e31018b3c63d1150b2ee7558810754e2abd1118ef0756c34c88fa7fde4b7108a477d5eb2b74930f7ac26140d2bf9140013afbf4e77f60b1b45af836c28bd3e36e8464f9bfd2f08159a017530a94d37fdb6a9ed3e9109b301cdfe9f495f6ed12b84044a37a6fdd94de4e0ab737bb266d1a47fabac6c339413a97f1054de64e2ccccb828e45277b89f6050fe6a7194f7a984d8266da699774db6c184b905d8a5a30e6d9fa154716a72deb776ae6429976a3d7c49d03a0b4ac072d47fe6b0fa9f63d61e300920a536ea7329568996d19b1b86d103ff1203f006f23991b3696e9d5fd80be3ad46dec010a5aa00ebbe4c272b684686062c7320630dc748af7a707a14426bbfeffeadfcfa12a1a65d6a42591859e325f9ba6296f7bc445c40ded405cccad5e94d68e16600617bf650c1fb237c939b50885e1e0607fb212d437ae40d5932aa29ec5e79787ed00bff428cf3609d916162f8c487ec796e9ff9f7a37a6e4a0ad18ba0fdc106fc2475a94430fa239b9350086ab998e1af6157b1975ba6388803fd0de42ffb8b603f00a9adf5b651bfe77ac51145804bc272204b9ee31a635d50ac6db58077a7d71c6d8ccd9245d913c7e648b9dcecbd7366d1213312670c360e7819af35eefd03682713d56a8696ff31da684d6801151adf6f8874d68a8e51d28c9a650cdbd268630dfd5e0bf065a42bed906e4ca3fe750230ac971d881f7edaa72f5a555c8174bccb9975ed63de1db0df95ca5a1e64a730924321f4f6ec8fcb90375c5211ed3ad9fd207f527abd7a05ae4d5a909377f5935303622fd4cbb874571862c9e7433cd5c0abd802789d2183d2a3be5c6f4eb98426064f01bfe943bdaa153925d5e89f67d3e87b0f086d0a2b2c608c265a05df8bdc738dfb41746b18f212bfa3fa908dd58554ed806fb65c27c34b85da3b06d10fc26cc26b23fd4a063706c2405d95e5d3f760f4ec1b082a073ddafecf437975d5aba6dc2c63615d28021dffb7a62a92540244acf58938a0a5aa147", 0x2000, &(0x7f0000000f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000bc0)={0x1f0, 0x0, 0x0, [{{0x3, 0xa1, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}}, {0x0, 0x0, 0x5, 0x0, 'fuse\x00'}}, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}, {0x0, 0x0, 0x1, 0x0, '\x00'}}, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000}}, {0x0, 0x0, 0x5, 0x0, 'fuse\x00'}}]}, 0x0, 0x0}) getdents64(r1, 0x0, 0x0) 01:24:21 executing program 2: syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000402505a8a440000102030109021b0001010000000904000000070100000905010200000000003d338b308d9d02400be6b241ae23547400cdf81340625fb55880373af85b6fb54a13f761f350be19469e47b08687765d156db53a315ce4ecbf1f62a7bebf6c3453a1999be1b18d454ae7b1481dbb18c3a8583b4bef93a451b5d78fd6231d595c72e939bde925bbb07a215764370d66aa59603ae1de5109003fb7b47291aeb6339f5865b17e78449b037d892c51749954452c61d0bca11c55537021eb24cba086fd2a0e2f988b58d3953c00000000"], 0x0) (async, rerun: 32) syz_usb_connect$cdc_ncm(0x5, 0x96, &(0x7f00000004c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x84, 0x2, 0x1, 0x3, 0xf0, 0x46, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "5ee2f8e9"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x101, 0x1ff, 0x5, 0xfa}, {0x6, 0x24, 0x1a, 0x9, 0xd}, [@acm={0x4}, @country_functional={0x8, 0x24, 0x7, 0x1, 0x5, [0x1f]}, @mbim_extended={0x8, 0x24, 0x1c, 0x1ff, 0x3, 0x8}, @mbim_extended={0x8, 0x24, 0x1c, 0x5, 0xff, 0x21}, @mbim_extended={0x8, 0x24, 0x1c, 0x81, 0x0, 0x9}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0xfc, 0x7f}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x5, 0xf8, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x4, 0x1, 0xff}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x80, 0x5, 0x1d, 0xff, 0x1f}, 0x54, &(0x7f0000000200)={0x5, 0xf, 0x54, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0xe1, "78d56ba2423342e001031a84fdd80117"}, @ssp_cap={0x24, 0x10, 0xa, 0xac, 0x6, 0x3, 0xff00, 0x7fff, [0xff7ed8, 0x3ff0, 0xf, 0xc000, 0x0, 0xff0000]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x6, 0x2, 0x0, 0xff0f, 0x8, [0xff000f, 0xffc000]}]}, 0x5, [{0x1b, &(0x7f0000000280)=@string={0x1b, 0x3, "9d8d71c6ca0fd5feaa51ac71ff9e6780883a71ff5e8d461d8c"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x43f}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x140a}}, {0xbe, &(0x7f0000000340)=@string={0xbe, 0x3, "998717031885685fd9bfc7ef139c01b3f7442210e3753f8731cc1db90e08efaa36a287590f7006173f412d8577e4a852665a85148339c1da07a386b3ddb669d7b9da485022484bdeeb5c1d8a55da5860c6c02b9ef077235345885785fe364d7c3e8a8e484dd19736b4a1c0a96568b4757faf28a2f7ac05ab92a5b1adae7d3f244227115517015421ade87aeb62f8461c17318ec34100586e1dce0685f85c60b16c7e7b1c6d3c6fd70aa1685eb89204661ac1f0b8cc1888d5317f6f93"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x1c09}}]}) (rerun: 32) 01:24:21 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) [ 428.885689][ T6199] fuse: Bad value for 'rootmode' [ 428.901079][ T6198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.933866][ T6198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.945541][ T6201] netlink: 5132 bytes leftover after parsing attributes in process `syz-executor.5'. 01:24:21 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:21 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 428.981291][ T6198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.998665][ T6201] netlink: 468 bytes leftover after parsing attributes in process `syz-executor.5'. [ 429.038199][ T6198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.076612][ T6198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy 01:24:21 executing program 5: r0 = syz_usb_connect(0x4, 0x65, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xe1, 0x43, 0x69, 0x0, 0x19d2, 0xfff6, 0xb6af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x26, 0x0, "a01e91112867f6e8102b5d51e58df7f105f275814ec397b5c7b9e96a46df3c4c6cdaa7ea"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x9, 0x0, "a1d5d003b12456"}]}}]}}]}}]}}, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000002a105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000140)={0xffffffffffffff49, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00226000000096fa00ef9e264f6f7e5a4a018d26e53f77200000002a6a01070900be0083"], 0x0}, 0x0) r2 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb653, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x50, 0x5, [{{0x9, 0x4, 0x0, 0x19, 0x1, 0x3, 0x1, 0x1, 0x12, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xbd2}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x5, 0x25, 0x1f}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x7, 0x3, 0xde}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x40, 0x9, 0x1, 0x8, 0x5}, 0x27, &(0x7f00000000c0)={0x5, 0xf, 0x27, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0xc3, 0x3, 0x9, 0x5}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x4, 0xf00f, 0x1c, [0x3f, 0xc000]}, @ptm_cap={0x3}]}, 0x1, [{0x68, &(0x7f00000001c0)=@string={0x68, 0x3, "98bda5135022dd863b8d6af13481c4f48aee990f89f58d418d70fc461346b729d9cdc2bea8b626f8d25d574ed2c06d1563aebf06043865a1f299d065d32e20394d4f581e7647b6052d4045f64fa95489766d8a56b37687c05d1b4a49b093d3426364c5c56bac"}}]}) syz_usb_control_io$hid(r0, &(0x7f0000001480)={0x24, &(0x7f0000001340)={0x40, 0x22, 0x56, {0x56, 0x23, "3bc5e636574689c226c542fab2d6ed155ed00c8a52aa229e986e0416e0efba257ba16c0fe78ebb7138304b21456b6329ede71f22af8839d71a528da2784fdcb5bcf2068fc0c37f24fd26e9c30da4c066cf10ed35"}}, &(0x7f00000013c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, &(0x7f0000001400)={0x0, 0x22, 0x15, {[@main=@item_012={0x2, 0x0, 0x8, "b251"}, @global=@item_012={0x1, 0x1, 0xf, 'm'}, @local=@item_4={0x3, 0x2, 0x4, "e654065b"}, @local=@item_012={0x2, 0x2, 0x4, "ed1e"}, @global=@item_012={0x1, 0x1, 0x9, "9f"}, @local=@item_012={0x2, 0x2, 0x4, "d2dc"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x1, 0x1, 0xb, '#'}]}}, &(0x7f0000001440)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0x95c}}}}, &(0x7f0000001600)={0x2c, &(0x7f00000014c0)={0x0, 0x8, 0x32, "0e1402e0ac81fa8f435f9d3dd5297d80b2b89a1ca89ea910adc44df3da7c5b78b69b9eb52f4658a58f91e3fd08d40231bfaf"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001580)={0x20, 0x1, 0x4, "aff4661c"}, &(0x7f00000015c0)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io(r2, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x40, 0x24, 0xab, {0xab, 0x11, "1526cdeabfc80239bde85ea6fa177e60c1532bc7e9a34b2a7cea18b73bf50e8c228d72cc9a9b9dbe0ae70a4ec1428e5216d90d05869b6b81ba3826658fa515dc3da82d549d9e290ba161f1a4504046bb2df8e6fffe075129df9aae45824ccf2bea2589839ee418ce8b78df917b0fd6adcd91e592350220ca6180d1e6f30bde24292bf6b571cb5833f086aebfb4c4e6be3ef99b8c0b0724b7fcbcc4df05b6987cf28e38811cffa14bd3"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2c0a}}, &(0x7f0000000380)={0x0, 0xf, 0x1c, {0x5, 0xf, 0x1c, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x5, 0x88c}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x3, 0x6eec}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x60, 0x5, 0x0, "a7940c3b", "12215711"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x4, 0x7f, 0x8, 0x3f, 0x73, 0x7}}}, &(0x7f0000000940)={0x84, &(0x7f0000000480)={0x0, 0x17, 0xea, "8e0cd775341a7737a44d3c0600d2c1ade4f1a64141966b2f0c8b03dd800a9dcce0007182bb30f040748797e874a9044c37e7230b55ef8f5d570b4d9bed4e30555a9c14cfb531adeafa029185b47036be3ecc9c97ae657b9a65775e234985ce7727b5e1ab584ca58131787e395b1ecbe9507a844c35e15e22ad2fd88349d2e50084f6f1c8fd1e565c340e6f1c1aa1a70932a43c13920e1651b9b5395dc50afb2a40188ada00b466a96921e28878fb19b68775e48a8f3b26c124d2152680390e6908b20fa90f99e251f9693235aa9ccb59be7ee6653cc262495eb9697029d29cdcac90f8a462d316952c26"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3d}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x25}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x400, 0x4}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0xc0}, &(0x7f0000000700)={0x40, 0xb, 0x2, '3X'}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xc6}, &(0x7f0000000780)={0x40, 0x13, 0x6}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000800)={0x40, 0x19, 0x2, "2ec8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xfff}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x3b}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x1}}) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f0009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "6c4bd65e"}, @local=@item_4={0x3, 0x2, 0x0, "b23e7cce"}, @main=@item_4={0x3, 0x0, 0x8, "c6482428"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001780)={0x24, &(0x7f0000001640)={0x40, 0xa, 0x6f, {0x6f, 0xb, "9bf5e02dda469dbfe6e5f9590c834a815dd9c4eb866e956b8b33de92b24982a0a575a1463e0cf8fd18bfecd474e70a97da06f7012a01a94e435c949db7b1e7c9e186078f01726c94c5ec6ae8021644a563879d4e208c111108a568d2c701e0987caef8c1579adaddef2221c5ef"}}, &(0x7f00000016c0)={0x0, 0x3, 0x34, @string={0x34, 0x3, "189ad533a26c5a4202d9f57f825fc53705f9e21075b5b1f9550e63f092cb560fee73c6de743568c529293dc50a65bb6c8546"}}, &(0x7f0000001700)={0x0, 0x22, 0xe, {[@global=@item_4={0x3, 0x1, 0x1, "c3043581"}, @main=@item_012={0x1, 0x0, 0xa, '='}, @global=@item_4={0x3, 0x1, 0x1, "8c9ab845"}, @global=@item_012={0x0, 0x1, 0x6}, @main=@item_012={0x0, 0x0, 0x8}]}}, &(0x7f0000001740)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1000, 0x8, 0x1, {0x22, 0x123}}}}, &(0x7f0000001940)={0x2c, &(0x7f00000017c0)={0x0, 0x14, 0x74, "7144befe3ebec2b7cbe6a07d33affcb62986f37c7e37b73090b95740f2fce225ae2cf78028810afa55f734e4d5116917f06338c77a15569e5cde219d1e5aaa2081cef87cc590e3f7ead78b3f2a41cea9d3a414e2789cfba5998e700a57b1b57cfd18794b4226af3f5131fddf8eb8b96fdff4a04d"}, &(0x7f0000001840)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000001880)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000018c0), &(0x7f0000001900)={0x20, 0x3, 0x1, 0x7}}) syz_usb_control_io(r0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000a00)={0x40, 0x23, 0xc3, {0xc3, 0x7, "60ae2a5f7d37626ff5c9eb29c9ce81b1890dd3b95b222deab38cfdd682440cf4032ac6f302511dc1716bb27622079eec3b7ae5aceecf91622e1ac6c74a8ec59b24e863bc6e94801fd0b2443ac49046d4a3b4b30a974280da5a3d2b58c72be3b0388184872d053924c43d84ac3c64da338ba68e8ee19e05181e5ca27259819d8c4cd965bf29d566f53fd9cc204f004f7c5ea624643ea31d29501e4767426ef8cacbfa757190069e6f82c80087ded8316b2451d73cf3140a18bf836e743d75522714"}}, &(0x7f0000000b00)={0x0, 0x3, 0xd4, @string={0xd4, 0x3, "fe519fb42266ab7c73958692641fb597f14f68428a57e7254a74bb0d28a17416977d7bfb37b7db7d0830634d3dd90f69cdfdc0a91eb83598918387e3daec25bd5eb48fda8b0c62b6ecd908e74612d3263bafa7ddecf67eb95edf08955a6fa6aa52834550a0cd8cb3f1f7ef06bb4ba87288dcff3e08492587823852b3d908f5749d098ae3fc7120973346cd9c669c188c5f6a704a37906fa5ef6982d38c36536927805f502ef356e6813fe547f1a0a2ceac42566979983f4a7b2cec41dfec54ec992f5837e77c730ee847f56ebbed3825ee1c"}}, &(0x7f0000000c00)={0x0, 0xf, 0x116, {0x5, 0xf, 0x116, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x0, 0x0, 0x4, 0xf00, 0x8}, @generic={0xf4, 0x10, 0xa, "2d00af65c4a13a7acaddbb4766c5b1e6c4507c12d6118ce7533a891b8237dc99a680ead97a3f966e859f19bdc861249afd4ae1a44046f70efb95491a10fee63bd66ecdd497bb4547e5492e231ddf4616ced64be217222024c8ba3cc8896eca353e5839a48935653edbd09aa4e4ea1b6a77c9ddc73cc9b77b5fec1373a5309741e286f7025d8572f1f8c3165357f94f415576320a707901da0f60588ccadd247622148a826db92b94f5f7fbe3d47bfc55335b74005ff1577876558ce7588153db0c5d27b13762db8569ab3af3f2c0901eae09e09b9fdd37b7a7d1eecebbe54ec74a1efe310b38aa0c30592b2981b945becf"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x1f, 0x0, 0xbf76}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0xc, 0xff}]}}, &(0x7f0000000d40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0xe6, 0x1, 0x5e, "213828f7", "4b885869"}}, &(0x7f0000000d80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x3, 0x1, 0x8, 0x9, 0x9, 0x4}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e00)={0x20, 0x31, 0x85, "d27f66b5d63e369d26bc25f60feb742f67a201fd88beea4c7e4a2991b350ae20ed395a92337b3b0acf0a102aa3321f51f2b9bdd15f0ed1c53392ab04982bac2ab4642959ca8b25f7e3667b9d905db65305222216896a80dae34258eed9ab46901fc83f7f77a996f644b6e124b50906525f28d55fe29d518a8fbdb4e5b25df350b1db9d9a71"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x100, 0x10}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d5f8"}, &(0x7f0000001080)={0x40, 0xf, 0x2}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f0000001100)={0x40, 0x17, 0x6, @random="e7e90fbb5515"}, &(0x7f0000001140)={0x40, 0x19, 0x2, "519d"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0x8001}, &(0x7f00000011c0)={0x40, 0x1c, 0x1}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x2}}) syz_usb_ep_write(r1, 0x0, 0xffffffffffffff13, &(0x7f0000000100)='\x00\x00\x00\x00\x00') [ 429.150397][ T6198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.167874][ T14] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 429.186644][ T6198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy 01:24:21 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:21 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 429.213276][ T6198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.235541][ T6198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.259593][ T6198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 01:24:21 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 429.508174][ T5180] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 429.528102][ T14] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 429.738083][ T14] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 429.747238][ T14] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.762194][ T14] usb 3-1: Product: syz [ 429.777789][ T14] usb 3-1: Manufacturer: syz [ 429.783283][ T14] usb 3-1: SerialNumber: syz [ 429.797892][ T5180] usb 6-1: Using ep0 maxpacket: 16 [ 429.940726][ T5180] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 429.952209][ T5180] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 429.965474][ T5180] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 429.974700][ T5180] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.993438][ T5180] usb 6-1: config 0 descriptor?? [ 430.056478][ T901] usb 3-1: USB disconnect, device number 9 [ 430.494829][ T5180] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 430.509668][ T5180] HID 045e:07da: Invalid code 65791 type 1 [ 430.520741][ T5180] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0001/input/input9 [ 430.615495][ T5180] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 430.697771][ T6211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.707595][ T6211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.723174][ T6211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.734052][ T6211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.053573][ T14] usb 6-1: USB disconnect, device number 17 [ 435.397971][ T4749] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 435.778104][ T4749] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 435.788035][ T4749] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 435.797849][ T4749] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 435.898143][ T4749] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 435.907274][ T4749] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 435.915421][ T4749] usb 2-1: SerialNumber: syz [ 435.979929][ T4749] usb-storage 2-1:1.0: USB Mass Storage device detected [ 435.992124][ T4749] scsi host1: usb-storage 2-1:1.0 [ 436.197368][ T6223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.206159][ T6223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.311000][ T5179] usb 2-1: USB disconnect, device number 3 01:24:30 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f00000004c0)={0x14, &(0x7f0000000440)={0x40, 0xa, 0x60, {0x60, 0xf, "2c797a1671753310778bad12d2a14f48b5546f6b924ba25e087185644412a8725bcda8335f918b5e160001bac11e075c97b591353655b2261a135f024ca0d069c346c4599182b6a8597364decf856217c5e762bf09383360ed3a9ba99861"}}, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000880)={0x1c, &(0x7f0000000780)={0x0, 0x16, 0x54, "68d19bb930075a587b7dc2acdf57ea46bbe73f0badf1d2a8b0890c1b00a0e4c031fcff5ea7706d737346362688261fc8e50b98fb55f7d1c3ee9aa775d683f4ab2ffd851b3b5461096854cf3611d35d1b95d0c06c"}, &(0x7f0000000800)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000000840)={0x0, 0x8, 0x1, 0x40}}) 01:24:30 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:30 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) (async) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) 01:24:30 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) 01:24:30 executing program 5: r0 = syz_usb_connect(0x4, 0x65, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xe1, 0x43, 0x69, 0x0, 0x19d2, 0xfff6, 0xb6af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x26, 0x0, "a01e91112867f6e8102b5d51e58df7f105f275814ec397b5c7b9e96a46df3c4c6cdaa7ea"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x9, 0x0, "a1d5d003b12456"}]}}]}}]}}]}}, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000002a105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000140)={0xffffffffffffff49, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00226000000096fa00ef9e264f6f7e5a4a018d26e53f77200000002a6a01070900be0083"], 0x0}, 0x0) r2 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb653, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x50, 0x5, [{{0x9, 0x4, 0x0, 0x19, 0x1, 0x3, 0x1, 0x1, 0x12, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xbd2}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x5, 0x25, 0x1f}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x7, 0x3, 0xde}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x40, 0x9, 0x1, 0x8, 0x5}, 0x27, &(0x7f00000000c0)={0x5, 0xf, 0x27, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0xc3, 0x3, 0x9, 0x5}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x4, 0xf00f, 0x1c, [0x3f, 0xc000]}, @ptm_cap={0x3}]}, 0x1, [{0x68, &(0x7f00000001c0)=@string={0x68, 0x3, "98bda5135022dd863b8d6af13481c4f48aee990f89f58d418d70fc461346b729d9cdc2bea8b626f8d25d574ed2c06d1563aebf06043865a1f299d065d32e20394d4f581e7647b6052d4045f64fa95489766d8a56b37687c05d1b4a49b093d3426364c5c56bac"}}]}) syz_usb_control_io$hid(r0, &(0x7f0000001480)={0x24, &(0x7f0000001340)={0x40, 0x22, 0x56, {0x56, 0x23, "3bc5e636574689c226c542fab2d6ed155ed00c8a52aa229e986e0416e0efba257ba16c0fe78ebb7138304b21456b6329ede71f22af8839d71a528da2784fdcb5bcf2068fc0c37f24fd26e9c30da4c066cf10ed35"}}, &(0x7f00000013c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, &(0x7f0000001400)={0x0, 0x22, 0x15, {[@main=@item_012={0x2, 0x0, 0x8, "b251"}, @global=@item_012={0x1, 0x1, 0xf, 'm'}, @local=@item_4={0x3, 0x2, 0x4, "e654065b"}, @local=@item_012={0x2, 0x2, 0x4, "ed1e"}, @global=@item_012={0x1, 0x1, 0x9, "9f"}, @local=@item_012={0x2, 0x2, 0x4, "d2dc"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x1, 0x1, 0xb, '#'}]}}, &(0x7f0000001440)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0x95c}}}}, &(0x7f0000001600)={0x2c, &(0x7f00000014c0)={0x0, 0x8, 0x32, "0e1402e0ac81fa8f435f9d3dd5297d80b2b89a1ca89ea910adc44df3da7c5b78b69b9eb52f4658a58f91e3fd08d40231bfaf"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001580)={0x20, 0x1, 0x4, "aff4661c"}, &(0x7f00000015c0)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io(r2, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x40, 0x24, 0xab, {0xab, 0x11, "1526cdeabfc80239bde85ea6fa177e60c1532bc7e9a34b2a7cea18b73bf50e8c228d72cc9a9b9dbe0ae70a4ec1428e5216d90d05869b6b81ba3826658fa515dc3da82d549d9e290ba161f1a4504046bb2df8e6fffe075129df9aae45824ccf2bea2589839ee418ce8b78df917b0fd6adcd91e592350220ca6180d1e6f30bde24292bf6b571cb5833f086aebfb4c4e6be3ef99b8c0b0724b7fcbcc4df05b6987cf28e38811cffa14bd3"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2c0a}}, &(0x7f0000000380)={0x0, 0xf, 0x1c, {0x5, 0xf, 0x1c, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x5, 0x88c}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x3, 0x6eec}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x60, 0x5, 0x0, "a7940c3b", "12215711"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x4, 0x7f, 0x8, 0x3f, 0x73, 0x7}}}, &(0x7f0000000940)={0x84, &(0x7f0000000480)={0x0, 0x17, 0xea, "8e0cd775341a7737a44d3c0600d2c1ade4f1a64141966b2f0c8b03dd800a9dcce0007182bb30f040748797e874a9044c37e7230b55ef8f5d570b4d9bed4e30555a9c14cfb531adeafa029185b47036be3ecc9c97ae657b9a65775e234985ce7727b5e1ab584ca58131787e395b1ecbe9507a844c35e15e22ad2fd88349d2e50084f6f1c8fd1e565c340e6f1c1aa1a70932a43c13920e1651b9b5395dc50afb2a40188ada00b466a96921e28878fb19b68775e48a8f3b26c124d2152680390e6908b20fa90f99e251f9693235aa9ccb59be7ee6653cc262495eb9697029d29cdcac90f8a462d316952c26"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3d}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x25}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x400, 0x4}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0xc0}, &(0x7f0000000700)={0x40, 0xb, 0x2, '3X'}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xc6}, &(0x7f0000000780)={0x40, 0x13, 0x6}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000800)={0x40, 0x19, 0x2, "2ec8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xfff}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x3b}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x1}}) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f0009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "6c4bd65e"}, @local=@item_4={0x3, 0x2, 0x0, "b23e7cce"}, @main=@item_4={0x3, 0x0, 0x8, "c6482428"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001780)={0x24, &(0x7f0000001640)={0x40, 0xa, 0x6f, {0x6f, 0xb, "9bf5e02dda469dbfe6e5f9590c834a815dd9c4eb866e956b8b33de92b24982a0a575a1463e0cf8fd18bfecd474e70a97da06f7012a01a94e435c949db7b1e7c9e186078f01726c94c5ec6ae8021644a563879d4e208c111108a568d2c701e0987caef8c1579adaddef2221c5ef"}}, &(0x7f00000016c0)={0x0, 0x3, 0x34, @string={0x34, 0x3, "189ad533a26c5a4202d9f57f825fc53705f9e21075b5b1f9550e63f092cb560fee73c6de743568c529293dc50a65bb6c8546"}}, &(0x7f0000001700)={0x0, 0x22, 0xe, {[@global=@item_4={0x3, 0x1, 0x1, "c3043581"}, @main=@item_012={0x1, 0x0, 0xa, '='}, @global=@item_4={0x3, 0x1, 0x1, "8c9ab845"}, @global=@item_012={0x0, 0x1, 0x6}, @main=@item_012={0x0, 0x0, 0x8}]}}, &(0x7f0000001740)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1000, 0x8, 0x1, {0x22, 0x123}}}}, &(0x7f0000001940)={0x2c, &(0x7f00000017c0)={0x0, 0x14, 0x74, "7144befe3ebec2b7cbe6a07d33affcb62986f37c7e37b73090b95740f2fce225ae2cf78028810afa55f734e4d5116917f06338c77a15569e5cde219d1e5aaa2081cef87cc590e3f7ead78b3f2a41cea9d3a414e2789cfba5998e700a57b1b57cfd18794b4226af3f5131fddf8eb8b96fdff4a04d"}, &(0x7f0000001840)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000001880)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000018c0), &(0x7f0000001900)={0x20, 0x3, 0x1, 0x7}}) syz_usb_control_io(r0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000a00)={0x40, 0x23, 0xc3, {0xc3, 0x7, "60ae2a5f7d37626ff5c9eb29c9ce81b1890dd3b95b222deab38cfdd682440cf4032ac6f302511dc1716bb27622079eec3b7ae5aceecf91622e1ac6c74a8ec59b24e863bc6e94801fd0b2443ac49046d4a3b4b30a974280da5a3d2b58c72be3b0388184872d053924c43d84ac3c64da338ba68e8ee19e05181e5ca27259819d8c4cd965bf29d566f53fd9cc204f004f7c5ea624643ea31d29501e4767426ef8cacbfa757190069e6f82c80087ded8316b2451d73cf3140a18bf836e743d75522714"}}, &(0x7f0000000b00)={0x0, 0x3, 0xd4, @string={0xd4, 0x3, "fe519fb42266ab7c73958692641fb597f14f68428a57e7254a74bb0d28a17416977d7bfb37b7db7d0830634d3dd90f69cdfdc0a91eb83598918387e3daec25bd5eb48fda8b0c62b6ecd908e74612d3263bafa7ddecf67eb95edf08955a6fa6aa52834550a0cd8cb3f1f7ef06bb4ba87288dcff3e08492587823852b3d908f5749d098ae3fc7120973346cd9c669c188c5f6a704a37906fa5ef6982d38c36536927805f502ef356e6813fe547f1a0a2ceac42566979983f4a7b2cec41dfec54ec992f5837e77c730ee847f56ebbed3825ee1c"}}, &(0x7f0000000c00)={0x0, 0xf, 0x116, {0x5, 0xf, 0x116, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x0, 0x0, 0x4, 0xf00, 0x8}, @generic={0xf4, 0x10, 0xa, "2d00af65c4a13a7acaddbb4766c5b1e6c4507c12d6118ce7533a891b8237dc99a680ead97a3f966e859f19bdc861249afd4ae1a44046f70efb95491a10fee63bd66ecdd497bb4547e5492e231ddf4616ced64be217222024c8ba3cc8896eca353e5839a48935653edbd09aa4e4ea1b6a77c9ddc73cc9b77b5fec1373a5309741e286f7025d8572f1f8c3165357f94f415576320a707901da0f60588ccadd247622148a826db92b94f5f7fbe3d47bfc55335b74005ff1577876558ce7588153db0c5d27b13762db8569ab3af3f2c0901eae09e09b9fdd37b7a7d1eecebbe54ec74a1efe310b38aa0c30592b2981b945becf"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x1f, 0x0, 0xbf76}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0xc, 0xff}]}}, &(0x7f0000000d40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0xe6, 0x1, 0x5e, "213828f7", "4b885869"}}, &(0x7f0000000d80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x3, 0x1, 0x8, 0x9, 0x9, 0x4}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e00)={0x20, 0x31, 0x85, "d27f66b5d63e369d26bc25f60feb742f67a201fd88beea4c7e4a2991b350ae20ed395a92337b3b0acf0a102aa3321f51f2b9bdd15f0ed1c53392ab04982bac2ab4642959ca8b25f7e3667b9d905db65305222216896a80dae34258eed9ab46901fc83f7f77a996f644b6e124b50906525f28d55fe29d518a8fbdb4e5b25df350b1db9d9a71"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x100, 0x10}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d5f8"}, &(0x7f0000001080)={0x40, 0xf, 0x2}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f0000001100)={0x40, 0x17, 0x6, @random="e7e90fbb5515"}, &(0x7f0000001140)={0x40, 0x19, 0x2, "519d"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0x8001}, &(0x7f00000011c0)={0x40, 0x1c, 0x1}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x2}}) syz_usb_ep_write(r1, 0x0, 0xffffffffffffff13, &(0x7f0000000100)='\x00\x00\x00\x00\x00') syz_usb_connect(0x4, 0x65, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xe1, 0x43, 0x69, 0x0, 0x19d2, 0xfff6, 0xb6af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x26, 0x0, "a01e91112867f6e8102b5d51e58df7f105f275814ec397b5c7b9e96a46df3c4c6cdaa7ea"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x9, 0x0, "a1d5d003b12456"}]}}]}}]}}]}}, 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000002a105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, &(0x7f0000000140)={0xffffffffffffff49, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00226000000096fa00ef9e264f6f7e5a4a018d26e53f77200000002a6a01070900be0083"], 0x0}, 0x0) (async) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb653, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x50, 0x5, [{{0x9, 0x4, 0x0, 0x19, 0x1, 0x3, 0x1, 0x1, 0x12, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xbd2}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x5, 0x25, 0x1f}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x7, 0x3, 0xde}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x40, 0x9, 0x1, 0x8, 0x5}, 0x27, &(0x7f00000000c0)={0x5, 0xf, 0x27, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0xc3, 0x3, 0x9, 0x5}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x4, 0xf00f, 0x1c, [0x3f, 0xc000]}, @ptm_cap={0x3}]}, 0x1, [{0x68, &(0x7f00000001c0)=@string={0x68, 0x3, "98bda5135022dd863b8d6af13481c4f48aee990f89f58d418d70fc461346b729d9cdc2bea8b626f8d25d574ed2c06d1563aebf06043865a1f299d065d32e20394d4f581e7647b6052d4045f64fa95489766d8a56b37687c05d1b4a49b093d3426364c5c56bac"}}]}) (async) syz_usb_control_io$hid(r0, &(0x7f0000001480)={0x24, &(0x7f0000001340)={0x40, 0x22, 0x56, {0x56, 0x23, "3bc5e636574689c226c542fab2d6ed155ed00c8a52aa229e986e0416e0efba257ba16c0fe78ebb7138304b21456b6329ede71f22af8839d71a528da2784fdcb5bcf2068fc0c37f24fd26e9c30da4c066cf10ed35"}}, &(0x7f00000013c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, &(0x7f0000001400)={0x0, 0x22, 0x15, {[@main=@item_012={0x2, 0x0, 0x8, "b251"}, @global=@item_012={0x1, 0x1, 0xf, 'm'}, @local=@item_4={0x3, 0x2, 0x4, "e654065b"}, @local=@item_012={0x2, 0x2, 0x4, "ed1e"}, @global=@item_012={0x1, 0x1, 0x9, "9f"}, @local=@item_012={0x2, 0x2, 0x4, "d2dc"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x1, 0x1, 0xb, '#'}]}}, &(0x7f0000001440)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0x95c}}}}, &(0x7f0000001600)={0x2c, &(0x7f00000014c0)={0x0, 0x8, 0x32, "0e1402e0ac81fa8f435f9d3dd5297d80b2b89a1ca89ea910adc44df3da7c5b78b69b9eb52f4658a58f91e3fd08d40231bfaf"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001580)={0x20, 0x1, 0x4, "aff4661c"}, &(0x7f00000015c0)={0x20, 0x3, 0x1, 0x3}}) (async) syz_usb_control_io(r2, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x40, 0x24, 0xab, {0xab, 0x11, "1526cdeabfc80239bde85ea6fa177e60c1532bc7e9a34b2a7cea18b73bf50e8c228d72cc9a9b9dbe0ae70a4ec1428e5216d90d05869b6b81ba3826658fa515dc3da82d549d9e290ba161f1a4504046bb2df8e6fffe075129df9aae45824ccf2bea2589839ee418ce8b78df917b0fd6adcd91e592350220ca6180d1e6f30bde24292bf6b571cb5833f086aebfb4c4e6be3ef99b8c0b0724b7fcbcc4df05b6987cf28e38811cffa14bd3"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2c0a}}, &(0x7f0000000380)={0x0, 0xf, 0x1c, {0x5, 0xf, 0x1c, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x5, 0x88c}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x3, 0x6eec}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x60, 0x5, 0x0, "a7940c3b", "12215711"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x4, 0x7f, 0x8, 0x3f, 0x73, 0x7}}}, &(0x7f0000000940)={0x84, &(0x7f0000000480)={0x0, 0x17, 0xea, "8e0cd775341a7737a44d3c0600d2c1ade4f1a64141966b2f0c8b03dd800a9dcce0007182bb30f040748797e874a9044c37e7230b55ef8f5d570b4d9bed4e30555a9c14cfb531adeafa029185b47036be3ecc9c97ae657b9a65775e234985ce7727b5e1ab584ca58131787e395b1ecbe9507a844c35e15e22ad2fd88349d2e50084f6f1c8fd1e565c340e6f1c1aa1a70932a43c13920e1651b9b5395dc50afb2a40188ada00b466a96921e28878fb19b68775e48a8f3b26c124d2152680390e6908b20fa90f99e251f9693235aa9ccb59be7ee6653cc262495eb9697029d29cdcac90f8a462d316952c26"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3d}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x25}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x400, 0x4}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0xc0}, &(0x7f0000000700)={0x40, 0xb, 0x2, '3X'}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xc6}, &(0x7f0000000780)={0x40, 0x13, 0x6}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000800)={0x40, 0x19, 0x2, "2ec8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xfff}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x3b}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x1}}) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f0009058103"], 0x0) (async) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "6c4bd65e"}, @local=@item_4={0x3, 0x2, 0x0, "b23e7cce"}, @main=@item_4={0x3, 0x0, 0x8, "c6482428"}]}}, 0x0}, 0x0) (async) syz_usb_control_io$hid(r3, &(0x7f0000001780)={0x24, &(0x7f0000001640)={0x40, 0xa, 0x6f, {0x6f, 0xb, "9bf5e02dda469dbfe6e5f9590c834a815dd9c4eb866e956b8b33de92b24982a0a575a1463e0cf8fd18bfecd474e70a97da06f7012a01a94e435c949db7b1e7c9e186078f01726c94c5ec6ae8021644a563879d4e208c111108a568d2c701e0987caef8c1579adaddef2221c5ef"}}, &(0x7f00000016c0)={0x0, 0x3, 0x34, @string={0x34, 0x3, "189ad533a26c5a4202d9f57f825fc53705f9e21075b5b1f9550e63f092cb560fee73c6de743568c529293dc50a65bb6c8546"}}, &(0x7f0000001700)={0x0, 0x22, 0xe, {[@global=@item_4={0x3, 0x1, 0x1, "c3043581"}, @main=@item_012={0x1, 0x0, 0xa, '='}, @global=@item_4={0x3, 0x1, 0x1, "8c9ab845"}, @global=@item_012={0x0, 0x1, 0x6}, @main=@item_012={0x0, 0x0, 0x8}]}}, &(0x7f0000001740)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1000, 0x8, 0x1, {0x22, 0x123}}}}, &(0x7f0000001940)={0x2c, &(0x7f00000017c0)={0x0, 0x14, 0x74, "7144befe3ebec2b7cbe6a07d33affcb62986f37c7e37b73090b95740f2fce225ae2cf78028810afa55f734e4d5116917f06338c77a15569e5cde219d1e5aaa2081cef87cc590e3f7ead78b3f2a41cea9d3a414e2789cfba5998e700a57b1b57cfd18794b4226af3f5131fddf8eb8b96fdff4a04d"}, &(0x7f0000001840)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000001880)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000018c0), &(0x7f0000001900)={0x20, 0x3, 0x1, 0x7}}) (async) syz_usb_control_io(r0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000a00)={0x40, 0x23, 0xc3, {0xc3, 0x7, "60ae2a5f7d37626ff5c9eb29c9ce81b1890dd3b95b222deab38cfdd682440cf4032ac6f302511dc1716bb27622079eec3b7ae5aceecf91622e1ac6c74a8ec59b24e863bc6e94801fd0b2443ac49046d4a3b4b30a974280da5a3d2b58c72be3b0388184872d053924c43d84ac3c64da338ba68e8ee19e05181e5ca27259819d8c4cd965bf29d566f53fd9cc204f004f7c5ea624643ea31d29501e4767426ef8cacbfa757190069e6f82c80087ded8316b2451d73cf3140a18bf836e743d75522714"}}, &(0x7f0000000b00)={0x0, 0x3, 0xd4, @string={0xd4, 0x3, "fe519fb42266ab7c73958692641fb597f14f68428a57e7254a74bb0d28a17416977d7bfb37b7db7d0830634d3dd90f69cdfdc0a91eb83598918387e3daec25bd5eb48fda8b0c62b6ecd908e74612d3263bafa7ddecf67eb95edf08955a6fa6aa52834550a0cd8cb3f1f7ef06bb4ba87288dcff3e08492587823852b3d908f5749d098ae3fc7120973346cd9c669c188c5f6a704a37906fa5ef6982d38c36536927805f502ef356e6813fe547f1a0a2ceac42566979983f4a7b2cec41dfec54ec992f5837e77c730ee847f56ebbed3825ee1c"}}, &(0x7f0000000c00)={0x0, 0xf, 0x116, {0x5, 0xf, 0x116, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x0, 0x0, 0x4, 0xf00, 0x8}, @generic={0xf4, 0x10, 0xa, "2d00af65c4a13a7acaddbb4766c5b1e6c4507c12d6118ce7533a891b8237dc99a680ead97a3f966e859f19bdc861249afd4ae1a44046f70efb95491a10fee63bd66ecdd497bb4547e5492e231ddf4616ced64be217222024c8ba3cc8896eca353e5839a48935653edbd09aa4e4ea1b6a77c9ddc73cc9b77b5fec1373a5309741e286f7025d8572f1f8c3165357f94f415576320a707901da0f60588ccadd247622148a826db92b94f5f7fbe3d47bfc55335b74005ff1577876558ce7588153db0c5d27b13762db8569ab3af3f2c0901eae09e09b9fdd37b7a7d1eecebbe54ec74a1efe310b38aa0c30592b2981b945becf"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x1f, 0x0, 0xbf76}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0xc, 0xff}]}}, &(0x7f0000000d40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0xe6, 0x1, 0x5e, "213828f7", "4b885869"}}, &(0x7f0000000d80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x3, 0x1, 0x8, 0x9, 0x9, 0x4}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e00)={0x20, 0x31, 0x85, "d27f66b5d63e369d26bc25f60feb742f67a201fd88beea4c7e4a2991b350ae20ed395a92337b3b0acf0a102aa3321f51f2b9bdd15f0ed1c53392ab04982bac2ab4642959ca8b25f7e3667b9d905db65305222216896a80dae34258eed9ab46901fc83f7f77a996f644b6e124b50906525f28d55fe29d518a8fbdb4e5b25df350b1db9d9a71"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x100, 0x10}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d5f8"}, &(0x7f0000001080)={0x40, 0xf, 0x2}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f0000001100)={0x40, 0x17, 0x6, @random="e7e90fbb5515"}, &(0x7f0000001140)={0x40, 0x19, 0x2, "519d"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0x8001}, &(0x7f00000011c0)={0x40, 0x1c, 0x1}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x2}}) (async) syz_usb_ep_write(r1, 0x0, 0xffffffffffffff13, &(0x7f0000000100)='\x00\x00\x00\x00\x00') (async) 01:24:30 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:30 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:30 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 438.127905][ T4749] usb 6-1: new high-speed USB device number 18 using dummy_hcd 01:24:30 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:30 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 438.378050][ T4749] usb 6-1: Using ep0 maxpacket: 16 01:24:31 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 438.498166][ T4749] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.526418][ T4749] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 438.564997][ T4749] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 438.604138][ T4749] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.638523][ T4749] usb 6-1: config 0 descriptor?? [ 439.130805][ T4749] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 439.145698][ T4749] HID 045e:07da: Invalid code 65791 type 1 [ 439.154304][ T4749] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0002/input/input10 [ 439.252259][ T4749] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 439.335545][ T6232] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.345458][ T6232] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.356020][ T6232] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.365858][ T6232] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.679562][ T6261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.688800][ T6261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.706244][ T7] usb 6-1: USB disconnect, device number 18 [ 444.980537][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 444.986943][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 [ 446.447842][ T7] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 446.827893][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 446.838110][ T7] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 446.848306][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 446.948180][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 446.957394][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 446.965502][ T7] usb 2-1: SerialNumber: syz [ 447.019329][ T7] usb-storage 2-1:1.0: USB Mass Storage device detected [ 447.030441][ T7] scsi host1: usb-storage 2-1:1.0 01:24:39 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) 01:24:39 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:39 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:39 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) 01:24:39 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) 01:24:39 executing program 5: r0 = syz_usb_connect(0x4, 0x65, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xe1, 0x43, 0x69, 0x0, 0x19d2, 0xfff6, 0xb6af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x26, 0x0, "a01e91112867f6e8102b5d51e58df7f105f275814ec397b5c7b9e96a46df3c4c6cdaa7ea"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x9, 0x0, "a1d5d003b12456"}]}}]}}]}}]}}, 0x0) (async, rerun: 64) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000002a105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) (rerun: 64) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000140)={0xffffffffffffff49, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00226000000096fa00ef9e264f6f7e5a4a018d26e53f77200000002a6a01070900be0083"], 0x0}, 0x0) r2 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb653, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x50, 0x5, [{{0x9, 0x4, 0x0, 0x19, 0x1, 0x3, 0x1, 0x1, 0x12, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xbd2}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x5, 0x25, 0x1f}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x7, 0x3, 0xde}}]}}}]}}]}}, &(0x7f0000000240)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x40, 0x9, 0x1, 0x8, 0x5}, 0x27, &(0x7f00000000c0)={0x5, 0xf, 0x27, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0xc3, 0x3, 0x9, 0x5}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x4, 0xf00f, 0x1c, [0x3f, 0xc000]}, @ptm_cap={0x3}]}, 0x1, [{0x68, &(0x7f00000001c0)=@string={0x68, 0x3, "98bda5135022dd863b8d6af13481c4f48aee990f89f58d418d70fc461346b729d9cdc2bea8b626f8d25d574ed2c06d1563aebf06043865a1f299d065d32e20394d4f581e7647b6052d4045f64fa95489766d8a56b37687c05d1b4a49b093d3426364c5c56bac"}}]}) syz_usb_control_io$hid(r0, &(0x7f0000001480)={0x24, &(0x7f0000001340)={0x40, 0x22, 0x56, {0x56, 0x23, "3bc5e636574689c226c542fab2d6ed155ed00c8a52aa229e986e0416e0efba257ba16c0fe78ebb7138304b21456b6329ede71f22af8839d71a528da2784fdcb5bcf2068fc0c37f24fd26e9c30da4c066cf10ed35"}}, &(0x7f00000013c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, &(0x7f0000001400)={0x0, 0x22, 0x15, {[@main=@item_012={0x2, 0x0, 0x8, "b251"}, @global=@item_012={0x1, 0x1, 0xf, 'm'}, @local=@item_4={0x3, 0x2, 0x4, "e654065b"}, @local=@item_012={0x2, 0x2, 0x4, "ed1e"}, @global=@item_012={0x1, 0x1, 0x9, "9f"}, @local=@item_012={0x2, 0x2, 0x4, "d2dc"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x1, 0x1, 0xb, '#'}]}}, &(0x7f0000001440)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0x95c}}}}, &(0x7f0000001600)={0x2c, &(0x7f00000014c0)={0x0, 0x8, 0x32, "0e1402e0ac81fa8f435f9d3dd5297d80b2b89a1ca89ea910adc44df3da7c5b78b69b9eb52f4658a58f91e3fd08d40231bfaf"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001580)={0x20, 0x1, 0x4, "aff4661c"}, &(0x7f00000015c0)={0x20, 0x3, 0x1, 0x3}}) (async) syz_usb_control_io(r2, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x40, 0x24, 0xab, {0xab, 0x11, "1526cdeabfc80239bde85ea6fa177e60c1532bc7e9a34b2a7cea18b73bf50e8c228d72cc9a9b9dbe0ae70a4ec1428e5216d90d05869b6b81ba3826658fa515dc3da82d549d9e290ba161f1a4504046bb2df8e6fffe075129df9aae45824ccf2bea2589839ee418ce8b78df917b0fd6adcd91e592350220ca6180d1e6f30bde24292bf6b571cb5833f086aebfb4c4e6be3ef99b8c0b0724b7fcbcc4df05b6987cf28e38811cffa14bd3"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2c0a}}, &(0x7f0000000380)={0x0, 0xf, 0x1c, {0x5, 0xf, 0x1c, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x5, 0x88c}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x3, 0x6eec}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x60, 0x5, 0x0, "a7940c3b", "12215711"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x4, 0x7f, 0x8, 0x3f, 0x73, 0x7}}}, &(0x7f0000000940)={0x84, &(0x7f0000000480)={0x0, 0x17, 0xea, "8e0cd775341a7737a44d3c0600d2c1ade4f1a64141966b2f0c8b03dd800a9dcce0007182bb30f040748797e874a9044c37e7230b55ef8f5d570b4d9bed4e30555a9c14cfb531adeafa029185b47036be3ecc9c97ae657b9a65775e234985ce7727b5e1ab584ca58131787e395b1ecbe9507a844c35e15e22ad2fd88349d2e50084f6f1c8fd1e565c340e6f1c1aa1a70932a43c13920e1651b9b5395dc50afb2a40188ada00b466a96921e28878fb19b68775e48a8f3b26c124d2152680390e6908b20fa90f99e251f9693235aa9ccb59be7ee6653cc262495eb9697029d29cdcac90f8a462d316952c26"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3d}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x25}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x400, 0x4}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0xc0}, &(0x7f0000000700)={0x40, 0xb, 0x2, '3X'}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xc6}, &(0x7f0000000780)={0x40, 0x13, 0x6}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000800)={0x40, 0x19, 0x2, "2ec8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xfff}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x3b}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x1}}) (async, rerun: 32) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f0009058103"], 0x0) (rerun: 32) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "6c4bd65e"}, @local=@item_4={0x3, 0x2, 0x0, "b23e7cce"}, @main=@item_4={0x3, 0x0, 0x8, "c6482428"}]}}, 0x0}, 0x0) (async) syz_usb_control_io$hid(r3, &(0x7f0000001780)={0x24, &(0x7f0000001640)={0x40, 0xa, 0x6f, {0x6f, 0xb, "9bf5e02dda469dbfe6e5f9590c834a815dd9c4eb866e956b8b33de92b24982a0a575a1463e0cf8fd18bfecd474e70a97da06f7012a01a94e435c949db7b1e7c9e186078f01726c94c5ec6ae8021644a563879d4e208c111108a568d2c701e0987caef8c1579adaddef2221c5ef"}}, &(0x7f00000016c0)={0x0, 0x3, 0x34, @string={0x34, 0x3, "189ad533a26c5a4202d9f57f825fc53705f9e21075b5b1f9550e63f092cb560fee73c6de743568c529293dc50a65bb6c8546"}}, &(0x7f0000001700)={0x0, 0x22, 0xe, {[@global=@item_4={0x3, 0x1, 0x1, "c3043581"}, @main=@item_012={0x1, 0x0, 0xa, '='}, @global=@item_4={0x3, 0x1, 0x1, "8c9ab845"}, @global=@item_012={0x0, 0x1, 0x6}, @main=@item_012={0x0, 0x0, 0x8}]}}, &(0x7f0000001740)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1000, 0x8, 0x1, {0x22, 0x123}}}}, &(0x7f0000001940)={0x2c, &(0x7f00000017c0)={0x0, 0x14, 0x74, "7144befe3ebec2b7cbe6a07d33affcb62986f37c7e37b73090b95740f2fce225ae2cf78028810afa55f734e4d5116917f06338c77a15569e5cde219d1e5aaa2081cef87cc590e3f7ead78b3f2a41cea9d3a414e2789cfba5998e700a57b1b57cfd18794b4226af3f5131fddf8eb8b96fdff4a04d"}, &(0x7f0000001840)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000001880)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000018c0), &(0x7f0000001900)={0x20, 0x3, 0x1, 0x7}}) (async) syz_usb_control_io(r0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000a00)={0x40, 0x23, 0xc3, {0xc3, 0x7, "60ae2a5f7d37626ff5c9eb29c9ce81b1890dd3b95b222deab38cfdd682440cf4032ac6f302511dc1716bb27622079eec3b7ae5aceecf91622e1ac6c74a8ec59b24e863bc6e94801fd0b2443ac49046d4a3b4b30a974280da5a3d2b58c72be3b0388184872d053924c43d84ac3c64da338ba68e8ee19e05181e5ca27259819d8c4cd965bf29d566f53fd9cc204f004f7c5ea624643ea31d29501e4767426ef8cacbfa757190069e6f82c80087ded8316b2451d73cf3140a18bf836e743d75522714"}}, &(0x7f0000000b00)={0x0, 0x3, 0xd4, @string={0xd4, 0x3, "fe519fb42266ab7c73958692641fb597f14f68428a57e7254a74bb0d28a17416977d7bfb37b7db7d0830634d3dd90f69cdfdc0a91eb83598918387e3daec25bd5eb48fda8b0c62b6ecd908e74612d3263bafa7ddecf67eb95edf08955a6fa6aa52834550a0cd8cb3f1f7ef06bb4ba87288dcff3e08492587823852b3d908f5749d098ae3fc7120973346cd9c669c188c5f6a704a37906fa5ef6982d38c36536927805f502ef356e6813fe547f1a0a2ceac42566979983f4a7b2cec41dfec54ec992f5837e77c730ee847f56ebbed3825ee1c"}}, &(0x7f0000000c00)={0x0, 0xf, 0x116, {0x5, 0xf, 0x116, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x0, 0x0, 0x4, 0xf00, 0x8}, @generic={0xf4, 0x10, 0xa, "2d00af65c4a13a7acaddbb4766c5b1e6c4507c12d6118ce7533a891b8237dc99a680ead97a3f966e859f19bdc861249afd4ae1a44046f70efb95491a10fee63bd66ecdd497bb4547e5492e231ddf4616ced64be217222024c8ba3cc8896eca353e5839a48935653edbd09aa4e4ea1b6a77c9ddc73cc9b77b5fec1373a5309741e286f7025d8572f1f8c3165357f94f415576320a707901da0f60588ccadd247622148a826db92b94f5f7fbe3d47bfc55335b74005ff1577876558ce7588153db0c5d27b13762db8569ab3af3f2c0901eae09e09b9fdd37b7a7d1eecebbe54ec74a1efe310b38aa0c30592b2981b945becf"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x1f, 0x0, 0xbf76}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0xc, 0xff}]}}, &(0x7f0000000d40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0xe6, 0x1, 0x5e, "213828f7", "4b885869"}}, &(0x7f0000000d80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x3, 0x1, 0x8, 0x9, 0x9, 0x4}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e00)={0x20, 0x31, 0x85, "d27f66b5d63e369d26bc25f60feb742f67a201fd88beea4c7e4a2991b350ae20ed395a92337b3b0acf0a102aa3321f51f2b9bdd15f0ed1c53392ab04982bac2ab4642959ca8b25f7e3667b9d905db65305222216896a80dae34258eed9ab46901fc83f7f77a996f644b6e124b50906525f28d55fe29d518a8fbdb4e5b25df350b1db9d9a71"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x100, 0x10}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d5f8"}, &(0x7f0000001080)={0x40, 0xf, 0x2}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f0000001100)={0x40, 0x17, 0x6, @random="e7e90fbb5515"}, &(0x7f0000001140)={0x40, 0x19, 0x2, "519d"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0x8001}, &(0x7f00000011c0)={0x40, 0x1c, 0x1}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x2}}) (async) syz_usb_ep_write(r1, 0x0, 0xffffffffffffff13, &(0x7f0000000100)='\x00\x00\x00\x00\x00') [ 447.119691][ T5179] usb 2-1: USB disconnect, device number 4 01:24:39 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:39 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:39 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:39 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:40 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:40 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 457.827860][ T901] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 458.190306][ T901] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 458.200244][ T901] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 458.216123][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 458.308158][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 458.317362][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 458.325568][ T901] usb 2-1: SerialNumber: syz [ 458.395878][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected [ 458.407147][ T901] scsi host1: usb-storage 2-1:1.0 01:24:51 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) 01:24:51 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc002a9, 0x19) [ 458.478352][ T4749] usb 2-1: USB disconnect, device number 5 01:24:51 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:24:51 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 467.107954][ T4749] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 467.487923][ T4749] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 467.498066][ T4749] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 467.508484][ T4749] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 467.598069][ T4749] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 467.607272][ T4749] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 467.615790][ T4749] usb 2-1: SerialNumber: syz [ 467.677520][ T4749] usb-storage 2-1:1.0: USB Mass Storage device detected [ 467.701605][ T4749] scsi host1: usb-storage 2-1:1.0 [ 467.881283][ T6348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 467.892793][ T6348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.984665][ T5187] usb 2-1: USB disconnect, device number 6 01:25:02 executing program 1: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) 01:25:02 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 2: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 3: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) dup3(r0, r0, 0x0) r1 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r1, 0x10000000) syz_io_uring_submit(r2, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) 01:25:02 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:02 executing program 3: fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 470.027955][ T5187] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 470.417598][ T5187] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 470.428129][ T5187] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 470.439575][ T5187] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 470.528266][ T5187] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 470.539189][ T5187] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 470.547302][ T5187] usb 3-1: SerialNumber: syz [ 470.616030][ T5187] usb-storage 3-1:1.0: USB Mass Storage device detected [ 470.626183][ T5187] scsi host1: usb-storage 3-1:1.0 [ 470.836468][ T6368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.846923][ T6368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.950897][ T7] usb 3-1: USB disconnect, device number 10 [ 478.217828][ T22] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 478.589742][ T22] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 478.599760][ T22] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 478.610590][ T22] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 478.738529][ T22] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 478.747873][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 478.755900][ T22] usb 2-1: SerialNumber: syz [ 478.820279][ T22] usb-storage 2-1:1.0: USB Mass Storage device detected [ 478.837459][ T22] scsi host1: usb-storage 2-1:1.0 [ 479.041162][ T6384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.052511][ T6384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.069108][ T5187] usb 2-1: USB disconnect, device number 7 01:25:12 executing program 1: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) 01:25:12 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) 01:25:12 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:12 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 479.887831][ T22] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 480.248840][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 480.258876][ T22] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 480.270267][ T22] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 480.357954][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 480.367978][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 480.376030][ T22] usb 3-1: SerialNumber: syz [ 480.419964][ T22] usb-storage 3-1:1.0: USB Mass Storage device detected [ 480.430635][ T22] scsi host1: usb-storage 3-1:1.0 [ 480.639705][ T6400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.650757][ T6400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.710323][ T7] usb 3-1: USB disconnect, device number 11 [ 488.207917][ T5187] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 488.587940][ T5187] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 488.598324][ T5187] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 488.609243][ T5187] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 488.708087][ T5187] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 488.717501][ T5187] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 488.726394][ T5187] usb 2-1: SerialNumber: syz [ 488.769413][ T5187] usb-storage 2-1:1.0: USB Mass Storage device detected [ 488.782009][ T5187] scsi host1: usb-storage 2-1:1.0 01:25:21 executing program 1: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) 01:25:21 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) syz_usb_control_io(r0, 0x0, 0x0) [ 488.882981][ T901] usb 2-1: USB disconnect, device number 8 01:25:21 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:21 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 489.198005][ T4749] usb 3-1: new high-speed USB device number 12 using dummy_hcd 01:25:21 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 489.608094][ T4749] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 489.618231][ T4749] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 489.628857][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 489.720492][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 489.729891][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 489.738347][ T4749] usb 3-1: SerialNumber: syz [ 489.792414][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 489.804599][ T4749] scsi host1: usb-storage 3-1:1.0 [ 490.009915][ T6431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.018623][ T6431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.148055][ T7] usb 3-1: USB disconnect, device number 12 [ 497.488008][ T901] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 497.848945][ T901] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 497.858819][ T901] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 497.868936][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 497.957925][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 497.967211][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 497.975448][ T901] usb 2-1: SerialNumber: syz [ 498.029405][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected [ 498.042085][ T901] scsi host1: usb-storage 2-1:1.0 01:25:30 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:25:30 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) [ 498.167330][ T901] usb 2-1: USB disconnect, device number 9 01:25:30 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:30 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:31 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:31 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 498.488172][ T22] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 498.898358][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 498.910426][ T22] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 498.920460][ T22] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 499.030469][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 499.039761][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 499.048496][ T22] usb 3-1: SerialNumber: syz [ 499.099769][ T22] usb-storage 3-1:1.0: USB Mass Storage device detected [ 499.111245][ T22] scsi host1: usb-storage 3-1:1.0 [ 499.302259][ T6471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.312237][ T6471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.322471][ T22] usb 3-1: USB disconnect, device number 13 [ 504.704707][ T7] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 505.067985][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 505.084897][ T7] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 505.095077][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 505.188238][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 505.197369][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 505.205539][ T7] usb 2-1: SerialNumber: syz [ 505.279416][ T7] usb-storage 2-1:1.0: USB Mass Storage device detected [ 505.296714][ T7] scsi host1: usb-storage 2-1:1.0 [ 506.417377][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.423837][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.587605][ T7] usb 2-1: USB disconnect, device number 10 01:25:39 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:25:39 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) 01:25:39 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:39 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:40 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 507.488119][ T5179] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 507.858082][ T5179] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 507.867912][ T5179] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 507.877619][ T5179] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 507.988182][ T5179] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 507.997357][ T5179] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 508.006239][ T5179] usb 3-1: SerialNumber: syz [ 508.069404][ T5179] usb-storage 3-1:1.0: USB Mass Storage device detected [ 508.080949][ T5179] scsi host1: usb-storage 3-1:1.0 [ 508.275357][ T6520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.286456][ T6520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.296537][ T7] usb 3-1: USB disconnect, device number 14 [ 515.757884][ T7] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 516.157943][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 516.168127][ T7] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 516.178481][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 516.278066][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 516.287197][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 516.295724][ T7] usb 2-1: SerialNumber: syz [ 516.339341][ T7] usb-storage 2-1:1.0: USB Mass Storage device detected [ 516.350806][ T7] scsi host1: usb-storage 2-1:1.0 [ 517.747553][ T22] usb 2-1: USB disconnect, device number 11 01:25:50 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x180, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1f}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7, 0x40, 0x5, 0x20, 0x80}, 0x1d, &(0x7f0000000680)=ANY=[@ANYBLOB="050f1d0003071002009909000710021400fcff0a10030208000920b500fb05fb453641ce943be47537ed366ae27ddfdb2b0a1eb67bc5acf00c548bf4f710dadd08cbadc51950f95697ba03c7f7a303345610304b347e50d20084718934db2da5e410317af0d376123a99a6023d3469e0d5d40b3eb8b1d8dcaeed8f508e48a9dba565d067092c9b9c87d9d657b74dcb68227d95ca6184deb2856e9000edae64f49a70e2b6462621c39a054dfc810a4528f556facba7de33956359d2895c2c00274cb4ee26c4b93cd2b90cdb0225a1733499a34072d6a154bd72510c22fb85d800"/239], 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0xbf, &(0x7f0000000180)=@string={0xbf, 0x3, "9abc438d07b1966292c439c6a76a9834ad73ae9420afcc30e2c9586366be30a85359a88633fc3275d89a4e3b5db7769d28fd6c0f69e92c9b7e1fd788ac5fc16ac2deba9e4758e3aa9e18b0fefd78dd7b0cf3232be612a07b55df8226fa305f5723f068ab3ac2fe78b8a084740d51549d5362bed652c87dd07bc1b72270d4a0695efe65f7a70e925f713423b707adab089ccfd093fab10265fbf96e100bb496be01e295bc17dd66764fbda83bbecd43a7ece481ea71186e57aa9665785c"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x4f5}}, {0xd7, &(0x7f0000000280)=@string={0xd7, 0x3, "8428e6de472a1116618ec14e1bd59e55d3683788ca257b554bd3f186ce0d4fe55f000a64e81d9dffd61f21b76e1faca4ca649e5139c4a98d92b02921ebaf4edd948d37a4e716165e9340b6984a89f345310be0f8341ae2def6229bbd025d2d880c53814f5b21423762fecff53cba2b664de0e56e10228e0a4a7d3cb215a29d89d6b44f51d522969c85256ff5e43ece86a633d05d463ea71637329ec8d97d87b96efa594d1938203aa28d729f28ac1a0e0afbeba2254ea98b2466860328e449fc06c63527a8b7e76e10b213bcee521f684a2d49df13"}}, {0xa, &(0x7f0000000380)=@string={0xa, 0x3, "7dbef8f4fa454fd4"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x224}}, {0xda, &(0x7f0000000500)=@string={0xda, 0x3, "aa2cdba4df286c4384e09856f62489bbd30f8e17626264b982f282ebd9e946128c9eae7922e168b841b252222dd938296a828fec30c4261bf547d9692a6cee005b98ca85235451883b215e10272c35a62588cbf0152fdbca9058f21ef2a773d4be32c3ca30db2b025380bd10536a133dd6b7aada3a64cda1bae700e446a76eebe62db057ab8aa52ffef0867124d8d70370a157f62134faf6858e779b280187ca26d50fce29ab7907a4cd8d533ed62d0f9e4e0b00911f8c09d93c0a4968c04fa6e36573044ede822a5fbb511358a4b6ed0711bb3394363c34"}}]}) 01:25:50 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:25:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:50 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 518.577917][ T7] usb 3-1: new high-speed USB device number 15 using dummy_hcd 01:25:51 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:51 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 518.987891][ T7] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 518.997798][ T7] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 519.007769][ T7] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 519.108125][ T7] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 519.117265][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 519.125882][ T7] usb 3-1: SerialNumber: syz [ 519.189361][ T7] usb-storage 3-1:1.0: USB Mass Storage device detected [ 519.201235][ T7] scsi host1: usb-storage 3-1:1.0 [ 519.397084][ T6556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.408159][ T6556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.417727][ T7] usb 3-1: USB disconnect, device number 15 01:25:52 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 520.257887][ T901] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 520.634202][ T901] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 520.644007][ T901] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 520.654881][ T901] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 520.748101][ T901] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 520.757225][ T901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 520.765720][ T901] usb 3-1: SerialNumber: syz [ 520.810021][ T901] usb-storage 3-1:1.0: USB Mass Storage device detected [ 520.822104][ T901] scsi host1: usb-storage 3-1:1.0 [ 522.095960][ T26] usb 3-1: USB disconnect, device number 16 01:25:58 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:25:58 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 0: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) dup3(r0, r0, 0x0) r1 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r1, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r1, 0x10000000) syz_io_uring_submit(r2, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r2, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:25:58 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 0: fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:25:58 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 526.108113][ T4749] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 526.498683][ T4749] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 526.508667][ T4749] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 526.519361][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 526.608095][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 526.617356][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 526.625609][ T4749] usb 3-1: SerialNumber: syz [ 526.670000][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 526.681074][ T4749] scsi host1: usb-storage 3-1:1.0 [ 528.024557][ T4749] usb 3-1: USB disconnect, device number 17 01:26:07 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:26:07 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:07 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:07 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:08 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 535.438395][ T22] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 535.847953][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 535.857792][ T22] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 535.869835][ T22] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 535.968025][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 535.977157][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 535.986553][ T22] usb 3-1: SerialNumber: syz [ 536.030742][ T22] usb-storage 3-1:1.0: USB Mass Storage device detected [ 536.048660][ T22] scsi host1: usb-storage 3-1:1.0 [ 537.381692][ T901] usb 3-1: USB disconnect, device number 18 01:26:17 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:17 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:17 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 0: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 0: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:17 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 545.097915][ T7] usb 3-1: new high-speed USB device number 19 using dummy_hcd 01:26:17 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 545.487947][ T7] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 545.498586][ T7] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 545.509872][ T7] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 545.598277][ T7] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 545.607613][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 545.615737][ T7] usb 3-1: SerialNumber: syz [ 545.683133][ T7] usb-storage 3-1:1.0: USB Mass Storage device detected [ 545.698120][ T7] scsi host1: usb-storage 3-1:1.0 [ 546.976349][ T22] usb 3-1: USB disconnect, device number 19 01:26:26 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:26 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 0: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:26 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r7 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r6, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r7, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:26 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 553.968034][ T901] usb 3-1: new high-speed USB device number 20 using dummy_hcd 01:26:26 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 554.347939][ T901] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 554.358037][ T901] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 554.367875][ T901] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 554.457885][ T901] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 554.467391][ T901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 554.475890][ T901] usb 3-1: SerialNumber: syz [ 554.519861][ T901] usb-storage 3-1:1.0: USB Mass Storage device detected [ 554.541641][ T901] scsi host1: usb-storage 3-1:1.0 [ 555.884203][ T4749] usb 3-1: USB disconnect, device number 20 01:26:34 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:34 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 2: syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:26:34 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:34 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 567.850016][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 567.856757][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:26:43 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:43 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 2: syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:26:43 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:43 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 581.658166][ T901] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 581.847946][ T901] usb 2-1: device descriptor read/64, error 18 [ 582.127828][ T901] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 582.337831][ T901] usb 2-1: device descriptor read/64, error 18 [ 582.460725][ T901] usb usb2-port1: attempt power cycle [ 582.868029][ T901] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 583.037868][ T901] usb 2-1: device descriptor read/8, error -61 [ 583.317965][ T901] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 583.518633][ T901] usb 2-1: device descriptor read/8, error -61 [ 583.648097][ T901] usb usb2-port1: unable to enumerate USB device 01:26:56 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:26:56 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:56 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:56 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:56 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) r2 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r2, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:56 executing program 2: syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:26:57 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:57 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:57 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:57 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:57 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:26:57 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 593.007806][ T901] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 593.208068][ T901] usb 2-1: device descriptor read/64, error 18 [ 593.487867][ T901] usb 2-1: new high-speed USB device number 17 using dummy_hcd 01:27:06 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:06 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 593.677855][ T901] usb 2-1: device descriptor read/64, error 18 01:27:06 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r1 = dup3(r0, r0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='ramfs\x00', &(0x7f00000002c0)='\x00', 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 5: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) dup3(r0, r0, 0x0) r1 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r1, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r1, 0x10000000) syz_io_uring_submit(r2, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r2, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 593.798127][ T901] usb usb2-port1: attempt power cycle 01:27:06 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 4: r0 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) dup3(r0, r0, 0x0) r1 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r1, 0x10000000) r6 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r1, 0x10000000) syz_io_uring_submit(r2, r5, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r6, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:06 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 602.287878][ T901] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 602.488000][ T901] usb 2-1: device descriptor read/64, error 18 [ 602.767811][ T901] usb 2-1: new high-speed USB device number 20 using dummy_hcd 01:27:15 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:15 executing program 5: fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 4: fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 602.968290][ T901] usb 2-1: device descriptor read/64, error 18 01:27:15 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 603.095668][ T901] usb usb2-port1: attempt power cycle 01:27:15 executing program 5: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:15 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 609.492205][ T7] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 609.698033][ T7] usb 2-1: device descriptor read/64, error 18 [ 609.977825][ T7] usb 2-1: new high-speed USB device number 23 using dummy_hcd 01:27:22 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 5: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 610.177839][ T7] usb 2-1: device descriptor read/64, error 18 01:27:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 5: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 610.298736][ T7] usb usb2-port1: attempt power cycle 01:27:23 executing program 5: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:23 executing program 4: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 614.687903][ T901] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 614.877979][ T901] usb 2-1: device descriptor read/64, error 18 [ 615.167757][ T901] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 615.367949][ T901] usb 2-1: device descriptor read/64, error 18 [ 615.505747][ T901] usb usb2-port1: attempt power cycle [ 615.927879][ T901] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 616.105729][ T901] usb 2-1: device descriptor read/8, error -61 [ 616.377809][ T901] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 616.548009][ T901] usb 2-1: device descriptor read/8, error -61 [ 616.668743][ T901] usb usb2-port1: unable to enumerate USB device 01:27:29 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:29 executing program 5: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:29 executing program 4: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:29 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:30 executing program 5: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:30 executing program 4: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:30 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:30 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:30 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:30 executing program 4: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 617.718031][ T901] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 617.908049][ T901] usb 3-1: device descriptor read/64, error 18 [ 618.177846][ T901] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 618.367826][ T901] usb 3-1: device descriptor read/64, error 18 [ 618.489876][ T901] usb usb3-port1: attempt power cycle [ 618.907915][ T901] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 619.077895][ T901] usb 3-1: device descriptor read/8, error -61 [ 619.359049][ T901] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 619.528353][ T901] usb 3-1: device descriptor read/8, error -61 [ 619.648971][ T901] usb usb3-port1: unable to enumerate USB device 01:27:41 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:41 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:41 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:41 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 629.117999][ T7] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 629.298121][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.304628][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 [ 629.347765][ T7] usb 3-1: device descriptor read/64, error 18 [ 629.627844][ T7] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 629.827796][ T7] usb 3-1: device descriptor read/64, error 18 [ 629.959835][ T7] usb usb3-port1: attempt power cycle [ 630.387752][ T7] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 630.560317][ T7] usb 3-1: device descriptor read/8, error -61 [ 630.847899][ T7] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 631.028194][ T7] usb 3-1: device descriptor read/8, error -61 [ 631.159994][ T7] usb usb3-port1: unable to enumerate USB device [ 637.417779][ T22] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 637.807827][ T22] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 637.818268][ T22] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 637.908087][ T22] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 637.917379][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 637.926132][ T22] usb 2-1: SerialNumber: syz [ 637.980422][ T22] usb-storage 2-1:1.0: USB Mass Storage device detected 01:27:50 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 638.076539][ T22] usb 2-1: USB disconnect, device number 29 01:27:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:51 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 638.407815][ T26] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 638.607923][ T26] usb 3-1: device descriptor read/64, error 18 [ 638.877781][ T26] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 639.067871][ T26] usb 3-1: device descriptor read/64, error 18 [ 639.207781][ T26] usb usb3-port1: attempt power cycle [ 639.617856][ T26] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 639.789181][ T26] usb 3-1: device descriptor read/8, error -61 [ 640.067910][ T26] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 640.259827][ T26] usb 3-1: device descriptor read/8, error -61 [ 640.381137][ T26] usb usb3-port1: unable to enumerate USB device 01:27:59 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:27:59 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:59 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:59 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:59 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:27:59 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:00 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 647.677841][ T26] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 647.907814][ T26] usb 3-1: device descriptor read/64, error 18 [ 648.187806][ T26] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 648.378152][ T26] usb 3-1: device descriptor read/64, error 18 [ 648.499476][ T26] usb usb3-port1: attempt power cycle [ 648.907781][ T26] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 649.077947][ T26] usb 3-1: device descriptor read/8, error -61 [ 649.357812][ T26] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 649.538068][ T26] usb 3-1: device descriptor read/8, error -61 [ 649.659628][ T26] usb usb3-port1: unable to enumerate USB device 01:28:09 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:09 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:09 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:09 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 656.977818][ T5179] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 657.187978][ T5179] usb 3-1: device descriptor read/64, error 18 [ 657.467835][ T5179] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 657.657779][ T5179] usb 3-1: device descriptor read/64, error 18 [ 657.779030][ T5179] usb usb3-port1: attempt power cycle [ 658.217915][ T5179] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 658.387878][ T5179] usb 3-1: device descriptor read/8, error -61 [ 658.657743][ T5179] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 658.828009][ T5179] usb 3-1: device descriptor read/8, error -61 [ 658.949045][ T5179] usb usb3-port1: unable to enumerate USB device 01:28:18 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:18 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:18 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:18 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 666.257898][ T5187] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 666.479839][ T5187] usb 3-1: device descriptor read/64, error 18 [ 666.747782][ T5187] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 666.957774][ T5187] usb 3-1: device descriptor read/64, error 18 [ 667.078619][ T5187] usb usb3-port1: attempt power cycle [ 667.497737][ T5187] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 667.668277][ T5187] usb 3-1: device descriptor read/8, error -61 [ 667.949036][ T5187] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 668.137854][ T5187] usb 3-1: device descriptor read/8, error -61 [ 668.266537][ T5187] usb usb3-port1: unable to enumerate USB device [ 676.692195][ T26] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 677.058121][ T26] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 677.068439][ T26] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 677.080029][ T26] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 677.168032][ T26] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 677.178448][ T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 677.186642][ T26] usb 2-1: SerialNumber: syz [ 677.239587][ T26] usb-storage 2-1:1.0: USB Mass Storage device detected 01:28:29 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:29 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:29 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 677.344699][ T901] usb 2-1: USB disconnect, device number 30 01:28:30 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:30 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:30 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:30 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:30 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:30 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 677.677726][ T4749] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 678.068061][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 678.078440][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 678.168180][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 678.177541][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 678.186504][ T4749] usb 3-1: SerialNumber: syz [ 678.252952][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 680.381798][ T901] usb 3-1: USB disconnect, device number 45 [ 688.047900][ T7] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 688.417892][ T7] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 688.434270][ T7] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 688.447401][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 688.548132][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 688.557236][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 688.565628][ T7] usb 2-1: SerialNumber: syz [ 688.629181][ T7] usb-storage 2-1:1.0: USB Mass Storage device detected 01:28:41 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:41 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 688.733999][ T7] usb 2-1: USB disconnect, device number 31 01:28:41 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:41 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 689.041226][ T4749] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 689.477970][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 689.488618][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 689.589189][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 689.598572][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 689.606741][ T4749] usb 3-1: SerialNumber: syz [ 689.663382][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 690.738182][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 690.744574][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.712658][ T26] usb 3-1: USB disconnect, device number 46 01:28:50 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a44000000001010902440001010000000904000012080600000524060000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:28:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:28:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 698.248124][ T5179] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 698.617826][ T5179] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 698.628197][ T5179] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 698.718885][ T5179] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 698.728300][ T5179] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 698.736347][ T5179] usb 3-1: SerialNumber: syz [ 698.779255][ T5179] usb-storage 3-1:1.0: USB Mass Storage device detected [ 700.970637][ T901] usb 3-1: USB disconnect, device number 47 [ 704.487821][ T901] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 704.847917][ T901] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 704.858415][ T901] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 704.868785][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 704.968089][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 704.977228][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 704.985749][ T901] usb 2-1: SerialNumber: syz [ 705.030051][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected 01:29:01 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:01 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 709.108155][ T7] usb 2-1: USB disconnect, device number 32 01:29:01 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:01 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:02 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 709.448656][ T4749] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 709.856494][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 709.867040][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 709.885458][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 709.977868][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 709.987415][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 709.996042][ T4749] usb 3-1: SerialNumber: syz [ 710.054166][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 712.150773][ T26] usb 3-1: USB disconnect, device number 48 [ 717.847781][ T26] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 718.208019][ T26] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 718.218455][ T26] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 718.228431][ T26] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 718.317905][ T26] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 718.327037][ T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 718.335212][ T26] usb 2-1: SerialNumber: syz [ 718.379356][ T26] usb-storage 2-1:1.0: USB Mass Storage device detected 01:29:13 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:13 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 720.543393][ T5179] usb 2-1: USB disconnect, device number 33 01:29:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 720.877861][ T26] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 721.237955][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 721.248331][ T26] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 721.259627][ T26] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 721.348057][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 721.357161][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 721.377472][ T26] usb 3-1: SerialNumber: syz [ 721.429106][ T26] usb-storage 3-1:1.0: USB Mass Storage device detected [ 723.582249][ T26] usb 3-1: USB disconnect, device number 49 [ 727.177905][ T901] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 727.538142][ T901] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 727.548388][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 727.647996][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 727.657206][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 727.666717][ T901] usb 2-1: SerialNumber: syz [ 727.709126][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected [ 727.917406][ T5175] usb 2-1: USB disconnect, device number 34 01:29:21 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:21 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:21 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 728.777831][ T901] usb 3-1: new high-speed USB device number 50 using dummy_hcd 01:29:21 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:21 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 729.180328][ T901] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 729.190754][ T901] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 729.202828][ T901] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 729.308946][ T901] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 729.318133][ T901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 729.326180][ T901] usb 3-1: SerialNumber: syz [ 729.379905][ T901] usb-storage 3-1:1.0: USB Mass Storage device detected 01:29:24 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 731.492545][ T4749] usb 3-1: USB disconnect, device number 50 [ 731.927926][ T4749] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 732.317790][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 732.328462][ T4749] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 732.338940][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 732.428026][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 732.437161][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 732.446246][ T4749] usb 3-1: SerialNumber: syz [ 732.502151][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 734.546410][ T4749] usb 3-1: USB disconnect, device number 51 [ 741.267817][ T901] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 741.637791][ T901] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 741.648093][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 741.737905][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 741.747002][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 741.762511][ T901] usb 2-1: SerialNumber: syz [ 741.829492][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected 01:29:36 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 743.981300][ T22] usb 2-1: USB disconnect, device number 35 01:29:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 744.287745][ T5175] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 744.677883][ T5175] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 744.688350][ T5175] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 744.699039][ T5175] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 744.787874][ T5175] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 744.797080][ T5175] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 744.805903][ T5175] usb 3-1: SerialNumber: syz [ 744.861710][ T5175] usb-storage 3-1:1.0: USB Mass Storage device detected [ 747.025130][ T5187] usb 3-1: USB disconnect, device number 52 [ 752.172383][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.178830][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:29:45 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:45 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:45 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:45 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:46 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:46 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 753.558621][ T26] usb 3-1: new high-speed USB device number 53 using dummy_hcd 01:29:46 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 753.928089][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 753.938450][ T26] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 753.952029][ T26] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 754.037916][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 754.047030][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 754.055333][ T26] usb 3-1: SerialNumber: syz [ 754.108744][ T26] usb-storage 3-1:1.0: USB Mass Storage device detected [ 756.295091][ T22] usb 3-1: USB disconnect, device number 53 [ 761.897801][ T22] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 762.270520][ T22] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 762.283079][ T22] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 762.378264][ T22] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 762.387421][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 762.395987][ T22] usb 2-1: SerialNumber: syz [ 762.460173][ T22] usb-storage 2-1:1.0: USB Mass Storage device detected 01:29:55 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:29:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 762.555969][ T901] usb 2-1: USB disconnect, device number 36 01:29:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:29:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 762.897758][ T4749] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 763.267968][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 763.278270][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 763.397965][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 763.409354][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 763.418238][ T4749] usb 3-1: SerialNumber: syz [ 763.469260][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 765.593170][ T5187] usb 3-1: USB disconnect, device number 54 [ 771.267863][ T22] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 771.659937][ T22] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 771.670493][ T22] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 771.757944][ T22] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 771.767081][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 771.776217][ T22] usb 2-1: SerialNumber: syz [ 771.829274][ T22] usb-storage 2-1:1.0: USB Mass Storage device detected 01:30:04 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:04 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:04 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 771.929196][ T5179] usb 2-1: USB disconnect, device number 37 01:30:04 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:04 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 772.248228][ T5187] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 772.617906][ T5187] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 772.628195][ T5187] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 772.719070][ T5187] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 772.728594][ T5187] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 772.736664][ T5187] usb 3-1: SerialNumber: syz [ 772.779155][ T5187] usb-storage 3-1:1.0: USB Mass Storage device detected [ 774.978306][ T901] usb 3-1: USB disconnect, device number 55 [ 780.527696][ T5179] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 780.887925][ T5179] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 780.898585][ T5179] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 780.988784][ T5179] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 781.005044][ T5179] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 781.014237][ T5179] usb 2-1: SerialNumber: syz [ 781.059754][ T5179] usb-storage 2-1:1.0: USB Mass Storage device detected 01:30:13 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:13 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 781.198493][ T22] usb 2-1: USB disconnect, device number 38 01:30:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:13 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:14 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:14 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 781.527727][ T4749] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 781.938001][ T4749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 781.948712][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 782.057960][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 782.067093][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 782.076081][ T4749] usb 3-1: SerialNumber: syz [ 782.139893][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 784.237157][ T901] usb 3-1: USB disconnect, device number 56 [ 794.067658][ T5187] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 794.447942][ T5187] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 794.457792][ T5187] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 794.548325][ T5187] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 794.557478][ T5187] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 794.565938][ T5187] usb 2-1: SerialNumber: syz [ 794.609427][ T5187] usb-storage 2-1:1.0: USB Mass Storage device detected 01:30:29 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 796.791505][ T5187] usb 2-1: USB disconnect, device number 39 01:30:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 797.117917][ T7] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 797.487854][ T7] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 797.499385][ T7] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 797.588072][ T7] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 797.597187][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 797.606584][ T7] usb 3-1: SerialNumber: syz [ 797.659729][ T7] usb-storage 3-1:1.0: USB Mass Storage device detected [ 799.833661][ T7] usb 3-1: USB disconnect, device number 57 [ 805.417736][ T5179] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 805.778029][ T5179] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 805.787870][ T5179] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 805.877815][ T5179] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 805.886951][ T5179] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 805.896516][ T5179] usb 2-1: SerialNumber: syz [ 805.950440][ T5179] usb-storage 2-1:1.0: USB Mass Storage device detected 01:30:38 executing program 1: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:38 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 806.082938][ T5179] usb 2-1: USB disconnect, device number 40 01:30:38 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:38 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 806.408281][ T901] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 806.777792][ T901] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 806.788634][ T901] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 806.877902][ T901] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 806.886993][ T901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 806.902419][ T901] usb 3-1: SerialNumber: syz [ 806.951369][ T901] usb-storage 3-1:1.0: USB Mass Storage device detected [ 809.132830][ T4749] usb 3-1: USB disconnect, device number 58 [ 812.772087][ T7] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 813.147812][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 813.166710][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 813.257766][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 813.266861][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 813.275953][ T7] usb 2-1: SerialNumber: syz [ 813.320235][ T7] usb-storage 2-1:1.0: USB Mass Storage device detected [ 813.612578][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 813.619199][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:30:48 executing program 1: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:30:48 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000000905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 815.427462][ T7] usb 2-1: USB disconnect, device number 41 01:30:48 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:48 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 815.778093][ T5187] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 816.147967][ T5187] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 816.158632][ T5187] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 816.257975][ T5187] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 816.267411][ T5187] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 816.275933][ T5187] usb 3-1: SerialNumber: syz [ 816.341422][ T5187] usb-storage 3-1:1.0: USB Mass Storage device detected [ 818.470407][ T4749] usb 3-1: USB disconnect, device number 59 [ 821.967751][ T901] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 822.327837][ T901] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 822.337807][ T901] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 822.347497][ T901] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 822.437768][ T901] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 822.446905][ T901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 822.455185][ T901] usb 2-1: SerialNumber: syz [ 822.499201][ T901] usb-storage 2-1:1.0: USB Mass Storage device detected [ 822.510079][ T901] scsi host1: usb-storage 2-1:1.0 [ 822.702279][ T5187] usb 2-1: USB disconnect, device number 42 01:30:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xb, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) io_setup(0xffff, &(0x7f0000000040)) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x4, 0x0, &(0x7f0000000140)) 01:30:55 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:30:55 executing program 1: bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)={0x0, 0x0, 0x4}, 0x10) 01:30:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:56 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:56 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 823.547774][ T5179] usb 3-1: new high-speed USB device number 60 using dummy_hcd 01:30:56 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$BLKIOMIN(r0, 0x1265, 0x0) 01:30:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$BLKIOMIN(r0, 0x127e, 0x0) 01:30:56 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:30:56 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 823.978140][ T5179] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 823.997109][ T5179] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 824.088106][ T5179] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 824.098052][ T5179] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 824.106258][ T5179] usb 3-1: SerialNumber: syz [ 824.159333][ T5179] usb-storage 3-1:1.0: USB Mass Storage device detected 01:30:58 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 826.262567][ T26] usb 3-1: USB disconnect, device number 60 [ 826.687796][ T26] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 827.049343][ T26] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 827.059315][ T26] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 827.147950][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 827.157298][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 827.165825][ T26] usb 3-1: SerialNumber: syz [ 827.209019][ T26] usb-storage 3-1:1.0: USB Mass Storage device detected 01:31:00 executing program 1: r0 = socket(0x18, 0x0, 0x2) ioctl$sock_TIOCOUTQ(r0, 0x8902, 0x0) 01:31:00 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000080)=[@in={0x2, 0x0, @loopback}], 0x10) 01:31:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:01 executing program 2: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc090581030800060220090582020002000000090503"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) [ 829.312264][ T4749] usb 3-1: USB disconnect, device number 61 [ 829.727610][ T4749] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 830.088059][ T4749] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 830.098020][ T4749] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 830.188539][ T4749] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 830.197872][ T4749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 830.205919][ T4749] usb 3-1: SerialNumber: syz [ 830.249583][ T4749] usb-storage 3-1:1.0: USB Mass Storage device detected [ 832.344243][ T5175] usb 3-1: USB disconnect, device number 62 01:31:12 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:31:12 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:12 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 840.527788][ T26] usb 3-1: new high-speed USB device number 63 using dummy_hcd 01:31:13 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:13 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:13 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:13 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 840.920354][ T26] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 840.944128][ T26] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 840.954685][ T26] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 841.060986][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 841.070163][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 841.078787][ T26] usb 3-1: SerialNumber: syz [ 841.132222][ T26] usb-storage 3-1:1.0: USB Mass Storage device detected [ 841.145495][ T26] scsi host1: usb-storage 3-1:1.0 [ 841.340758][ T5175] usb 3-1: USB disconnect, device number 63 01:31:22 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:31:22 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:22 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 849.848077][ T22] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 850.258002][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 850.267867][ T22] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 850.277873][ T22] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 850.377940][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 850.387442][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 850.395733][ T22] usb 3-1: SerialNumber: syz [ 850.439995][ T22] usb-storage 3-1:1.0: USB Mass Storage device detected [ 850.449595][ T22] scsi host1: usb-storage 3-1:1.0 [ 850.646315][ T26] usb 3-1: USB disconnect, device number 64 01:31:29 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:31:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:29 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 857.027690][ T22] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 857.427809][ T22] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 857.437602][ T22] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 857.447304][ T22] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 857.557937][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 857.567086][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 857.575336][ T22] usb 3-1: SerialNumber: syz [ 857.629407][ T22] usb-storage 3-1:1.0: USB Mass Storage device detected [ 857.639761][ T22] scsi host1: usb-storage 3-1:1.0 [ 857.831687][ T5187] usb 3-1: USB disconnect, device number 65 01:31:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 2: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 01:31:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 864.167915][ T5187] usb 3-1: new high-speed USB device number 66 using dummy_hcd 01:31:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 864.527878][ T5187] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 864.537686][ T5187] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 864.547422][ T5187] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 864.638073][ T5187] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 864.647208][ T5187] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 864.655619][ T5187] usb 3-1: SerialNumber: syz [ 864.716887][ T5187] usb-storage 3-1:1.0: USB Mass Storage device detected [ 864.729564][ T5187] scsi host1: usb-storage 3-1:1.0 [ 864.926644][ T26] usb 3-1: USB disconnect, device number 66 01:31:45 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:45 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:46 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 875.049626][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.055993][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:31:55 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:31:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:05 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:14 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:14 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:14 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:14 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:14 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:15 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:22 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:31 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:42 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:43 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 936.500044][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 936.506483][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:32:50 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 2: syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:32:50 executing program 2: syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 2: syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:01 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 2: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 3: syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:10 executing program 3: syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 2: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 3: syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 2: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:18 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:24 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 3: r0 = syz_io_uring_setup(0x1999, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:31 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:32 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:32 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:46 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 997.929732][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 997.936106][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:33:55 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:33:55 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:00 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, 0x0, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:11 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:19 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, 0x0, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:26 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:27 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:27 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 4: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:36 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 0: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905810308000602200905820200020000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:34:44 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 4: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:34:44 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:44 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:45 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:45 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:45 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 1052.507766][ T26] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1052.515692][ T22] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1052.877755][ T26] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.893812][ T26] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1052.904574][ T26] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 1052.918256][ T22] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.928821][ T22] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1053.007878][ T26] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1053.016997][ T26] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1053.025849][ T22] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1053.035298][ T26] usb 5-1: SerialNumber: syz [ 1053.040354][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1053.051608][ T22] usb 1-1: SerialNumber: syz [ 1053.089085][ T26] usb-storage 5-1:1.0: USB Mass Storage device detected [ 1053.099708][ T22] usb-storage 1-1:1.0: USB Mass Storage device detected [ 1055.213197][ T5187] usb 1-1: USB disconnect, device number 4 [ 1055.221832][ T5179] usb 5-1: USB disconnect, device number 6 [ 1059.369531][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 1059.375900][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 01:34:56 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r4 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 4: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:34:56 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:34:56 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 1063.887821][ T5179] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1064.287630][ T5179] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1064.298315][ T5179] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1064.309498][ T5179] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 1064.397612][ T5179] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1064.406901][ T5179] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1064.415166][ T5179] usb 5-1: SerialNumber: syz [ 1064.468829][ T5179] usb-storage 5-1:1.0: USB Mass Storage device detected [ 1066.614344][ T5179] usb 5-1: USB disconnect, device number 7 01:35:02 executing program 1: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 5: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, 0x0, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 0: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}, 0x10001) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) r5 = mmap$IORING_OFF_SQES(&(0x7f00000da000/0x4000)=nil, 0x4000, 0x3, 0x12, r0, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 4: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc0905"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:35:02 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 5: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:35:02 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) 01:35:02 executing program 0: r0 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020014402505a1a4400000000101090244000101000000090400001208060000052406000005240000000d240f010000000000000000fc09058103080006022009058202000200000009050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 01:35:02 executing program 3: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x10001) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000) syz_io_uring_submit(0x0, r3, &(0x7f0000000080)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000640)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 1070.367844][ T26] usb 5-1: new high-speed USB device number 8 using dummy_hcd 01:35:02 executing program 2: r0 = syz_io_uring_setup(0x1999, &(0x7f00000003c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0xb20, &(0x7f0000000240), &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6374, 0x0, 0x0, 0x0, 0x0) [ 1070.537849][ T22] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1070.601882][ T7] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1070.737752][ T26] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1070.748345][ T26] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1070.758955][ T26] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 1070.847865][ T26] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1070.858882][ T26] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1070.866940][ T26] usb 5-1: SerialNumber: syz [ 1070.897834][ T22] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1070.910257][ T26] usb-storage 5-1:1.0: USB Mass Storage device detected [ 1070.918620][ T22] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1070.929430][ T22] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 1070.988153][ T7] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1070.998415][ T7] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1071.009841][ T7] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 1071.017784][ T22] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1071.032207][ T22] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1071.040475][ T22] usb 6-1: SerialNumber: syz [ 1071.089507][ T22] usb-storage 6-1:1.0: USB Mass Storage device detected [ 1071.107712][ T7] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1071.114673][ T22] scsi host1: usb-storage 6-1:1.0 [ 1071.148829][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1071.158269][ T7] usb 1-1: SerialNumber: syz [ 1071.216665][ T7] usb-storage 1-1:1.0: USB Mass Storage device detected [ 1071.231668][ T7] scsi host2: usb-storage 1-1:1.0 [ 1072.424510][ T7] usb 6-1: USB disconnect, device number 19 [ 1072.487723][ T7] ------------[ cut here ]------------ [ 1072.491080][ T22] usb 1-1: USB disconnect, device number 5 [ 1072.493687][ T7] remove_proc_entry: removing non-empty directory 'scsi/usb-storage', leaking at least '2' [ 1072.518883][ T7] WARNING: CPU: 0 PID: 7 at fs/proc/generic.c:718 remove_proc_entry+0x361/0x460 [ 1072.528607][ T7] Modules linked in: [ 1072.532589][ T7] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.3.0-rc2-syzkaller-00016-g4979bf866825 #0 [ 1072.542607][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 1072.552791][ T7] Workqueue: usb_hub_wq hub_event [ 1072.558501][ T7] RIP: 0010:remove_proc_entry+0x361/0x460 [ 1072.564310][ T7] Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 be 00 00 00 49 8b 94 24 d8 00 00 00 48 c7 c6 40 ac 5e 8a 48 c7 c7 60 ab 5e 8a e8 5f df 42 ff <0f> 0b e9 6d fe ff ff e8 c3 c2 7a ff 48 c7 c7 c0 68 99 8c e8 f7 e9 [ 1072.584047][ T7] RSP: 0018:ffffc900000c7650 EFLAGS: 00010286 [ 1072.590267][ T7] RAX: 0000000000000000 RBX: 1ffff92000018ecc RCX: ffffc9001495b000 [ 1072.598373][ T7] RDX: 0000000000040000 RSI: ffffffff814bf3a7 RDI: 0000000000000001 [ 1072.606410][ T7] RBP: ffff888076770640 R08: 0000000000000001 R09: 0000000000000000 [ 1072.614505][ T7] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888145303000 [ 1072.622580][ T7] R13: ffff8880767706f8 R14: ffff888017ba1f50 R15: 0000000000000000 [ 1072.630692][ T7] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 1072.639733][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1072.646382][ T7] CR2: 0000001b3332e000 CR3: 0000000028617000 CR4: 00000000003506f0 [ 1072.654488][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1072.662595][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1072.670714][ T7] Call Trace: [ 1072.674041][ T7] [ 1072.677019][ T7] ? proc_readdir+0x140/0x140 [ 1072.681863][ T7] scsi_proc_hostdir_rm+0x107/0x280 [ 1072.687236][ T7] scsi_host_dev_release+0xc9/0x3b0 [ 1072.692612][ T7] ? scsi_host_put+0x20/0x20 [ 1072.697260][ T7] device_release+0xa3/0x240 [ 1072.702028][ T7] kobject_put+0x1c2/0x4d0 [ 1072.706540][ T7] put_device+0x1f/0x30 [ 1072.710826][ T7] usb_unbind_interface+0x1dc/0x8e0 [ 1072.716189][ T7] ? usb_unbind_device+0x1a0/0x1a0 [ 1072.721427][ T7] device_remove+0x11f/0x170 [ 1072.726108][ T7] device_release_driver_internal+0x443/0x610 [ 1072.732356][ T7] ? put_device+0x1f/0x30 [ 1072.736754][ T7] bus_remove_device+0x22c/0x420 [ 1072.741848][ T7] device_del+0x48a/0xb80 [ 1072.746270][ T7] ? __device_link_del+0x380/0x380 [ 1072.751520][ T7] ? kobject_put+0x1e8/0x4d0 [ 1072.756217][ T7] usb_disable_device+0x35a/0x7b0 [ 1072.761411][ T7] usb_disconnect+0x2db/0x8a0 [ 1072.766177][ T7] hub_event+0x1fbf/0x4e40 [ 1072.770754][ T7] ? hub_port_debounce+0x3b0/0x3b0 [ 1072.775967][ T7] ? lock_release+0x700/0x700 [ 1072.780846][ T7] ? lock_downgrade+0x690/0x690 [ 1072.785773][ T7] process_one_work+0x991/0x1710 [ 1072.790914][ T7] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 1072.796359][ T7] ? spin_bug+0x1c0/0x1c0 [ 1072.800805][ T7] ? _raw_spin_lock_irq+0x45/0x50 [ 1072.806021][ T7] worker_thread+0x669/0x1090 [ 1072.810879][ T7] ? process_one_work+0x1710/0x1710 [ 1072.816163][ T7] kthread+0x2e8/0x3a0 [ 1072.820417][ T7] ? kthread_complete_and_exit+0x40/0x40 [ 1072.826111][ T7] ret_from_fork+0x1f/0x30 [ 1072.830701][ T7] [ 1072.833762][ T7] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1072.841067][ T7] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.3.0-rc2-syzkaller-00016-g4979bf866825 #0 [ 1072.850924][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 1072.861036][ T7] Workqueue: usb_hub_wq hub_event [ 1072.866120][ T7] Call Trace: [ 1072.869438][ T7] [ 1072.872404][ T7] dump_stack_lvl+0xd9/0x150 [ 1072.877032][ T7] panic+0x688/0x730 [ 1072.881020][ T7] ? panic_smp_self_stop+0x90/0x90 [ 1072.886169][ T7] ? show_trace_log_lvl+0x285/0x390 [ 1072.891494][ T7] ? remove_proc_entry+0x361/0x460 [ 1072.896677][ T7] check_panic_on_warn+0xb1/0xc0 [ 1072.901689][ T7] __warn+0xf2/0x460 [ 1072.905662][ T7] ? remove_proc_entry+0x361/0x460 [ 1072.910840][ T7] report_bug+0x2da/0x500 [ 1072.915214][ T7] handle_bug+0x3c/0x70 [ 1072.919457][ T7] exc_invalid_op+0x18/0x50 [ 1072.923993][ T7] asm_exc_invalid_op+0x1a/0x20 [ 1072.928946][ T7] RIP: 0010:remove_proc_entry+0x361/0x460 [ 1072.934747][ T7] Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 be 00 00 00 49 8b 94 24 d8 00 00 00 48 c7 c6 40 ac 5e 8a 48 c7 c7 60 ab 5e 8a e8 5f df 42 ff <0f> 0b e9 6d fe ff ff e8 c3 c2 7a ff 48 c7 c7 c0 68 99 8c e8 f7 e9 [ 1072.954416][ T7] RSP: 0018:ffffc900000c7650 EFLAGS: 00010286 [ 1072.960545][ T7] RAX: 0000000000000000 RBX: 1ffff92000018ecc RCX: ffffc9001495b000 [ 1072.968577][ T7] RDX: 0000000000040000 RSI: ffffffff814bf3a7 RDI: 0000000000000001 [ 1072.976604][ T7] RBP: ffff888076770640 R08: 0000000000000001 R09: 0000000000000000 [ 1072.984637][ T7] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888145303000 [ 1072.992669][ T7] R13: ffff8880767706f8 R14: ffff888017ba1f50 R15: 0000000000000000 [ 1073.000720][ T7] ? __warn_printk+0x187/0x310 [ 1073.005672][ T7] ? proc_readdir+0x140/0x140 [ 1073.010453][ T7] scsi_proc_hostdir_rm+0x107/0x280 [ 1073.015749][ T7] scsi_host_dev_release+0xc9/0x3b0 [ 1073.021111][ T7] ? scsi_host_put+0x20/0x20 [ 1073.025781][ T7] device_release+0xa3/0x240 [ 1073.030455][ T7] kobject_put+0x1c2/0x4d0 [ 1073.034962][ T7] put_device+0x1f/0x30 [ 1073.039199][ T7] usb_unbind_interface+0x1dc/0x8e0 [ 1073.044476][ T7] ? usb_unbind_device+0x1a0/0x1a0 [ 1073.049662][ T7] device_remove+0x11f/0x170 [ 1073.054338][ T7] device_release_driver_internal+0x443/0x610 [ 1073.060503][ T7] ? put_device+0x1f/0x30 [ 1073.064912][ T7] bus_remove_device+0x22c/0x420 [ 1073.069943][ T7] device_del+0x48a/0xb80 [ 1073.074365][ T7] ? __device_link_del+0x380/0x380 [ 1073.076900][ T5179] usb 5-1: USB disconnect, device number 8 [ 1073.085381][ T7] ? kobject_put+0x1e8/0x4d0 [ 1073.090086][ T7] usb_disable_device+0x35a/0x7b0 [ 1073.095202][ T7] usb_disconnect+0x2db/0x8a0 [ 1073.099973][ T7] hub_event+0x1fbf/0x4e40 [ 1073.104600][ T7] ? hub_port_debounce+0x3b0/0x3b0 [ 1073.109807][ T7] ? lock_release+0x700/0x700 [ 1073.114554][ T7] ? lock_downgrade+0x690/0x690 [ 1073.119499][ T7] process_one_work+0x991/0x1710 [ 1073.124553][ T7] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 1073.130007][ T7] ? spin_bug+0x1c0/0x1c0 [ 1073.134448][ T7] ? _raw_spin_lock_irq+0x45/0x50 [ 1073.139575][ T7] worker_thread+0x669/0x1090 [ 1073.144339][ T7] ? process_one_work+0x1710/0x1710 [ 1073.149610][ T7] kthread+0x2e8/0x3a0 [ 1073.153771][ T7] ? kthread_complete_and_exit+0x40/0x40 [ 1073.159487][ T7] ret_from_fork+0x1f/0x30 [ 1073.164007][ T7] [ 1073.167308][ T7] Kernel Offset: disabled [ 1073.171843][ T7] Rebooting in 86400 seconds..