last executing test programs: 10.443794064s ago: executing program 0 (id=1222): syz_open_dev$sndctrl(0x0, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff0009"], 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18}, './file0\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000417bd10a5535cb31a673bd62d2eb0000000400"/41], 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0x1000000000, 0x0, 0x40, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x68ff, 0x5, 0x7fff, 0x3, 0x400000000], 0x80ad003}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.270560921s ago: executing program 4 (id=1233): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, r4, 0x5, 0xfffffffd, 0x2, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4810) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000840)={0x764, r4, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x748, 0x11d, 0x0, 0x1, [{0x2d0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x80}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x114, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x8}, {0x0, 0x4}, {0x6, 0x2}, {0x4}, {0x7, 0x2}, {0x5, 0xa}, {0x6, 0x3}, {0x1, 0x5}, {0x7, 0x1}, {0x4, 0x1}, {0x2}, {0x3, 0x7}, {0x1, 0x3}, {0x5, 0x7}, {0x7, 0x9}, {0x6, 0x7}, {0x2, 0x7}, {0x6, 0x5}, {0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0xc, 0x36, 0xc, 0x16, 0xb, 0x1b, 0x3, 0x1, 0x60, 0x5, 0x4, 0x1b, 0x48, 0x24, 0x3b, 0xc, 0x48, 0xc, 0x3, 0x6, 0x16, 0x60, 0x36]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x1, 0xf, 0x100, 0xa, 0x9a8d, 0xb7]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x1, 0x1}, {0x3, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x7, 0x9}, {0x4}, {0x7, 0x7}, {}, {0x6}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x8}, {0x7, 0x6}, {0x3, 0x9}]}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x2, 0x2}, {0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x6}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x9, 0x1, 0x0, 0x3, 0x0, 0x101, 0x7]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x3, 0x5}, {0x1, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x7, 0x8}, {0x4, 0x8}, {0x0, 0x7}, {0x2, 0x3}, {0x7, 0x9}, {0x7, 0x1}, {0x1, 0x4}, {0x4, 0x7}, {0x3, 0xa}, {0x7, 0x7}, {0x7, 0x2}, {0x6, 0x5}, {0x0, 0xa}, {0x7, 0x4}, {0x0, 0x9}, {0x1, 0x6}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x2, 0x4}, {0x3, 0x7}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x3}, {0x1, 0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x1}, {0x3, 0x4}, {0x1, 0x1}, {0x5}, {0x3, 0x6}, {0x2, 0x8}, {0x4, 0x2}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x2}, {0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x5}, {0x5, 0x6}, {}, {0x2, 0x7}, {0x0, 0x4}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x6c, 0x9, 0x6, 0x48, 0x60, 0x3, 0x6, 0xb, 0x4, 0xc, 0x60, 0x3, 0x16, 0x18, 0x18, 0x18, 0x16, 0x12, 0x12, 0x5, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x16c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x7}, {0x0, 0x4}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x3}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x5}, {0x0, 0x5}, {0x2}, {0x6, 0x1}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0x6}, {0x7, 0x7}, {0x4, 0x4}, {0x1, 0x2}, {0x6, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x47, 0x2, [{0x7, 0x1}, {0x3, 0x6}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0xa}, {0x6, 0x4}, {0x0, 0x8}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x5}, {0x1}, {0x0, 0xa}, {0x2, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x3, 0x8}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x1}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x5}, {0x6}, {0x0, 0x7}, {0x1, 0xa}, {0x0, 0x3}, {0x6, 0x6}, {0x1, 0x8}, {0x3, 0x4}, {0x5, 0x7}, {0x2, 0xa}, {0x7}, {0x5, 0x5}, {0x6, 0x6}, {0x4}, {0x0, 0x6}, {0x0, 0x5}, {0x4}, {0x5, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x4, 0x9}, {0x1, 0x3}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x6}, {0x4, 0x3}, {0x7, 0x3}, {0x7, 0x4}, {0x7, 0x6}, {0x4, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x1, 0x1}, {0x3, 0x4}, {0x6}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x7}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x5}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x3, 0x4, 0xb502, 0x1c0, 0xc, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x200, 0x8, 0x6, 0x6, 0x7, 0xfff3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7a}]}, @NL80211_BAND_2GHZ={0xb0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x42, 0x2, [{0x6}, {0x3, 0x3}, {0x4, 0x2}, {0x5, 0x9}, {0x0, 0x6}, {0x4, 0x5}, {0x3, 0x5}, {0x3}, {0x4, 0x4}, {0x7, 0x8}, {0x3, 0x7}, {0x3, 0x8}, {0x3, 0xa}, {0x0, 0x9}, {0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x7, 0x6}, {0x7, 0x6}, {}, {0x6, 0x14}, {0x4}, {0x4, 0x1}, {0x0, 0x3}, {0x1, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x6, 0x5}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x4, 0x8}, {0x1, 0x9}, {0x1, 0x5}, {0x3, 0x2}, {0x5}, {0x7, 0x1}, {0x1, 0x6}, {0x0, 0x7}, {0x0, 0x3}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x5, 0x4}, {0x1, 0x8}, {0x5, 0x4}, {0x6, 0x8}, {0x4, 0x2}, {0x2, 0xa}, {0x0, 0x8}, {0x4, 0x4}, {0x3, 0x6}, {0x4, 0x9}, {0x2, 0x6}, {0x2, 0xa}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x3}, {0x1, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x3, 0x4}, {0x5, 0x3}, {0x5, 0x8}, {0x1, 0x7}, {0x1, 0x7}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x4, 0x2}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x3}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x8}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x4, 0x7}, {0x2, 0x5}, {0x0, 0x8}, {0x1, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5385, 0x8001, 0xf0e7, 0xfffe, 0x6, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x9, 0x40, 0x2, 0x8, 0x6]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x66}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x71}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x380, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x36c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x18, 0x2, [{0x3, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x0, 0x5}, {0x2, 0x6}, {0x1}, {0x2, 0x8}, {0x1, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x2, 0x9}, {0x4}, {0x3, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x6}, {0x4}, {0x6, 0x1}, {0x0, 0x8}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x95, 0x2, 0x3, 0xd6, 0x0, 0x6, 0x6]}}]}, @NL80211_BAND_60GHZ={0xa4, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2c, 0x2, [{0x2, 0x4}, {0x5}, {0x3, 0x2}, {0x7, 0x3}, {0x5, 0x3}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x7}, {0x3, 0x3}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x4, 0x7}, {0x2, 0x9}, {0x1}, {0x1, 0xa}, {0x1, 0xa}, {0x6, 0x2}, {0x7, 0x3}, {0x6, 0x1}, {0x1}, {0x4, 0x5}, {0x1, 0x9}, {0x1}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x5}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x4}, {0x4, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x78, 0x6, 0xfd, 0xdc, 0x7, 0x915]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xca8, 0x4, 0x5b5d, 0x7, 0xfff, 0x4, 0x7]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x18, 0x24, 0x0, 0x18, 0x4, 0x1b, 0x4, 0xc, 0x9, 0x12, 0x0, 0xc, 0x4, 0x24, 0x24, 0x16, 0x63]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x4, 0x1, 0x12, 0x6e, 0x36, 0x6c, 0x1b, 0x6, 0xb, 0x16, 0x6, 0x2, 0x6c, 0x18, 0x6c, 0x60, 0x6, 0xc, 0x16, 0x5, 0x36]}]}, @NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x5098abc75f17ee31, 0x4, 0x6, 0x9, 0x5, 0x12, 0x6c, 0x3, 0x6c, 0x1b, 0x24, 0x9, 0xb, 0x12, 0x3834ceaf91043b90, 0x1b, 0x48, 0x2, 0x12, 0x6, 0x30, 0x4, 0x4, 0x6c, 0xb, 0xb, 0xc, 0xc, 0x36]}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x8, 0xf, 0xe, 0x2, 0x3, 0x47, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x4, 0x7, 0x7, 0x80, 0x4, 0x1, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{0x1, 0x3}, {0x7, 0x7}, {0x4}, {0x5, 0x2}, {0x6}, {0x1}, {0x0, 0x5}, {0x5, 0x6}, {0x4, 0x5}, {0x2, 0x5}, {0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x1}, {0x7, 0x3}, {0x7, 0x8}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x7}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x7, 0x8}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x0, 0x1}, {0x4, 0x3}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x8}, {0x3, 0x9}, {0x4, 0x5}, {0x7, 0x8}, {0x6, 0x7}, {}, {0x7, 0x9}, {0x6, 0x1}, {0x2, 0xa}, {0x3, 0x7}, {0x5, 0x2}, {0x4, 0x9}, {0x4, 0x8}, {0x0, 0x4}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x2}, {0x1, 0xa}, {0x6}, {0x7, 0x1}, {0x1, 0x8}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x2}, {0x4, 0x3}, {0x5, 0x6}, {0x0, 0x4}, {0x2, 0x2}, {0x6, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6b, 0x5, 0x3, 0x2fd, 0x8, 0x1, 0x100, 0x1]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x36, 0x0, 0x3ff, 0xe61, 0x0, 0x7f, 0x10]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x4, 0x9}, {0x4, 0x9}, {0x1, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x3}, {0x0, 0x2}, {0x4, 0xa}, {0x5}, {0x6, 0x5}, {}, {0x7, 0x5}, {0x1, 0x9}, {0x0, 0x3}, {0x3, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0x6}, {0x6, 0x9}, {0x1, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x0, 0x7}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xdf, 0x6, 0x8, 0x2, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x4, 0x9, 0x8, 0x1, 0x9, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x48, 0x36, 0x18, 0x4, 0x5, 0x16, 0x16, 0x6c, 0x6, 0x1b, 0x6, 0x0, 0x48, 0x6, 0x4, 0x3, 0x16, 0x4, 0x4d, 0x48, 0x12, 0x6, 0x6, 0x60, 0x6c, 0x6c, 0x1, 0x1]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x100, 0x100, 0x100, 0x9, 0xf, 0x4]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x30, 0xb, 0x48, 0x1b, 0x0, 0xc, 0x60, 0x5, 0xb, 0xe, 0x53, 0x24, 0x50, 0x1b, 0x6, 0x42acac960eb9f4a5, 0x48, 0x6, 0xb, 0xa, 0x1b, 0x6, 0x2, 0x16, 0x48, 0x4, 0x30, 0x36, 0x6]}]}, @NL80211_BAND_60GHZ={0x8c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x2, 0x5}, {0x2, 0x3}, {0x6, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x8}, {0x2, 0x4}, {0x7, 0x9}, {0x1, 0x3}, {0x6, 0x3}, {0x2, 0xa}, {0x7, 0x7}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x7}, {0x1, 0x1}, {0x1, 0x5}, {0x2, 0x4}, {0x1, 0x9}, {0x3, 0x5}, {0x6, 0x2}, {0x5, 0x4}, {0x0, 0x5}, {0x0, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x7, 0x2}, {0x5, 0x6}, {0x6, 0x9}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x6}, {0x0, 0xa}, {0x6, 0x3}, {0x5, 0x6}, {0x7, 0x1}, {0x0, 0x6}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x5, 0x6}, {0x6, 0x9}, {0x0, 0xa}, {0x5, 0x5}, {0x0, 0x9}, {0x5, 0x8}, {0x3, 0x1}, {0x3, 0xa}, {}, {0x5, 0x3}, {0x3, 0x5}, {0x0, 0x2}, {0x5, 0x6}, {0x1, 0x8}, {0x7, 0x5}, {0x0, 0x1}, {0x5, 0x1}, {0x2, 0x2}, {}, {0x7, 0x5}, {0x5, 0x1}, {0x6}, {0x4}, {0x7, 0x9}, {0x0, 0x9}, {0x1, 0x5}, {0x2, 0x2}, {0x2, 0xa}, {0x6, 0x7}, {0x0, 0x3}, {0x1, 0x8}, {0x2}, {0x0, 0x9}, {0x7, 0x8}, {0x6, 0x3}, {0x6, 0x6}, {0x5, 0x3}, {0x5, 0x8}, {0x2, 0x4}, {0x6, 0x8}, {0x1, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x3}, {0x2, 0x1}, {0x2, 0xa}, {0x6, 0x8}, {0x0, 0x4}, {0x7, 0x5}, {0x2, 0x7}, {0x6, 0xa}, {0x2, 0x9}, {0x1, 0x1}, {0x4, 0x3}, {0x5, 0x5}, {0x7, 0x3}, {0x6, 0x5}, {0x0, 0x3}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x6}, {0x6, 0x2}, {0x6, 0x1}, {0x3, 0x8}, {0x2, 0x6}, {0x7, 0x7}, {0x3, 0x6}, {0x2}, {0x0, 0x9}]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x81}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xdb}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8000}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x25}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8}]}]}]}, 0x764}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r10, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r11, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 6.438347543s ago: executing program 4 (id=1236): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f00)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x10) 6.306657911s ago: executing program 0 (id=1238): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_open_dev$sndctrl(&(0x7f0000005a80), 0xce5, 0x2400) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r4, &(0x7f0000000380)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff0000000000ffff"}) r5 = dup3(0xffffffffffffffff, r4, 0x0) read$FUSE(r5, &(0x7f0000005fc0)={0x2020}, 0xfeb4) setsockopt$sock_linger(r3, 0x1, 0xd, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x31) ioctl$SIOCAX25NOUID(r6, 0x89e3, &(0x7f0000000000)) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x2, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x1}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x15}]}, 0x24}, 0x1, 0x0, 0x0, 0x44001}, 0x22080001) syz_io_uring_setup(0x7cf4, 0x0, &(0x7f0000000080), &(0x7f0000000040)) close_range(r0, 0xffffffffffffffff, 0x0) 5.106477469s ago: executing program 0 (id=1240): sendmsg(0xffffffffffffffff, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000180)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x0, 0xa2e65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0, 0xffe0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0xc0844123, &(0x7f0000000080)=0x5) 5.064270999s ago: executing program 4 (id=1241): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r2 = dup(r1) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r2], 0x53) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f0000000100)=0xe8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x40, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [{@fowner_gt={'fowner>', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'wfdno'}}], 0x6b}}) 5.01428728s ago: executing program 3 (id=1242): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000007", 0x41d) recvmmsg(r3, &(0x7f00000021c0), 0x5b, 0x40, 0x0) 4.917961268s ago: executing program 4 (id=1243): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, 0x0, 0x5, 0xfffffffd, 0x2, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4810) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000840)={0x760, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x744, 0x11d, 0x0, 0x1, [{0x2d0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x80}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x114, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x8}, {0x0, 0x4}, {0x6, 0x2}, {0x4}, {0x7, 0x2}, {0x5, 0xa}, {0x6, 0x3}, {0x1, 0x5}, {0x7, 0x1}, {0x4, 0x1}, {0x2}, {0x3, 0x7}, {0x1, 0x3}, {0x5, 0x7}, {0x7, 0x9}, {0x6, 0x7}, {0x2, 0x7}, {0x6, 0x5}, {0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0xc, 0x36, 0xc, 0x16, 0xb, 0x1b, 0x3, 0x1, 0x60, 0x5, 0x4, 0x1b, 0x48, 0x24, 0x3b, 0xc, 0x48, 0xc, 0x3, 0x6, 0x16, 0x60, 0x36]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x1, 0xf, 0x100, 0xa, 0x9a8d, 0xb7]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x1, 0x1}, {0x3, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x7, 0x9}, {0x4}, {0x7, 0x7}, {}, {0x6}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x8}, {0x7, 0x6}, {0x3, 0x9}]}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x2, 0x2}, {0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x6}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x9, 0x1, 0x0, 0x3, 0x0, 0x101, 0x7]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x3, 0x5}, {0x1, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x7, 0x8}, {0x4, 0x8}, {0x0, 0x7}, {0x2, 0x3}, {0x7, 0x9}, {0x7, 0x1}, {0x1, 0x4}, {0x4, 0x7}, {0x3, 0xa}, {0x7, 0x7}, {0x7, 0x2}, {0x6, 0x5}, {0x0, 0xa}, {0x7, 0x4}, {0x0, 0x9}, {0x1, 0x6}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x2, 0x4}, {0x3, 0x7}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x3}, {0x1, 0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x1}, {0x3, 0x4}, {0x1, 0x1}, {0x5}, {0x3, 0x6}, {0x2, 0x8}, {0x4, 0x2}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x2}, {0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x5}, {0x5, 0x6}, {}, {0x2, 0x7}, {0x0, 0x4}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x6c, 0x9, 0x6, 0x48, 0x60, 0x3, 0x6, 0xb, 0x4, 0xc, 0x60, 0x3, 0x16, 0x18, 0x18, 0x18, 0x16, 0x12, 0x12, 0x5, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x16c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x7}, {0x0, 0x4}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x3}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x5}, {0x0, 0x5}, {0x2}, {0x6, 0x1}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0x6}, {0x7, 0x7}, {0x4, 0x4}, {0x1, 0x2}, {0x6, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x47, 0x2, [{0x7, 0x1}, {0x3, 0x6}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0xa}, {0x6, 0x4}, {0x0, 0x8}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x5}, {0x1}, {0x0, 0xa}, {0x2, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x3, 0x8}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x1}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x5}, {0x6}, {0x0, 0x7}, {0x1, 0xa}, {0x0, 0x3}, {0x6, 0x6}, {0x1, 0x8}, {0x3, 0x4}, {0x5, 0x7}, {0x2, 0xa}, {0x7}, {0x5, 0x5}, {0x6, 0x6}, {0x4}, {0x0, 0x6}, {0x0, 0x5}, {0x4}, {0x5, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x4, 0x9}, {0x1, 0x3}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x6}, {0x4, 0x3}, {0x7, 0x3}, {0x7, 0x4}, {0x7, 0x6}, {0x4, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x1, 0x1}, {0x3, 0x4}, {0x6}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x7}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x5}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x3, 0x4, 0xb502, 0x1c0, 0xc, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x200, 0x8, 0x6, 0x6, 0x7, 0xfff3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7a}]}, @NL80211_BAND_2GHZ={0xb0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x42, 0x2, [{0x6}, {0x3, 0x3}, {0x4, 0x2}, {0x5, 0x9}, {0x0, 0x6}, {0x4, 0x5}, {0x3, 0x5}, {0x3}, {0x4, 0x4}, {0x7, 0x8}, {0x3, 0x7}, {0x3, 0x8}, {0x3, 0xa}, {0x0, 0x9}, {0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x7, 0x6}, {0x7, 0x6}, {}, {0x6, 0x14}, {0x4}, {0x4, 0x1}, {0x0, 0x3}, {0x1, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x6, 0x5}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x4, 0x8}, {0x1, 0x9}, {0x1, 0x5}, {0x3, 0x2}, {0x5}, {0x7, 0x1}, {0x1, 0x6}, {0x0, 0x7}, {0x0, 0x3}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x5, 0x4}, {0x1, 0x8}, {0x5, 0x4}, {0x6, 0x8}, {0x4, 0x2}, {0x2, 0xa}, {0x0, 0x8}, {0x4, 0x4}, {0x3, 0x6}, {0x4, 0x9}, {0x2, 0x6}, {0x2, 0xa}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x3}, {0x1, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x3, 0x4}, {0x5, 0x3}, {0x5, 0x8}, {0x1, 0x7}, {0x1, 0x7}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x4, 0x2}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x3}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x8}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x4, 0x7}, {0x2, 0x5}, {0x0, 0x8}, {0x1, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5385, 0x8001, 0xf0e7, 0xfffe, 0x6, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x9, 0x40, 0x2, 0x8, 0x6]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x66}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x71}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x390, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x37c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x18, 0x2, [{0x3, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x0, 0x5}, {0x2, 0x6}, {0x1}, {0x2, 0x8}, {0x1, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x2, 0x9}, {0x4}, {0x3, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x6}, {0x4}, {0x6, 0x1}, {0x0, 0x8}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x95, 0x2, 0x3, 0xd6, 0x0, 0x6, 0x6]}}]}, @NL80211_BAND_60GHZ={0xb8, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2d, 0x2, [{0x2, 0x4}, {0x5}, {0x3, 0x2}, {0x7, 0x3}, {0x5, 0x3}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x7}, {0x3, 0x3}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x4, 0x7}, {0x2, 0x9}, {0x1}, {0x1, 0xa}, {0x1, 0xa}, {0x6, 0x6}, {0x6, 0x2}, {0x7, 0x3}, {0x6, 0x1}, {0x1}, {0x4, 0x5}, {0x1, 0x9}, {0x1}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x5}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x4}, {0x4, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x78, 0x6, 0xfd, 0xdc, 0x7, 0x915]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xca8, 0x4, 0x5b5d, 0x7, 0xfff, 0x4, 0x7]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x18, 0x24, 0x0, 0x18, 0x4, 0x1b, 0x4, 0xc, 0x9, 0x12, 0x0, 0xc, 0x4, 0x24, 0x24, 0x16, 0x63]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x4, 0x1, 0x12, 0x6e, 0x36, 0x6c, 0x1b, 0x6, 0xb, 0x16, 0x6, 0x2, 0x6c, 0x18, 0x6c, 0x60, 0x6, 0xc, 0x16, 0x5, 0x36]}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x7, 0x9}, {0x5, 0x9}, {0x5, 0x3}, {0x6, 0x2}, {0x1, 0x5}, {0x0, 0x1}, {0x7, 0x5}, {0x2, 0x1}, {0x3}]}]}, @NL80211_BAND_6GHZ={0x24, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x20, 0x1, [0x5098abc75f17ee31, 0x4, 0x6, 0x5, 0x12, 0x6c, 0x3, 0x6c, 0x1b, 0x24, 0x9, 0xb, 0x12, 0x3834ceaf91043b90, 0x1b, 0x48, 0x2, 0x12, 0x6, 0x30, 0x4, 0x4, 0x6c, 0xb, 0xb, 0xc, 0xc, 0x36]}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x8, 0xf, 0xe, 0x2, 0x3, 0x47, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x4, 0x7, 0x7, 0x80, 0x4, 0x1, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{0x1, 0x3}, {0x7, 0x7}, {0x4}, {0x5, 0x2}, {0x6}, {0x1}, {0x0, 0x5}, {0x5, 0x6}, {0x4, 0x5}, {0x2, 0x5}, {0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x1}, {0x7, 0x3}, {0x7, 0x8}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x7}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x7, 0x8}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x0, 0x1}, {0x4, 0x3}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x8}, {0x3, 0x9}, {0x4, 0x5}, {0x7, 0x8}, {0x6, 0x7}, {}, {0x7, 0x9}, {0x6, 0x1}, {0x2, 0xa}, {0x3, 0x7}, {0x5, 0x2}, {0x4, 0x9}, {0x4, 0x8}, {0x0, 0x4}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x2}, {0x1, 0xa}, {0x6}, {0x7, 0x1}, {0x1, 0x8}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x2}, {0x4, 0x3}, {0x5, 0x6}, {0x0, 0x4}, {0x2, 0x2}, {0x6, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6b, 0x5, 0x3, 0x2fd, 0x8, 0x1, 0x100, 0x1]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x36, 0x0, 0x3ff, 0xe61, 0x0, 0x7f, 0x10]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x4, 0x9}, {0x4, 0x9}, {0x1, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x3}, {0x0, 0x2}, {0x4, 0xa}, {0x5}, {0x6, 0x5}, {}, {0x7, 0x5}, {0x1, 0x9}, {0x0, 0x3}, {0x3, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0x6}, {0x6, 0x9}, {0x1, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x0, 0x7}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xdf, 0x6, 0x8, 0x2, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x4, 0x9, 0x8, 0x1, 0x9, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x48, 0x36, 0x18, 0x4, 0x5, 0x16, 0x16, 0x6c, 0x6, 0x1b, 0x6, 0x0, 0x48, 0x6, 0x4, 0x3, 0x16, 0x4, 0x4d, 0x48, 0x12, 0x6, 0x6, 0x60, 0x6c, 0x6c, 0x1, 0x1]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x100, 0x100, 0x100, 0x9, 0xf, 0x4]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x30, 0xb, 0x48, 0x1b, 0x0, 0xc, 0x60, 0x5, 0xb, 0xe, 0x53, 0x24, 0x50, 0x1b, 0x6, 0x42acac960eb9f4a5, 0x48, 0x6, 0xb, 0xa, 0x1b, 0x6, 0x2, 0x16, 0x48, 0x4, 0x30, 0x36, 0x6]}]}, @NL80211_BAND_60GHZ={0x8c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x2, 0x5}, {0x2, 0x3}, {0x6, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x8}, {0x2, 0x4}, {0x7, 0x9}, {0x1, 0x3}, {0x6, 0x3}, {0x2, 0xa}, {0x7, 0x7}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x7}, {0x1, 0x1}, {0x1, 0x5}, {0x2, 0x4}, {0x1, 0x9}, {0x3, 0x5}, {0x6, 0x2}, {0x5, 0x4}, {0x0, 0x5}, {0x0, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x7, 0x2}, {0x5, 0x6}, {0x6, 0x9}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x6}, {0x0, 0xa}, {0x6, 0x3}, {0x5, 0x6}, {0x7, 0x1}, {0x0, 0x6}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x5, 0x6}, {0x6, 0x9}, {0x0, 0xa}, {0x5, 0x5}, {0x0, 0x9}, {0x5, 0x8}, {0x3, 0x1}, {0x3, 0xa}, {}, {0x5, 0x3}, {0x3, 0x5}, {0x0, 0x2}, {0x5, 0x6}, {0x1, 0x8}, {0x7, 0x5}, {0x0, 0x1}, {0x5, 0x1}, {0x2, 0x2}, {}, {0x7, 0x5}, {0x5, 0x1}, {0x6}, {0x4}, {0x7, 0x9}, {0x0, 0x9}, {0x1, 0x5}, {0x2, 0x2}, {0x2, 0xa}, {0x6, 0x7}, {0x0, 0x3}, {0x1, 0x8}, {0x2}, {0x0, 0x9}, {0x7, 0x8}, {0x6, 0x3}, {0x6, 0x6}, {0x5, 0x3}, {0x5, 0x8}, {0x2, 0x4}, {0x6, 0x8}, {0x1, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x3}, {0x2, 0x1}, {0x2, 0xa}, {0x6, 0x8}, {0x0, 0x4}, {0x7, 0x5}, {0x2, 0x7}, {0x6, 0xa}, {0x2, 0x9}, {0x1, 0x1}, {0x4, 0x3}, {0x5, 0x5}, {0x7, 0x3}, {0x6, 0x5}, {0x0, 0x3}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x6}, {0x6, 0x2}, {0x6, 0x1}, {0x3, 0x8}, {0x2, 0x6}, {0x7, 0x7}, {0x3, 0x6}, {0x2}, {0x0, 0x9}]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xdb}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8000}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x25}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd}]}]}]}, 0x760}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 4.207226765s ago: executing program 4 (id=1244): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000006910a40000000000bc181000000000009500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000240)={r2, r1}) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, 0x2, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008880}, 0x1) r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r3, 0x0, 0x0, 0x1001f0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x64142, 0xe8) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r6, 0x5) r7 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r7, 0x2) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000200)={0x4, 0x240, 0x2c0, &(0x7f0000000400)=[0x0, 0x100000000, 0xfffffffffffffffe, 0x4, 0x6, 0x9, 0xd, 0x7, 0x80000000, 0xffffffffffffcf75, 0x4, 0x3ff, 0x6, 0xffffffffffff14c5, 0x4, 0x8001, 0xe59d, 0x7f, 0x0, 0x4, 0x5, 0x1000, 0x6c30000, 0x2, 0x1, 0xec, 0x4, 0x100000000, 0x9, 0xd, 0x7, 0x8c, 0x7fffffffffffffff, 0xb9, 0x8, 0x1, 0xf, 0x30, 0x2, 0x1, 0x80, 0x2, 0x3, 0xffffffff, 0x5, 0x764b, 0x7, 0x2, 0x9, 0x4, 0x9, 0x100000000, 0x5, 0x2f4, 0x0, 0x0, 0x1, 0x7, 0x5, 0x1dd, 0xec, 0x3, 0x0, 0x101, 0x6, 0xb, 0x5, 0x8, 0x3, 0x7, 0xbf, 0x1, 0x9, 0xe, 0x7, 0x2, 0x4, 0x800, 0x100, 0x10, 0x2, 0x6000, 0xffffffffffffffff, 0x6, 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x4, 0x3, 0x4d, 0x2, 0x3, 0x6, 0x1, 0x5, 0x1, 0x1ff, 0x40, 0x8001, 0xb, 0xffff, 0x6, 0x5, 0x1, 0x7, 0x9, 0x7, 0xf8, 0x2, 0x400, 0x9, 0x6, 0x4, 0x4, 0xf, 0x97b2, 0x6, 0xd, 0x8, 0x4, 0x8, 0x9, 0xc3, 0x1000, 0x0, 0x5, 0xdcd]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021040100000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000d8000380d40000800800034000000002c8000b80480001800a00010071756f74610000003800028008000240000000030c0001"], 0x188}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0xfffffffffffffa8a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sendfile(r4, r4, 0x0, 0x1000200201005) 4.067139589s ago: executing program 3 (id=1245): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sndseq(0xffffff9c, &(0x7f0000000100), 0x101000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000280)={{0x6, 0x6}, 0x1, 0x87c, 0x9, {0xff, 0x85}, 0xd4, 0x2}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='target PCI:0:0:5.0'], 0x13) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000fc0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="af000000", @ANYRES16=r3, @ANYBLOB="01002abd7000fcdbdf250c00000008000300", @ANYRES32=r5, @ANYBLOB="04000a00"], 0x20}, 0x1, 0x0, 0x0, 0x818}, 0x22000040) 3.902461893s ago: executing program 3 (id=1246): syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff0009240605060201000009240300030300"], 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0\x00'}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1500000004000000040401000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000417bd10a5535cb31a673bd62d2eb0000000400"/42], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r1], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r2}, &(0x7f0000000840), 0x0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r2, 0x0}, 0x20) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000000c0)={0xfffb, 0x4, 0x7, 0x8, 0x61134d30, 0xdf9, 0x6, 0x6}, 0x20) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000003200)={r0, 0xfffffffffffffff9, 0x9, 0x3}) getpid() r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000280)={0x9}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0x1000000000, 0x0, 0x40, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x68ff, 0x5, 0x7fff, 0x3, 0x400000000], 0x80ad003}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.741250831s ago: executing program 1 (id=1247): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, r4, 0x5, 0xfffffffd, 0x2, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4810) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000840)={0x754, r4, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x738, 0x11d, 0x0, 0x1, [{0x2d0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x80}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x114, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x8}, {0x0, 0x4}, {0x6, 0x2}, {0x4}, {0x7, 0x2}, {0x5, 0xa}, {0x6, 0x3}, {0x1, 0x5}, {0x7, 0x1}, {0x4, 0x1}, {0x2}, {0x3, 0x7}, {0x1, 0x3}, {0x5, 0x7}, {0x7, 0x9}, {0x6, 0x7}, {0x2, 0x7}, {0x6, 0x5}, {0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0xc, 0x36, 0xc, 0x16, 0xb, 0x1b, 0x3, 0x1, 0x60, 0x5, 0x4, 0x1b, 0x48, 0x24, 0x3b, 0xc, 0x48, 0xc, 0x3, 0x6, 0x16, 0x60, 0x36]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x1, 0xf, 0x100, 0xa, 0x9a8d, 0xb7]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x1, 0x1}, {0x3, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x7, 0x9}, {0x4}, {0x7, 0x7}, {}, {0x6}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x8}, {0x7, 0x6}, {0x3, 0x9}]}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x2, 0x2}, {0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x6}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x9, 0x1, 0x0, 0x3, 0x0, 0x101, 0x7]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x3, 0x5}, {0x1, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x7, 0x8}, {0x4, 0x8}, {0x0, 0x7}, {0x2, 0x3}, {0x7, 0x9}, {0x7, 0x1}, {0x1, 0x4}, {0x4, 0x7}, {0x3, 0xa}, {0x7, 0x7}, {0x7, 0x2}, {0x6, 0x5}, {0x0, 0xa}, {0x7, 0x4}, {0x0, 0x9}, {0x1, 0x6}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x2, 0x4}, {0x3, 0x7}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x3}, {0x1, 0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x1}, {0x3, 0x4}, {0x1, 0x1}, {0x5}, {0x3, 0x6}, {0x2, 0x8}, {0x4, 0x2}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x2}, {0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x5}, {0x5, 0x6}, {}, {0x2, 0x7}, {0x0, 0x4}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x6c, 0x9, 0x6, 0x48, 0x60, 0x3, 0x6, 0xb, 0x4, 0xc, 0x60, 0x3, 0x16, 0x18, 0x18, 0x18, 0x16, 0x12, 0x12, 0x5, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x16c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x7}, {0x0, 0x4}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x3}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x5}, {0x0, 0x5}, {0x2}, {0x6, 0x1}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0x6}, {0x7, 0x7}, {0x4, 0x4}, {0x1, 0x2}, {0x6, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x47, 0x2, [{0x7, 0x1}, {0x3, 0x6}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0xa}, {0x6, 0x4}, {0x0, 0x8}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x5}, {0x1}, {0x0, 0xa}, {0x2, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x3, 0x8}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x1}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x5}, {0x6}, {0x0, 0x7}, {0x1, 0xa}, {0x0, 0x3}, {0x6, 0x6}, {0x1, 0x8}, {0x3, 0x4}, {0x5, 0x7}, {0x2, 0xa}, {0x7}, {0x5, 0x5}, {0x6, 0x6}, {0x4}, {0x0, 0x6}, {0x0, 0x5}, {0x4}, {0x5, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x4, 0x9}, {0x1, 0x3}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x6}, {0x4, 0x3}, {0x7, 0x3}, {0x7, 0x4}, {0x7, 0x6}, {0x4, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x1, 0x1}, {0x3, 0x4}, {0x6}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x7}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x5}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x3, 0x4, 0xb502, 0x1c0, 0xc, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x200, 0x8, 0x6, 0x6, 0x7, 0xfff3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7a}]}, @NL80211_BAND_2GHZ={0xb0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x42, 0x2, [{0x6}, {0x3, 0x3}, {0x4, 0x2}, {0x5, 0x9}, {0x0, 0x6}, {0x4, 0x5}, {0x3, 0x5}, {0x3}, {0x4, 0x4}, {0x7, 0x8}, {0x3, 0x7}, {0x3, 0x8}, {0x3, 0xa}, {0x0, 0x9}, {0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x7, 0x6}, {0x7, 0x6}, {}, {0x6, 0x14}, {0x4}, {0x4, 0x1}, {0x0, 0x3}, {0x1, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x6, 0x5}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x4, 0x8}, {0x1, 0x9}, {0x1, 0x5}, {0x3, 0x2}, {0x5}, {0x7, 0x1}, {0x1, 0x6}, {0x0, 0x7}, {0x0, 0x3}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x5, 0x4}, {0x1, 0x8}, {0x5, 0x4}, {0x6, 0x8}, {0x4, 0x2}, {0x2, 0xa}, {0x0, 0x8}, {0x4, 0x4}, {0x3, 0x6}, {0x4, 0x9}, {0x2, 0x6}, {0x2, 0xa}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x3}, {0x1, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x3, 0x4}, {0x5, 0x3}, {0x5, 0x8}, {0x1, 0x7}, {0x1, 0x7}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x4, 0x2}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x3}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x8}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x4, 0x7}, {0x2, 0x5}, {0x0, 0x8}, {0x1, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5385, 0x8001, 0xf0e7, 0xfffe, 0x6, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x9, 0x40, 0x2, 0x8, 0x6]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x66}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x71}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x370, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x35c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x18, 0x2, [{0x3, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x0, 0x5}, {0x2, 0x6}, {0x1}, {0x2, 0x8}, {0x1, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x2, 0x9}, {0x4}, {0x3, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x6}, {0x4}, {0x6, 0x1}, {0x0, 0x8}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x95, 0x2, 0x3, 0xd6, 0x0, 0x6, 0x6]}}]}, @NL80211_BAND_60GHZ={0x94, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2d, 0x2, [{0x2, 0x4}, {0x5}, {0x3, 0x2}, {0x7, 0x3}, {0x5, 0x3}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x7}, {0x3, 0x3}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x4, 0x7}, {0x2, 0x9}, {0x1}, {0x1, 0xa}, {0x1, 0xa}, {0x6, 0x6}, {0x6, 0x2}, {0x7, 0x3}, {0x6, 0x1}, {0x1}, {0x4, 0x5}, {0x1, 0x9}, {0x1}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x5}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x4}, {0x4, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x78, 0x6, 0xfd, 0xdc, 0x7, 0x915]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xca8, 0x4, 0x5b5d, 0x7, 0xfff, 0x4, 0x7]}}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x4, 0x1, 0x12, 0x6e, 0x36, 0x6c, 0x1b, 0x6, 0xb, 0x16, 0x6, 0x2, 0x6c, 0x18, 0x6c, 0x60, 0x6, 0xc, 0x16, 0x5, 0x36]}]}, @NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x5098abc75f17ee31, 0x4, 0x6, 0x9, 0x5, 0x12, 0x6c, 0x3, 0x6c, 0x1b, 0x24, 0x9, 0xb, 0x12, 0x3834ceaf91043b90, 0x1b, 0x48, 0x2, 0x12, 0x6, 0x30, 0x4, 0x4, 0x6c, 0xb, 0xb, 0xc, 0xc, 0x36]}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x8, 0xf, 0xe, 0x2, 0x3, 0x47, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x4, 0x7, 0x7, 0x80, 0x4, 0x1, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{0x1, 0x3}, {0x7, 0x7}, {0x4}, {0x5, 0x2}, {0x6}, {0x1}, {0x0, 0x5}, {0x5, 0x6}, {0x4, 0x5}, {0x2, 0x5}, {0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x1}, {0x7, 0x3}, {0x7, 0x8}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x7}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x7, 0x8}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x0, 0x1}, {0x4, 0x3}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x8}, {0x3, 0x9}, {0x4, 0x5}, {0x7, 0x8}, {0x6, 0x7}, {}, {0x7, 0x9}, {0x6, 0x1}, {0x2, 0xa}, {0x3, 0x7}, {0x5, 0x2}, {0x4, 0x9}, {0x4, 0x8}, {0x0, 0x4}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x2}, {0x1, 0xa}, {0x6}, {0x7, 0x1}, {0x1, 0x8}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x2}, {0x4, 0x3}, {0x5, 0x6}, {0x0, 0x4}, {0x2, 0x2}, {0x6, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6b, 0x5, 0x3, 0x2fd, 0x8, 0x1, 0x100, 0x1]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x36, 0x0, 0x3ff, 0xe61, 0x0, 0x7f, 0x10]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x4, 0x9}, {0x4, 0x9}, {0x1, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x3}, {0x0, 0x2}, {0x4, 0xa}, {0x5}, {0x6, 0x5}, {}, {0x7, 0x5}, {0x1, 0x9}, {0x0, 0x3}, {0x3, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0x6}, {0x6, 0x9}, {0x1, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x0, 0x7}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xdf, 0x6, 0x8, 0x2, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x4, 0x9, 0x8, 0x1, 0x9, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x48, 0x36, 0x18, 0x4, 0x5, 0x16, 0x16, 0x6c, 0x6, 0x1b, 0x6, 0x0, 0x48, 0x6, 0x4, 0x3, 0x16, 0x4, 0x4d, 0x48, 0x12, 0x6, 0x6, 0x60, 0x6c, 0x6c, 0x1, 0x1]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x100, 0x100, 0x100, 0x9, 0xf, 0x4]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x30, 0xb, 0x48, 0x1b, 0x0, 0xc, 0x60, 0x5, 0xb, 0xe, 0x53, 0x24, 0x50, 0x1b, 0x6, 0x42acac960eb9f4a5, 0x48, 0x6, 0xb, 0xa, 0x1b, 0x6, 0x2, 0x16, 0x48, 0x4, 0x30, 0x36, 0x6]}]}, @NL80211_BAND_60GHZ={0x8c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x2, 0x5}, {0x2, 0x3}, {0x6, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x8}, {0x2, 0x4}, {0x7, 0x9}, {0x1, 0x3}, {0x6, 0x3}, {0x2, 0xa}, {0x7, 0x7}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x7}, {0x1, 0x1}, {0x1, 0x5}, {0x2, 0x4}, {0x1, 0x9}, {0x3, 0x5}, {0x6, 0x2}, {0x5, 0x4}, {0x0, 0x5}, {0x0, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x7, 0x2}, {0x5, 0x6}, {0x6, 0x9}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x6}, {0x0, 0xa}, {0x6, 0x3}, {0x5, 0x6}, {0x7, 0x1}, {0x0, 0x6}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x5, 0x6}, {0x6, 0x9}, {0x0, 0xa}, {0x5, 0x5}, {0x0, 0x9}, {0x5, 0x8}, {0x3, 0x1}, {0x3, 0xa}, {}, {0x5, 0x3}, {0x3, 0x5}, {0x0, 0x2}, {0x5, 0x6}, {0x1, 0x8}, {0x7, 0x5}, {0x0, 0x1}, {0x5, 0x1}, {0x2, 0x2}, {}, {0x7, 0x5}, {0x5, 0x1}, {0x6}, {0x4}, {0x7, 0x9}, {0x0, 0x9}, {0x1, 0x5}, {0x2, 0x2}, {0x2, 0xa}, {0x6, 0x7}, {0x0, 0x3}, {0x1, 0x8}, {0x2}, {0x0, 0x9}, {0x7, 0x8}, {0x6, 0x3}, {0x6, 0x6}, {0x5, 0x3}, {0x5, 0x8}, {0x2, 0x4}, {0x6, 0x8}, {0x1, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x3}, {0x2, 0x1}, {0x2, 0xa}, {0x6, 0x8}, {0x0, 0x4}, {0x7, 0x5}, {0x2, 0x7}, {0x6, 0xa}, {0x2, 0x9}, {0x1, 0x1}, {0x4, 0x3}, {0x5, 0x5}, {0x7, 0x3}, {0x6, 0x5}, {0x0, 0x3}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x6}, {0x6, 0x2}, {0x6, 0x1}, {0x3, 0x8}, {0x2, 0x6}, {0x7, 0x7}, {0x3, 0x6}, {0x2}, {0x0, 0x9}]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x81}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xdb}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8000}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x25}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8}]}]}]}, 0x754}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.413316853s ago: executing program 1 (id=1249): mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x50}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffffffffffe68, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @remote}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x8, 0x4, 0x4, 0xbf22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) 2.954885307s ago: executing program 1 (id=1250): mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x50}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffffffffffe68, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @remote}, 0xc) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) syz_emit_ethernet(0x2416, 0x0, 0x0) gettid() bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0500ffffffff000000002100000008000300", @ANYRES8=r1, @ANYBLOB="38002d800a00000002020202020202020200000a00000001", @ANYRESDEC], 0x54}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x8, 0x4, 0x4, 0xbf22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000140)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) socket$inet(0x2, 0x1, 0x36490000) r4 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r4, &(0x7f0000000040)={0x18, 0x2, {0x2, @empty}}, 0x1e) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf) 2.849004616s ago: executing program 2 (id=1251): socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000340), 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x0, 0x0, &(0x7f0000000bc0)) r1 = socket(0x10, 0x803, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000006c0)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703100000001f03000000000700040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4014) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x80c0) sendmsg$nl_route_sched(r1, 0x0, 0x400c084) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fstat(r2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r5 = syz_open_dev$sndmidi(0x0, 0x2, 0x141101) dup(r5) syz_io_uring_setup(0xa39, 0x0, 0x0, &(0x7f0000000340)) 2.03146618s ago: executing program 0 (id=1252): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f000028c000/0x4000)=nil, 0x4000, 0x0, 0x8031, r1, 0x100000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x11e, 0x1e, 0xffffffffffffffff, 0x0) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x20000400) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x0, 0x0, 0xfffffffc}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r6, 0x400442c8, &(0x7f00000001c0)=ANY=[@ANYRES32, @ANYBLOB="0125ecc46800"]) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/net/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd1l,'}, 0x30) r7 = syz_open_dev$video4linux(&(0x7f0000001280), 0x5, 0xa0000) ioctl$VIDIOC_SUBDEV_S_CROP(r7, 0xc038563c, &(0x7f00000012c0)={0x1, 0x0, {0x0, 0x401, 0x1000, 0x40}}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r8, 0x3, 0x0) getdents(r8, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x10) sendmsg$nl_xfrm(r0, 0x0, 0x0) 1.913680718s ago: executing program 4 (id=1253): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xc6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x6}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080), 0x0}, 0x0) 1.81019412s ago: executing program 1 (id=1254): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd29, 0x25dfdbfd, {0x7, 0x0, 0x0, r1, 0x40, 0x9ffac2705d37b0b7, 0x5}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x20000040) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x9048}}) (async, rerun: 64) preadv(0xffffffffffffffff, &(0x7f0000010440)=[{&(0x7f0000000040)=""/160, 0xa0}], 0x1, 0xc03, 0x0) (async, rerun: 64) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000100)={'macvlan1\x00'}) (async) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) (async) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, 0x0) (async, rerun: 64) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 64) ptrace(0x10, r4) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x100008b}, 0x0) (async, rerun: 32) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) (async, rerun: 32) r5 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) (rerun: 32) read$msr(r5, &(0x7f0000002700)=""/102392, 0x18ff8) (async) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x17, 0x1, {0xb, './bus/file0'}}, 0x14) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) fchdir(r7) (async) r8 = open(&(0x7f0000000280)='./bus/file0\x00', 0x303a42, 0x20) ftruncate(r8, 0x2007ffb) sendfile(r8, r8, 0x0, 0x1000000201005) (async, rerun: 64) ftruncate(r8, 0x30) (async, rerun: 64) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="700000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="000000000204040008001300", @ANYRES32=r4, @ANYBLOB], 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x40080) (async) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3}) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) 1.662353774s ago: executing program 1 (id=1255): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000006910a40000000000bc181000000000009500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000240)={r2, r1}) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, 0x2, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008880}, 0x1) r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r3, 0x0, 0x0, 0x1001f0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x64142, 0xe8) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r6, 0x5) flock(0xffffffffffffffff, 0x2) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000200)={0x4, 0x240, 0x2c0, &(0x7f0000000400)=[0x0, 0x100000000, 0xfffffffffffffffe, 0x4, 0x6, 0x9, 0xd, 0x7, 0x80000000, 0xffffffffffffcf75, 0x4, 0x3ff, 0x6, 0xffffffffffff14c5, 0x4, 0x8001, 0xe59d, 0x7f, 0x0, 0x4, 0x5, 0x1000, 0x6c30000, 0x2, 0x1, 0xec, 0x4, 0x100000000, 0x9, 0xd, 0x7, 0x8c, 0x7fffffffffffffff, 0xb9, 0x8, 0x1, 0xf, 0x30, 0x2, 0x1, 0x80, 0x2, 0x3, 0xffffffff, 0x5, 0x764b, 0x7, 0x2, 0x9, 0x4, 0x9, 0x100000000, 0x5, 0x2f4, 0x0, 0x0, 0x1, 0x7, 0x5, 0x1dd, 0xec, 0x3, 0x0, 0x101, 0x6, 0xb, 0x5, 0x8, 0x3, 0x7, 0xbf, 0x1, 0x9, 0xe, 0x7, 0x2, 0x4, 0x800, 0x100, 0x10, 0x2, 0x6000, 0xffffffffffffffff, 0x6, 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x4, 0x3, 0x4d, 0x2, 0x3, 0x6, 0x1, 0x5, 0x1, 0x1ff, 0x40, 0x8001, 0xb, 0xffff, 0x6, 0x5, 0x1, 0x7, 0x9, 0x7, 0xf8, 0x2, 0x400, 0x9, 0x6, 0x4, 0x4, 0xf, 0x97b2, 0x6, 0xd, 0x8, 0x4, 0x8, 0x9, 0xc3, 0x1000, 0x0, 0x5, 0xdcd]}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021040100000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000d8000380d40000800800034000000002c8000b80480001800a00010071756f74610000003800028008000240000000030c0001"], 0x188}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sendfile(r4, r4, 0x0, 0x1000200201005) 1.661474644s ago: executing program 2 (id=1256): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, r3, 0x5, 0xfffffffd, 0x2, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4810) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000840)={0x774, r3, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x758, 0x11d, 0x0, 0x1, [{0x2d0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x80}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x114, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x8}, {0x0, 0x4}, {0x6, 0x2}, {0x4}, {0x7, 0x2}, {0x5, 0xa}, {0x6, 0x3}, {0x1, 0x5}, {0x7, 0x1}, {0x4, 0x1}, {0x2}, {0x3, 0x7}, {0x1, 0x3}, {0x5, 0x7}, {0x7, 0x9}, {0x6, 0x7}, {0x2, 0x7}, {0x6, 0x5}, {0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0xc, 0x36, 0xc, 0x16, 0xb, 0x1b, 0x3, 0x1, 0x60, 0x5, 0x4, 0x1b, 0x48, 0x24, 0x3b, 0xc, 0x48, 0xc, 0x3, 0x6, 0x16, 0x60, 0x36]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x1, 0xf, 0x100, 0xa, 0x9a8d, 0xb7]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x1, 0x1}, {0x3, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x7, 0x9}, {0x4}, {0x7, 0x7}, {}, {0x6}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x8}, {0x7, 0x6}, {0x3, 0x9}]}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x2, 0x2}, {0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x6}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x9, 0x1, 0x0, 0x3, 0x0, 0x101, 0x7]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x3, 0x5}, {0x1, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x7, 0x8}, {0x4, 0x8}, {0x0, 0x7}, {0x2, 0x3}, {0x7, 0x9}, {0x7, 0x1}, {0x1, 0x4}, {0x4, 0x7}, {0x3, 0xa}, {0x7, 0x7}, {0x7, 0x2}, {0x6, 0x5}, {0x0, 0xa}, {0x7, 0x4}, {0x0, 0x9}, {0x1, 0x6}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x2, 0x4}, {0x3, 0x7}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x3}, {0x1, 0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x1}, {0x3, 0x4}, {0x1, 0x1}, {0x5}, {0x3, 0x6}, {0x2, 0x8}, {0x4, 0x2}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x2}, {0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x5}, {0x5, 0x6}, {}, {0x2, 0x7}, {0x0, 0x4}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x6c, 0x9, 0x6, 0x48, 0x60, 0x3, 0x6, 0xb, 0x4, 0xc, 0x60, 0x3, 0x16, 0x18, 0x18, 0x18, 0x16, 0x12, 0x12, 0x5, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x16c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x7}, {0x0, 0x4}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x3}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x5}, {0x0, 0x5}, {0x2}, {0x6, 0x1}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0x6}, {0x7, 0x7}, {0x4, 0x4}, {0x1, 0x2}, {0x6, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x47, 0x2, [{0x7, 0x1}, {0x3, 0x6}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0xa}, {0x6, 0x4}, {0x0, 0x8}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x5}, {0x1}, {0x0, 0xa}, {0x2, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x3, 0x8}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x1}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x5}, {0x6}, {0x0, 0x7}, {0x1, 0xa}, {0x0, 0x3}, {0x6, 0x6}, {0x1, 0x8}, {0x3, 0x4}, {0x5, 0x7}, {0x2, 0xa}, {0x7}, {0x5, 0x5}, {0x6, 0x6}, {0x4}, {0x0, 0x6}, {0x0, 0x5}, {0x4}, {0x5, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x4, 0x9}, {0x1, 0x3}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x6}, {0x4, 0x3}, {0x7, 0x3}, {0x7, 0x4}, {0x7, 0x6}, {0x4, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x1, 0x1}, {0x3, 0x4}, {0x6}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x7}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x5}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x3, 0x4, 0xb502, 0x1c0, 0xc, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x200, 0x8, 0x6, 0x6, 0x7, 0xfff3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7a}]}, @NL80211_BAND_2GHZ={0xb0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x42, 0x2, [{0x6}, {0x3, 0x3}, {0x4, 0x2}, {0x5, 0x9}, {0x0, 0x6}, {0x4, 0x5}, {0x3, 0x5}, {0x3}, {0x4, 0x4}, {0x7, 0x8}, {0x3, 0x7}, {0x3, 0x8}, {0x3, 0xa}, {0x0, 0x9}, {0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x7, 0x6}, {0x7, 0x6}, {}, {0x6, 0x14}, {0x4}, {0x4, 0x1}, {0x0, 0x3}, {0x1, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x6, 0x5}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x4, 0x8}, {0x1, 0x9}, {0x1, 0x5}, {0x3, 0x2}, {0x5}, {0x7, 0x1}, {0x1, 0x6}, {0x0, 0x7}, {0x0, 0x3}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x5, 0x4}, {0x1, 0x8}, {0x5, 0x4}, {0x6, 0x8}, {0x4, 0x2}, {0x2, 0xa}, {0x0, 0x8}, {0x4, 0x4}, {0x3, 0x6}, {0x4, 0x9}, {0x2, 0x6}, {0x2, 0xa}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x3}, {0x1, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x3, 0x4}, {0x5, 0x3}, {0x5, 0x8}, {0x1, 0x7}, {0x1, 0x7}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x4, 0x2}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x3}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x8}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x4, 0x7}, {0x2, 0x5}, {0x0, 0x8}, {0x1, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5385, 0x8001, 0xf0e7, 0xfffe, 0x6, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x9, 0x40, 0x2, 0x8, 0x6]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x66}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x71}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x38c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x378, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x18, 0x2, [{0x3, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x0, 0x5}, {0x2, 0x6}, {0x1}, {0x2, 0x8}, {0x1, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x2, 0x9}, {0x4}, {0x3, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x6}, {0x4}, {0x6, 0x1}, {0x0, 0x8}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x95, 0x2, 0x3, 0xd6, 0x0, 0x6, 0x6]}}]}, @NL80211_BAND_60GHZ={0xb0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2c, 0x2, [{0x2, 0x4}, {0x5}, {0x3, 0x2}, {0x7, 0x3}, {0x5, 0x3}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x7}, {0x3, 0x3}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x4, 0x7}, {0x2, 0x9}, {0x1}, {0x1, 0xa}, {0x1, 0xa}, {0x6, 0x6}, {0x6, 0x2}, {0x7, 0x3}, {0x6, 0x1}, {0x4, 0x5}, {0x1, 0x9}, {0x1}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x5}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x4}, {0x4, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x78, 0x6, 0xfd, 0xdc, 0x7, 0x915]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xca8, 0x4, 0x5b5d, 0x7, 0xfff, 0x4, 0x7]}}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x18, 0x24, 0x0, 0x18, 0x4, 0x1b, 0x4, 0xc, 0x9, 0x0, 0xc, 0x4, 0x24, 0x24, 0x16, 0x63]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x4, 0x1, 0x12, 0x6e, 0x36, 0x6c, 0x1b, 0x6, 0xb, 0x16, 0x6, 0x2, 0x6c, 0x18, 0x6c, 0x60, 0x6, 0xc, 0x16, 0x5, 0x36]}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x7, 0x9}, {0x5, 0x9}, {0x5, 0x3}, {0x6, 0x2}, {0x1, 0x5}, {0x0, 0x1}, {0x7, 0x5}, {0x2, 0x1}, {0x3}]}]}, @NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x5098abc75f17ee31, 0x4, 0x6, 0x9, 0x5, 0x12, 0x6c, 0x3, 0x6c, 0x1b, 0x24, 0x9, 0xb, 0x12, 0x3834ceaf91043b90, 0x1b, 0x48, 0x2, 0x12, 0x6, 0x30, 0x4, 0x4, 0x6c, 0xb, 0xb, 0xc, 0xc, 0x36]}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x8, 0xf, 0xe, 0x2, 0x3, 0x47, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x4, 0x7, 0x7, 0x80, 0x4, 0x1, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{0x1, 0x3}, {0x7, 0x7}, {0x4}, {0x5, 0x2}, {0x6}, {0x1}, {0x0, 0x5}, {0x5, 0x6}, {0x4, 0x5}, {0x2, 0x5}, {0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x1}, {0x7, 0x3}, {0x7, 0x8}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x7}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x7, 0x8}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x0, 0x1}, {0x4, 0x3}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x8}, {0x3, 0x9}, {0x4, 0x5}, {0x7, 0x8}, {0x6, 0x7}, {}, {0x7, 0x9}, {0x6, 0x1}, {0x2, 0xa}, {0x3, 0x7}, {0x5, 0x2}, {0x4, 0x9}, {0x4, 0x8}, {0x0, 0x4}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x2}, {0x1, 0xa}, {0x6}, {0x7, 0x1}, {0x1, 0x8}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x2}, {0x4, 0x3}, {0x5, 0x6}, {0x0, 0x4}, {0x2, 0x2}, {0x6, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6b, 0x5, 0x3, 0x2fd, 0x8, 0x1, 0x100, 0x1]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x36, 0x0, 0x3ff, 0xe61, 0x0, 0x7f, 0x10]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x4, 0x9}, {0x4, 0x9}, {0x1, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x3}, {0x0, 0x2}, {0x4, 0xa}, {0x5}, {0x6, 0x5}, {}, {0x7, 0x5}, {0x1, 0x9}, {0x0, 0x3}, {0x3, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0x6}, {0x6, 0x9}, {0x1, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x0, 0x7}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xdf, 0x6, 0x8, 0x2, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x4, 0x9, 0x8, 0x1, 0x9, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x48, 0x36, 0x18, 0x4, 0x5, 0x16, 0x16, 0x6c, 0x6, 0x1b, 0x6, 0x0, 0x48, 0x6, 0x4, 0x3, 0x16, 0x4, 0x4d, 0x48, 0x12, 0x6, 0x6, 0x60, 0x6c, 0x6c, 0x1, 0x1]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x100, 0x100, 0x100, 0x9, 0xf, 0x4]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x30, 0xb, 0x48, 0x1b, 0x0, 0xc, 0x60, 0x5, 0xb, 0xe, 0x53, 0x24, 0x50, 0x1b, 0x6, 0x42acac960eb9f4a5, 0x48, 0x6, 0xb, 0xa, 0x1b, 0x6, 0x2, 0x16, 0x48, 0x4, 0x30, 0x36, 0x6]}]}, @NL80211_BAND_60GHZ={0x8c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x2, 0x5}, {0x2, 0x3}, {0x6, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x8}, {0x2, 0x4}, {0x7, 0x9}, {0x1, 0x3}, {0x6, 0x3}, {0x2, 0xa}, {0x7, 0x7}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x7}, {0x1, 0x1}, {0x1, 0x5}, {0x2, 0x4}, {0x1, 0x9}, {0x3, 0x5}, {0x6, 0x2}, {0x5, 0x4}, {0x0, 0x5}, {0x0, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x7, 0x2}, {0x5, 0x6}, {0x6, 0x9}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x6}, {0x0, 0xa}, {0x6, 0x3}, {0x5, 0x6}, {0x7, 0x1}, {0x0, 0x6}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x5, 0x6}, {0x6, 0x9}, {0x0, 0xa}, {0x5, 0x5}, {0x0, 0x9}, {0x5, 0x8}, {0x3, 0x1}, {0x3, 0xa}, {}, {0x5, 0x3}, {0x3, 0x5}, {0x0, 0x2}, {0x5, 0x6}, {0x1, 0x8}, {0x7, 0x5}, {0x0, 0x1}, {0x5, 0x1}, {0x2, 0x2}, {}, {0x7, 0x5}, {0x5, 0x1}, {0x6}, {0x4}, {0x7, 0x9}, {0x0, 0x9}, {0x1, 0x5}, {0x2, 0x2}, {0x2, 0xa}, {0x6, 0x7}, {0x0, 0x3}, {0x1, 0x8}, {0x2}, {0x0, 0x9}, {0x7, 0x8}, {0x6, 0x3}, {0x6, 0x6}, {0x5, 0x3}, {0x5, 0x8}, {0x2, 0x4}, {0x6, 0x8}, {0x1, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x3}, {0x2, 0x1}, {0x2, 0xa}, {0x6, 0x8}, {0x0, 0x4}, {0x7, 0x5}, {0x2, 0x7}, {0x6, 0xa}, {0x2, 0x9}, {0x1, 0x1}, {0x4, 0x3}, {0x5, 0x5}, {0x7, 0x3}, {0x6, 0x5}, {0x0, 0x3}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x6}, {0x6, 0x2}, {0x6, 0x1}, {0x3, 0x8}, {0x2, 0x6}, {0x7, 0x7}, {0x3, 0x6}, {0x2}, {0x0, 0x9}]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x81}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xdb}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8000}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x25}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8}]}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1.612620379s ago: executing program 2 (id=1257): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000600000000a20000000000a05000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000008580100000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c010380400000800800034000000002340002803000028008000180fffffffd09"], 0x1ec}}, 0x0) 1.526590784s ago: executing program 1 (id=1258): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000007c0)={'wlan0\x00', 0x0}) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040d90455a018000000000109022400010000000009040100010300000009210000000122050009058103"], 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r6}, 0x10) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/freeze_filesystems', 0x4ae82, 0x12c) write$UHID_CREATE2(r7, &(0x7f0000000000)=ANY=[@ANYRESDEC=r6], 0x118) epoll_create1(0x80000) read$char_usb(0xffffffffffffffff, &(0x7f0000001980)=""/179, 0xb3) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000000)={'bridge0\x00', @random="01001000"}) syz_usb_control_io(r4, &(0x7f0000000ac0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) socket$packet(0x11, 0x3, 0x300) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x48) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r9, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r8}, 0x20) shutdown(r8, 0x0) ppoll(&(0x7f00000002c0)=[{r8, 0x9120}], 0x1, 0x0, 0x0, 0x0) r10 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r10, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x6}, 0x1c) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20040051}, 0x0) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYRESOCT=r7], 0x80}, 0x1, 0x0, 0x0, 0x40054}, 0x4000012) syz_emit_ethernet(0x3a, &(0x7f0000000600)={@local, @local, @val={@void, {0x8100, 0x2, 0x1, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x2e, 0x28, 0x65, 0x0, 0x10, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @multicast2}, {{0x4e24, 0x4e20, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffe, 0x0, 0x57}}}}}}, 0x0) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000940)={&(0x7f0000000840)={0x3c, r2, 0x10, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IE={0x1e, 0x2a, [@gcr_ga={0xbd, 0x6}, @supported_rates={0x1, 0x8, [{0x36}, {0x30}, {0x6}, {0x36}, {0x24, 0x1}, {0x60, 0x1}, {0x6}, {0x2, 0x1}]}, @mesh_id={0x72, 0x6}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x812) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r10, 0x40089413, &(0x7f0000000800)=0x6) 1.460002231s ago: executing program 2 (id=1259): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000000000008500000053000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)="0000000000000000000001000000", 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.459332397s ago: executing program 3 (id=1260): mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x50}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffffffffffe68, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @remote}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x8, 0x4, 0x4, 0xbf22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) 1.081841217s ago: executing program 0 (id=1261): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00'}, 0x10) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f00000008c0)=r3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = io_uring_setup(0x5594, &(0x7f0000000100)={0x0, 0x10000000, 0x1, 0x1, 0x1d2}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 750.721448ms ago: executing program 3 (id=1262): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, 0x0, 0x5, 0xfffffffd, 0x2, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4810) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000840)={0x6e8, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x6cc, 0x11d, 0x0, 0x1, [{0x2c8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x80}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x114, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x17, 0x2, [{0x0, 0x8}, {0x0, 0x4}, {0x6, 0x2}, {0x4}, {0x7, 0x2}, {0x5, 0xa}, {0x6, 0x3}, {0x1, 0x5}, {0x7, 0x1}, {0x4, 0x1}, {0x2}, {0x3, 0x7}, {0x1, 0x3}, {0x5, 0x7}, {0x7, 0x9}, {0x6, 0x7}, {0x2, 0x7}, {0x6, 0x5}, {0x7}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0xc, 0x36, 0xc, 0x16, 0xb, 0x1b, 0x3, 0x1, 0x60, 0x5, 0x4, 0x1b, 0x48, 0x24, 0x3b, 0xc, 0x48, 0xc, 0x3, 0x6, 0x16, 0x60, 0x36]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x1, 0xf, 0x100, 0xa, 0x9a8d, 0xb7]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x1, 0x1}, {0x3, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x7, 0x9}, {0x4}, {0x7, 0x7}, {}, {0x6}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0xa}, {0x5, 0x3}, {0x1, 0xa}, {0x5, 0x7}, {0x3, 0x8}, {0x7, 0x6}, {0x3, 0x9}]}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x2, 0x2}, {0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x3, 0x1}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x6}]}]}, @NL80211_BAND_6GHZ={0x8c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x9, 0x1, 0x0, 0x3, 0x0, 0x101, 0x7]}}, @NL80211_TXRATE_HT={0x4f, 0x2, [{0x3, 0x5}, {0x1, 0x7}, {0x2, 0x2}, {0x7, 0x1}, {0x1, 0x8}, {0x1, 0x4}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x7, 0x8}, {0x4, 0x8}, {0x0, 0x7}, {0x2, 0x3}, {0x7, 0x9}, {0x7, 0x1}, {0x1, 0x4}, {0x4, 0x7}, {0x3, 0xa}, {0x7, 0x7}, {0x7, 0x2}, {0x6, 0x5}, {0x0, 0xa}, {0x7, 0x4}, {0x0, 0x9}, {0x1, 0x6}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x2, 0x4}, {0x3, 0x7}, {0x4, 0x1}, {0x6, 0x9}, {0x4, 0x3}, {0x1, 0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x3}, {0x7, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x1}, {0x3, 0x4}, {0x1, 0x1}, {0x5}, {0x3, 0x6}, {0x2, 0x8}, {0x4, 0x2}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x5}, {0x5, 0x2}, {0x2}, {0x5, 0x8}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x5}, {0x5, 0x6}, {}, {0x2, 0x7}, {0x0, 0x4}, {0x5, 0xa}, {0x6, 0x1}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x6c, 0x9, 0x6, 0x48, 0x60, 0x3, 0x6, 0xb, 0x4, 0xc, 0x60, 0x3, 0x16, 0x18, 0x18, 0x18, 0x16, 0x12, 0x12, 0x5, 0x3]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x164, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x1, 0x7}, {0x0, 0x4}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x3}, {0x6, 0x6}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x5}, {0x0, 0x5}, {0x2}, {0x6, 0x1}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x3}, {0x3, 0x9}, {0x2, 0x6}, {0x1, 0x6}, {0x7, 0x7}, {0x4, 0x4}, {0x1, 0x2}, {0x6, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x47, 0x2, [{0x7, 0x1}, {0x3, 0x6}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0xa}, {0x6, 0x4}, {0x0, 0x8}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x2}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x5}, {0x1}, {0x0, 0xa}, {0x2, 0x5}, {0x7, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x3, 0x8}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x1}, {0x3, 0xa}, {0x1, 0x7}, {0x2, 0x5}, {0x6}, {0x0, 0x7}, {0x1, 0xa}, {0x0, 0x3}, {0x6, 0x6}, {0x1, 0x8}, {0x3, 0x4}, {0x5, 0x7}, {0x2, 0xa}, {0x7}, {0x5, 0x5}, {0x6, 0x6}, {0x4}, {0x0, 0x6}, {0x0, 0x5}, {0x4}, {0x5, 0x6}, {0x7, 0x1}, {0x1, 0x9}, {0x4, 0x9}, {0x1, 0x3}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x6}, {0x4, 0x3}, {0x7, 0x3}, {0x7, 0x4}, {0x7, 0x6}, {0x4, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x1, 0x1}, {0x3, 0x4}, {0x6}, {0x7, 0x5}, {0x1, 0xa}, {0x2, 0x7}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x5}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x3, 0x4, 0xb502, 0x1c0, 0xc, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x200, 0x8, 0x6, 0x6, 0x7, 0xfff3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7a}]}, @NL80211_BAND_2GHZ={0xa8, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x42, 0x2, [{0x6}, {0x3, 0x3}, {0x4, 0x2}, {0x5, 0x9}, {0x0, 0x6}, {0x4, 0x5}, {0x3, 0x5}, {0x3}, {0x4, 0x4}, {0x7, 0x8}, {0x3, 0x7}, {0x3, 0x8}, {0x3, 0xa}, {0x0, 0x9}, {0x6}, {0x3, 0x6}, {0x4, 0x1}, {0x7, 0x6}, {0x7, 0x6}, {}, {0x6, 0x14}, {0x4}, {0x4, 0x1}, {0x0, 0x3}, {0x1, 0x5}, {0x0, 0x2}, {0x5, 0x4}, {0x6, 0x5}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x7}, {0x4, 0x8}, {0x1, 0x9}, {0x1, 0x5}, {0x3, 0x2}, {0x5}, {0x7, 0x1}, {0x1, 0x6}, {0x0, 0x7}, {0x0, 0x3}, {0x5, 0x4}, {0x5, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x5, 0x4}, {0x1, 0x8}, {0x5, 0x4}, {0x6, 0x8}, {0x4, 0x2}, {0x2, 0xa}, {0x0, 0x8}, {0x4, 0x4}, {0x3, 0x6}, {0x4, 0x9}, {0x2, 0x6}, {0x2, 0xa}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x3}, {0x1, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x25, 0x2, [{0x3, 0x4}, {0x5, 0x3}, {0x5, 0x8}, {0x1, 0x7}, {0x1, 0x7}, {0x1}, {0x0, 0x8}, {0x6, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x4, 0x2}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x3}, {0x7, 0x8}, {0x7, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x8}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x4, 0x7}, {0x2, 0x5}, {0x0, 0x8}, {0x1, 0xa}, {0x4, 0xa}, {0x0, 0x3}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x3}, {0x0, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5385, 0x8001, 0xf0e7, 0xfffe, 0x6, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7, 0x9, 0x40, 0x2, 0x8, 0x6]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x66}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x71}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x308, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x2f4, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x15, 0x2, [{0x3, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x0, 0x5}, {0x2, 0x6}, {0x1}, {0x2, 0x8}, {0x1, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x2, 0x9}, {0x4}, {0x3, 0x1}, {0x1, 0x9}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x6}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x95, 0x2, 0x3, 0xd6, 0x0, 0x6, 0x6]}}]}, @NL80211_BAND_60GHZ={0xb8, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2d, 0x2, [{0x2, 0x4}, {0x5}, {0x3, 0x2}, {0x7, 0x3}, {0x5, 0x3}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x7}, {0x3, 0x3}, {0x7, 0x2}, {0x5, 0x8}, {0x1, 0x7}, {0x2, 0x8}, {0x4, 0x7}, {0x2, 0x9}, {0x1}, {0x1, 0xa}, {0x1, 0xa}, {0x6, 0x6}, {0x6, 0x2}, {0x7, 0x3}, {0x6, 0x1}, {0x1}, {0x4, 0x5}, {0x1, 0x9}, {0x1}, {0x2, 0x3}, {0x0, 0x1}, {0x1, 0x4}, {0x3, 0x5}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x4}, {0x4, 0x3}, {0x2, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x3, 0x78, 0x6, 0xfd, 0xdc, 0x7, 0x915]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xca8, 0x4, 0x5b5d, 0x7, 0xfff, 0x4, 0x7]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x18, 0x24, 0x0, 0x18, 0x4, 0x1b, 0x4, 0xc, 0x9, 0x12, 0x0, 0xc, 0x4, 0x24, 0x24, 0x16, 0x63]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x4, 0x1, 0x12, 0x6e, 0x36, 0x6c, 0x1b, 0x6, 0xb, 0x16, 0x6, 0x2, 0x6c, 0x18, 0x6c, 0x60, 0x6, 0xc, 0x16, 0x5, 0x36]}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x7, 0x9}, {0x5, 0x9}, {0x5, 0x3}, {0x6, 0x2}, {0x1, 0x5}, {0x0, 0x1}, {0x7, 0x5}, {0x2, 0x1}, {0x3}]}]}, @NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x5098abc75f17ee31, 0x4, 0x6, 0x9, 0x5, 0x12, 0x6c, 0x3, 0x6c, 0x1b, 0x24, 0x9, 0xb, 0x12, 0x3834ceaf91043b90, 0x1b, 0x48, 0x2, 0x12, 0x6, 0x30, 0x4, 0x4, 0x6c, 0xb, 0xb, 0xc, 0xc, 0x36]}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x8, 0xf, 0xe, 0x2, 0x3, 0x47, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x4, 0x7, 0x7, 0x80, 0x4, 0x1, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{0x1, 0x3}, {0x7, 0x7}, {0x4}, {0x5, 0x2}, {0x6}, {0x1}, {0x0, 0x5}, {0x5, 0x6}, {0x4, 0x5}, {0x2, 0x5}, {0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x1}, {0x7, 0x3}, {0x7, 0x8}, {0x5, 0x5}, {0x7, 0x8}, {0x0, 0x7}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x7, 0x8}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x3}, {0x0, 0x4}, {0x2, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x0, 0x1}, {0x4, 0x3}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x7, 0x8}, {0x3, 0x9}, {0x4, 0x5}, {0x7, 0x8}, {0x6, 0x7}, {}, {0x7, 0x9}, {0x6, 0x1}, {0x2, 0xa}, {0x3, 0x7}, {0x5, 0x2}, {0x4, 0x9}, {0x4, 0x8}, {0x0, 0x4}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x2}, {0x1, 0xa}, {0x6}, {0x7, 0x1}, {0x1, 0x8}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x2}, {0x4, 0x3}, {0x5, 0x6}, {0x0, 0x4}, {0x2, 0x2}, {0x6, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6b, 0x5, 0x3, 0x2fd, 0x8, 0x1, 0x100, 0x1]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x36, 0x0, 0x3ff, 0xe61, 0x0, 0x7f, 0x10]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x4, 0x9}, {0x4, 0x9}, {0x1, 0xa}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x3}, {0x0, 0x2}, {0x4, 0xa}, {0x5}, {0x6, 0x5}, {}, {0x7, 0x5}, {0x1, 0x9}, {0x0, 0x3}, {0x3, 0x6}, {0x0, 0xa}, {0x5}, {0x0, 0x6}, {0x6, 0x9}, {0x1, 0x5}, {0x7, 0x1}, {0x1, 0x9}, {0x1, 0x3}, {0x0, 0x7}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xdf, 0x6, 0x8, 0x2, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x4, 0x9, 0x8, 0x1, 0x9, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x48, 0x36, 0x18, 0x4, 0x5, 0x16, 0x16, 0x6c, 0x6, 0x1b, 0x6, 0x0, 0x48, 0x6, 0x4, 0x3, 0x16, 0x4, 0x4d, 0x48, 0x12, 0x6, 0x6, 0x60, 0x6c, 0x6c, 0x1, 0x1]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x2, 0x100, 0x100, 0x100, 0x9, 0xf, 0x4]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x30, 0xb, 0x48, 0x1b, 0x0, 0xc, 0x60, 0x5, 0xb, 0xe, 0x53, 0x24, 0x50, 0x1b, 0x6, 0x42acac960eb9f4a5, 0x48, 0x6, 0xb, 0xa, 0x1b, 0x6, 0x2, 0x16, 0x48, 0x4, 0x30, 0x36, 0x6]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x81}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xdb}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8000}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x25}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8}]}]}]}, 0x6e8}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 271.255434ms ago: executing program 2 (id=1263): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x2, @loopback, 0x6}, 0x1c) (async) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x2000) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000180)=0x7a, 0x4) (async) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, &(0x7f00000004c0)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f209b747822a71ddcfbfe3256db532d9be7c7ba14b065982dbc69cdcc21bcf5cd715a71925339e98db7cbd0e046a6891ceb602b01628c64e1f562934eae6269ee67226e24b0e4233af25a053f8e947940f985064d90790182bf61152bada212b2eca863792752e6009ac615bcd3c2891fc6dc80666d92d"], 0x68) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x20201) r6 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x100000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) (async) ioctl$SNDCTL_DSP_GETODELAY(r6, 0x80045017, 0x0) (async) write$snddsp(0xffffffffffffffff, &(0x7f0000000200)="a38d", 0x2) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x8, 0x4, &(0x7f0000000300)=ANY=[@ANYRES8=r8], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2d}, 0x94) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140), &(0x7f00000001c0)=0x4) 177.38546ms ago: executing program 3 (id=1264): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0xff97}, 0x0) 110.449724ms ago: executing program 2 (id=1265): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) getpgid(0x0) mkdir(0x0, 0x150) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c) listen(r4, 0x204) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) (fail_nth: 6) 0s ago: executing program 0 (id=1266): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_emit_ethernet(0xe, &(0x7f00000006c0)={@broadcast, @multicast, @void, {@generic={0x10}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0xa01, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x10}]}}}]}, 0x3c}}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000840)=ANY=[@ANYBLOB="1a00000000000000860400"]) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0x5) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f00000000c0)={0x8}) kernel console output (not intermixed with test programs): arsing attributes in process `syz.1.717'. [ 179.402685][ T8105] FAULT_INJECTION: forcing a failure. [ 179.402685][ T8105] name failslab, interval 1, probability 0, space 0, times 0 [ 179.415379][ T8105] CPU: 0 UID: 0 PID: 8105 Comm: syz.3.719 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 179.415404][ T8105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 179.415414][ T8105] Call Trace: [ 179.415420][ T8105] [ 179.415428][ T8105] dump_stack_lvl+0x16c/0x1f0 [ 179.415462][ T8105] should_fail_ex+0x512/0x640 [ 179.415491][ T8105] should_failslab+0xc2/0x120 [ 179.415510][ T8105] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 179.415535][ T8105] ? lock_acquire+0x179/0x350 [ 179.415552][ T8105] ? dst_alloc+0x99/0x1a0 [ 179.415580][ T8105] ? __pfx_ip6_dst_gc+0x10/0x10 [ 179.415605][ T8105] dst_alloc+0x99/0x1a0 [ 179.415632][ T8105] ip6_pol_route+0x96b/0x1230 [ 179.415657][ T8105] ? __pfx_ip6_pol_route+0x10/0x10 [ 179.415681][ T8105] ? __pfx_rt6_multipath_hash+0x10/0x10 [ 179.415716][ T8105] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 179.415738][ T8105] fib6_rule_lookup+0x536/0x720 [ 179.415762][ T8105] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 179.415784][ T8105] ? nf_nat_ipv6_fn+0xff/0x2e0 [ 179.415809][ T8105] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 179.415838][ T8105] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 179.415862][ T8105] ip6_route_input+0x662/0xc00 [ 179.415890][ T8105] ? __pfx_ip6_route_input+0x10/0x10 [ 179.415911][ T8105] ? lock_acquire+0x179/0x350 [ 179.415943][ T8105] ? sock_wfree+0x11c/0x880 [ 179.415971][ T8105] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 179.415999][ T8105] ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 [ 179.416026][ T8105] ipv6_rcv+0x1e8/0x680 [ 179.416050][ T8105] ? __pfx_ipv6_rcv+0x10/0x10 [ 179.416071][ T8105] __netif_receive_skb_one_core+0x12d/0x1e0 [ 179.416098][ T8105] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 179.416124][ T8105] ? lock_acquire+0x179/0x350 [ 179.416144][ T8105] ? __phys_addr+0xe8/0x180 [ 179.416167][ T8105] __netif_receive_skb+0x1d/0x160 [ 179.416191][ T8105] netif_receive_skb+0x137/0x7b0 [ 179.416216][ T8105] ? __pfx_netif_receive_skb+0x10/0x10 [ 179.416251][ T8105] tun_rx_batched.isra.0+0x3ee/0x740 [ 179.416283][ T8105] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 179.416319][ T8105] ? tun_get_user+0x1c0d/0x3b80 [ 179.416336][ T8105] ? rcu_is_watching+0x12/0xc0 [ 179.416363][ T8105] tun_get_user+0x28a2/0x3b80 [ 179.416393][ T8105] ? __pfx_tun_get_user+0x10/0x10 [ 179.416411][ T8105] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 179.416443][ T8105] ? find_held_lock+0x2b/0x80 [ 179.416466][ T8105] ? tun_get+0x191/0x370 [ 179.416490][ T8105] tun_chr_write_iter+0xdc/0x210 [ 179.416512][ T8105] vfs_write+0x6c4/0x1150 [ 179.416538][ T8105] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 179.416559][ T8105] ? __pfx_vfs_write+0x10/0x10 [ 179.416582][ T8105] ? find_held_lock+0x2b/0x80 [ 179.416624][ T8105] ksys_write+0x12a/0x250 [ 179.416650][ T8105] ? __pfx_ksys_write+0x10/0x10 [ 179.416685][ T8105] do_syscall_64+0xcd/0x4c0 [ 179.416706][ T8105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.416723][ T8105] RIP: 0033:0x7f45bf58d45f [ 179.416738][ T8105] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 179.416754][ T8105] RSP: 002b:00007f45c04b4000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 179.416771][ T8105] RAX: ffffffffffffffda RBX: 00007f45bf7b5fa0 RCX: 00007f45bf58d45f [ 179.416782][ T8105] RDX: 000000000000006e RSI: 0000200000000240 RDI: 00000000000000c8 [ 179.416793][ T8105] RBP: 00007f45c04b4090 R08: 0000000000000000 R09: 0000000000000000 [ 179.416803][ T8105] R10: 000000000000006e R11: 0000000000000293 R12: 0000000000000001 [ 179.416813][ T8105] R13: 0000000000000000 R14: 00007f45bf7b5fa0 R15: 00007ffcdaf8fed8 [ 179.416837][ T8105] [ 180.446626][ T8112] binder: BINDER_SET_CONTEXT_MGR already set [ 180.455612][ T8112] binder: 8100:8112 ioctl 4018620d 200000000040 returned -16 [ 180.555144][ T5909] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 180.717561][ T5909] usb 4-1: Using ep0 maxpacket: 8 [ 180.726790][ T5909] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 180.745434][ T8121] block nbd1: Device being setup by another task [ 180.757541][ T5909] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 180.771425][ T8122] block nbd1: shutting down sockets [ 180.790670][ T5909] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.843108][ T5909] usb 4-1: config 0 descriptor?? [ 180.880775][ T30] audit: type=1400 audit(1753618110.238:336): avc: denied { map } for pid=8130 comm="syz.4.727" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 180.986731][ T30] audit: type=1400 audit(1753618110.268:337): avc: denied { execute } for pid=8130 comm="syz.4.727" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 181.073547][ T8135] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8135 comm=syz.2.729 [ 181.096345][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 181.248206][ T8142] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8142 comm=syz.4.732 [ 181.262482][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 181.276050][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.288747][ T5909] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 181.306173][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 181.352846][ T5909] usb 4-1: USB disconnect, device number 14 [ 181.378091][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 181.391690][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.436023][ T10] usb 1-1: Product: syz [ 181.443278][ T10] usb 1-1: Manufacturer: syz [ 181.457126][ T10] usb 1-1: SerialNumber: syz [ 181.492192][ T8150] netlink: 32 bytes leftover after parsing attributes in process `syz.1.734'. [ 181.989539][ T30] audit: type=1400 audit(1753618111.348:338): avc: denied { getopt } for pid=8148 comm="syz.2.735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 182.166352][ T8162] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8162 comm=syz.3.737 [ 182.707311][ T30] audit: type=1400 audit(1753618112.058:339): avc: denied { append } for pid=8167 comm="syz.1.741" name="dlm-control" dev="devtmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.737442][ T8171] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 182.956190][ T8176] binder: 8168:8176 unknown command 0 [ 182.967814][ T8176] binder: 8168:8176 ioctl c0306201 200000000080 returned -22 [ 183.063672][ T30] audit: type=1400 audit(1753618112.418:340): avc: denied { read } for pid=8174 comm="syz.1.742" laddr=::ac14:14aa lport=35261 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 183.990553][ T10] usb 1-1: 0:2 : does not exist [ 184.085301][ T8181] netlink: 20 bytes leftover after parsing attributes in process `syz.0.743'. [ 184.379609][ T8183] netlink: 'syz.0.743': attribute type 9 has an invalid length. [ 184.883657][ T10] usb 1-1: USB disconnect, device number 18 [ 184.970922][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 185.376149][ T30] audit: type=1400 audit(1753618114.698:341): avc: denied { ioctl } for pid=8184 comm="syz.1.744" path="socket:[20460]" dev="sockfs" ino=20460 ioctlcmd=0x89e8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 185.768231][ T8190] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8190 comm=syz.0.746 [ 185.815862][ T5833] Bluetooth: hci4: command 0x0406 tx timeout [ 185.822986][ T5833] Bluetooth: hci2: command 0x0406 tx timeout [ 185.830276][ T5845] Bluetooth: hci1: command 0x0406 tx timeout [ 185.838673][ T5845] Bluetooth: hci0: command 0x0406 tx timeout [ 185.839846][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 186.485180][ T30] audit: type=1400 audit(1753618115.718:342): avc: denied { create } for pid=8199 comm="syz.0.749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 187.167000][ T8204] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8204 comm=syz.1.750 [ 188.616548][ T8218] lo speed is unknown, defaulting to 1000 [ 188.622677][ T8218] lo speed is unknown, defaulting to 1000 [ 188.632603][ T8218] lo speed is unknown, defaulting to 1000 [ 188.645531][ T8218] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 188.661393][ T8218] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 189.061585][ T8218] lo speed is unknown, defaulting to 1000 [ 189.070135][ T8218] lo speed is unknown, defaulting to 1000 [ 189.077967][ T8218] lo speed is unknown, defaulting to 1000 [ 189.085817][ T8218] lo speed is unknown, defaulting to 1000 [ 189.093025][ T8218] lo speed is unknown, defaulting to 1000 [ 189.352669][ T8227] ntfs3(nullb0): Primary boot signature is not NTFS. [ 189.360617][ T8227] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 189.856194][ T30] audit: type=1400 audit(1753618118.708:343): avc: denied { mounton } for pid=8221 comm="syz.4.758" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 190.325725][ T10] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 190.509441][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 190.776453][ T8240] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 190.776453][ T8240] program syz.2.762 not setting count and/or reply_len properly [ 190.776538][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 190.817578][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 190.890123][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 190.917304][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.953493][ T10] usb 4-1: Product: syz [ 190.968290][ T10] usb 4-1: Manufacturer: syz [ 191.005808][ T10] usb 4-1: SerialNumber: syz [ 191.061131][ T30] audit: type=1400 audit(1753618120.418:344): avc: denied { create } for pid=8246 comm="syz.2.765" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 191.116185][ T30] audit: type=1400 audit(1753618120.438:345): avc: denied { create } for pid=8244 comm="syz.4.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 191.141859][ T30] audit: type=1400 audit(1753618120.438:346): avc: denied { getopt } for pid=8246 comm="syz.2.765" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 191.245907][ T30] audit: type=1400 audit(1753618120.558:347): avc: denied { create } for pid=8244 comm="syz.4.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 191.973007][ T8252] binder: 8248:8252 unknown command 0 [ 191.979413][ T8252] binder: 8248:8252 ioctl c0306201 200000000080 returned -22 [ 192.445895][ T8266] vlan2: entered promiscuous mode [ 192.451138][ T8266] bond0: entered promiscuous mode [ 192.457797][ T8266] bond_slave_0: entered promiscuous mode [ 192.463650][ T8266] bond_slave_1: entered promiscuous mode [ 193.090700][ T30] audit: type=1400 audit(1753618122.448:348): avc: denied { create } for pid=8268 comm="syz.4.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 193.163324][ T8272] trusted_key: encrypted_key: insufficient parameters specified [ 193.303120][ T30] audit: type=1400 audit(1753618122.498:349): avc: denied { getopt } for pid=8268 comm="syz.4.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 193.438376][ T30] audit: type=1400 audit(1753618122.778:350): avc: denied { bind } for pid=8270 comm="syz.1.769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 193.766515][ T8279] capability: warning: `syz.2.770' uses deprecated v2 capabilities in a way that may be insecure [ 193.794958][ T8279] syz.2.770 uses obsolete (PF_INET,SOCK_PACKET) [ 194.445722][ T30] audit: type=1400 audit(1753618122.778:351): avc: denied { setopt } for pid=8270 comm="syz.1.769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 194.536234][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.542541][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.737568][ T8285] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8285 comm=syz.4.774 [ 195.420390][ T8296] syz.4.778: attempt to access beyond end of device [ 195.420390][ T8296] nbd4: rw=0, sector=16, nr_sectors = 1 limit=0 [ 195.464710][ T8296] qnx6: unable to read the first superblock [ 195.536799][ T8296] syz.4.778: attempt to access beyond end of device [ 195.536799][ T8296] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 195.871240][ T8296] qnx6: unable to read the first superblock [ 195.941722][ T8296] qnx6: unable to read the first superblock [ 196.027807][ T10] usb 4-1: 0:2 : does not exist [ 196.097853][ T10] usb 4-1: USB disconnect, device number 15 [ 196.105980][ T5910] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 196.155222][ T5895] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 196.216138][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 196.287373][ T5910] usb 5-1: config index 0 descriptor too short (expected 32786, got 18) [ 196.345238][ T5895] usb 3-1: device descriptor read/64, error -71 [ 196.346658][ T8314] netlink: 32 bytes leftover after parsing attributes in process `syz.0.784'. [ 196.369903][ T5910] usb 5-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 196.890028][ T5910] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=0 [ 196.909741][ T5910] usb 5-1: Manufacturer: syz [ 197.115662][ T5895] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 197.388484][ T5910] usb 5-1: config 0 descriptor?? [ 197.436429][ T5910] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 197.445194][ T5895] usb 3-1: device descriptor read/64, error -71 [ 197.460028][ T5910] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 197.555670][ T5895] usb usb3-port1: attempt power cycle [ 197.672702][ T5910] usb 5-1: USB disconnect, device number 20 [ 197.681122][ T5910] ftdi_sio 5-1:0.0: device disconnected [ 197.905578][ T5895] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 197.945959][ T5895] usb 3-1: device descriptor read/8, error -71 [ 198.012038][ T8331] binder: 8327:8331 unknown command 0 [ 198.018779][ T8331] binder: 8327:8331 ioctl c0306201 200000000080 returned -22 [ 198.195161][ T5895] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 198.215933][ T5895] usb 3-1: device descriptor read/8, error -71 [ 198.329288][ T5895] usb usb3-port1: unable to enumerate USB device [ 198.367760][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 198.545768][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 198.684607][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.699418][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 198.712263][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 198.725319][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.289749][ T10] usb 1-1: Product: syz [ 199.346056][ T10] usb 1-1: Manufacturer: syz [ 199.367327][ T10] usb 1-1: SerialNumber: syz [ 201.290785][ T8385] netlink: 'syz.1.807': attribute type 1 has an invalid length. [ 201.559863][ T8388] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8388 comm=syz.1.808 [ 202.018679][ T8397] binder: 8394:8397 unknown command 0 [ 202.063085][ T8397] binder: 8394:8397 ioctl c0306201 200000000080 returned -22 [ 202.096510][ T8401] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8401 comm=syz.2.812 [ 202.505434][ T10] usb 1-1: 0:2 : does not exist [ 202.582988][ T10] usb 1-1: USB disconnect, device number 19 [ 202.757735][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 202.991446][ T8426] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8426 comm=syz.2.821 [ 203.022847][ T8427] FAULT_INJECTION: forcing a failure. [ 203.022847][ T8427] name failslab, interval 1, probability 0, space 0, times 0 [ 203.038378][ T8427] CPU: 1 UID: 0 PID: 8427 Comm: syz.4.822 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 203.038403][ T8427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 203.038413][ T8427] Call Trace: [ 203.038418][ T8427] [ 203.038424][ T8427] dump_stack_lvl+0x16c/0x1f0 [ 203.038457][ T8427] should_fail_ex+0x512/0x640 [ 203.038483][ T8427] ? fs_reclaim_acquire+0xae/0x150 [ 203.038507][ T8427] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 203.038524][ T8427] should_failslab+0xc2/0x120 [ 203.038542][ T8427] __kmalloc_noprof+0xd2/0x510 [ 203.038574][ T8427] tomoyo_realpath_from_path+0xc2/0x6e0 [ 203.038593][ T8427] ? tomoyo_profile+0x47/0x60 [ 203.038615][ T8427] tomoyo_path_number_perm+0x245/0x580 [ 203.038637][ T8427] ? tomoyo_path_number_perm+0x237/0x580 [ 203.038664][ T8427] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 203.038690][ T8427] ? find_held_lock+0x2b/0x80 [ 203.038734][ T8427] ? find_held_lock+0x2b/0x80 [ 203.038754][ T8427] ? hook_file_ioctl_common+0x145/0x410 [ 203.038780][ T8427] ? __fget_files+0x20e/0x3c0 [ 203.038801][ T8427] security_file_ioctl+0x9b/0x240 [ 203.038820][ T8427] __x64_sys_ioctl+0xb7/0x210 [ 203.038846][ T8427] do_syscall_64+0xcd/0x4c0 [ 203.038864][ T8427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.038881][ T8427] RIP: 0033:0x7f427b18e9a9 [ 203.038896][ T8427] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 203.038913][ T8427] RSP: 002b:00007f427c0a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 203.038929][ T8427] RAX: ffffffffffffffda RBX: 00007f427b3b5fa0 RCX: 00007f427b18e9a9 [ 203.038940][ T8427] RDX: 0000200000000300 RSI: 0000000080104592 RDI: 0000000000000003 [ 203.038950][ T8427] RBP: 00007f427c0a1090 R08: 0000000000000000 R09: 0000000000000000 [ 203.038959][ T8427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.038969][ T8427] R13: 0000000000000000 R14: 00007f427b3b5fa0 R15: 00007ffeae388478 [ 203.038992][ T8427] [ 203.038999][ T8427] ERROR: Out of memory at tomoyo_realpath_from_path. [ 203.359951][ T8437] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8437 comm=syz.0.825 [ 203.495852][ T8439] lo speed is unknown, defaulting to 1000 [ 203.642512][ T30] audit: type=1800 audit(1753618132.988:352): pid=8448 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.828" name="bus" dev="overlay" ino=909 res=0 errno=0 [ 203.644524][ T5830] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 205.445823][ T5830] usb 3-1: Using ep0 maxpacket: 16 [ 205.447251][ T5830] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 205.447271][ T5830] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 205.448950][ T5830] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 205.448975][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.448995][ T5830] usb 3-1: Product: syz [ 205.449010][ T5830] usb 3-1: Manufacturer: syz [ 205.449024][ T5830] usb 3-1: SerialNumber: syz [ 205.477170][ T8458] FAULT_INJECTION: forcing a failure. [ 205.477170][ T8458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.477201][ T8458] CPU: 0 UID: 0 PID: 8458 Comm: syz.3.832 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 205.477221][ T8458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 205.477231][ T8458] Call Trace: [ 205.477237][ T8458] [ 205.477243][ T8458] dump_stack_lvl+0x16c/0x1f0 [ 205.477275][ T8458] should_fail_ex+0x512/0x640 [ 205.477309][ T8458] _copy_from_user+0x2e/0xd0 [ 205.477327][ T8458] copy_msghdr_from_user+0x98/0x160 [ 205.477344][ T8458] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 205.477373][ T8458] ___sys_sendmsg+0xfe/0x1d0 [ 205.477391][ T8458] ? __pfx____sys_sendmsg+0x10/0x10 [ 205.477405][ T8458] ? __lock_acquire+0x622/0x1c90 [ 205.477452][ T8458] __sys_sendmsg+0x16d/0x220 [ 205.477469][ T8458] ? __pfx___sys_sendmsg+0x10/0x10 [ 205.477501][ T8458] do_syscall_64+0xcd/0x4c0 [ 205.477520][ T8458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.477537][ T8458] RIP: 0033:0x7f45bf58e9a9 [ 205.477551][ T8458] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 205.477567][ T8458] RSP: 002b:00007f45c04b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 205.477584][ T8458] RAX: ffffffffffffffda RBX: 00007f45bf7b5fa0 RCX: 00007f45bf58e9a9 [ 205.477595][ T8458] RDX: 00000000000052cc RSI: 0000200000000040 RDI: 0000000000000004 [ 205.477605][ T8458] RBP: 00007f45c04b4090 R08: 0000000000000000 R09: 0000000000000000 [ 205.477614][ T8458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 205.477624][ T8458] R13: 0000000000000000 R14: 00007f45bf7b5fa0 R15: 00007ffcdaf8fed8 [ 205.477646][ T8458] [ 205.488795][ T8459] netlink: 24 bytes leftover after parsing attributes in process `syz.0.831'. [ 205.829318][ T30] audit: type=1400 audit(1753618135.188:353): avc: denied { create } for pid=8464 comm="syz.3.835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 205.850143][ T8459] netlink: 24 bytes leftover after parsing attributes in process `syz.0.831'. [ 206.035560][ T9] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 206.095286][ T10] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 206.185303][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 206.186599][ T9] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 206.186615][ T9] usb 5-1: config 0 has no interface number 0 [ 206.186632][ T9] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 206.186650][ T9] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 206.186672][ T9] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 206.186694][ T9] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 206.186724][ T9] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 206.186737][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.209023][ T9] usb 5-1: config 0 descriptor?? [ 206.217242][ T9] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 206.257111][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26522, setting to 1024 [ 206.473124][ T10] usb 1-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 206.485866][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.500320][ T10] usb 1-1: Product: syz [ 206.516327][ T10] usb 1-1: Manufacturer: syz [ 206.550720][ T10] usb 1-1: SerialNumber: syz [ 206.578946][ T5945] usb 5-1: USB disconnect, device number 21 [ 206.588174][ T5945] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 206.608170][ T10] usb 1-1: config 0 descriptor?? [ 206.635368][ T8459] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 206.659793][ T10] usb 1-1: Found UVC 0.00 device syz (18ec:3288) [ 206.697620][ T10] usb 1-1: No valid video chain found. [ 206.707404][ T8473] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8473 comm=syz.1.836 [ 206.776381][ T5910] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 206.851120][ T5945] usb 1-1: USB disconnect, device number 20 [ 206.915767][ T5910] usb 4-1: device descriptor read/64, error -71 [ 207.129887][ T5909] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 207.165875][ T5910] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 207.285166][ T5909] usb 2-1: Using ep0 maxpacket: 8 [ 207.295134][ T5909] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 207.303303][ T5909] usb 2-1: config 0 has no interface number 0 [ 207.310452][ T5909] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 207.315349][ T5910] usb 4-1: device descriptor read/64, error -71 [ 207.322334][ T5909] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 207.341913][ T5909] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 207.355129][ T5909] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 207.376604][ T5909] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 207.386561][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.396076][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 207.415266][ T5909] usb 2-1: config 0 descriptor?? [ 207.452795][ T5910] usb usb4-port1: attempt power cycle [ 207.466481][ T5909] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 207.575173][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 207.579939][ T8481] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8481 comm=syz.0.840 [ 207.581628][ T10] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 207.607423][ T5830] usb 3-1: 0:2 : does not exist [ 207.649827][ T8475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.659166][ T8475] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.669876][ T10] usb 5-1: config 0 has no interface number 0 [ 207.682531][ T10] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 207.683195][ T5830] usb 3-1: USB disconnect, device number 24 [ 207.708077][ T5909] usb 2-1: USB disconnect, device number 12 [ 207.711285][ T10] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 207.737654][ T5909] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 207.739536][ T10] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 207.791069][ T10] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 207.809352][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 207.835564][ T5910] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 207.846219][ T10] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 207.872094][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.882411][ T5910] usb 4-1: device descriptor read/8, error -71 [ 207.891198][ T8487] lo speed is unknown, defaulting to 1000 [ 207.902830][ T10] usb 5-1: config 0 descriptor?? [ 207.918182][ T10] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 208.111916][ T8477] FAULT_INJECTION: forcing a failure. [ 208.111916][ T8477] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 208.131167][ T8477] CPU: 0 UID: 0 PID: 8477 Comm: syz.4.838 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 208.131183][ T8477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 208.131189][ T8477] Call Trace: [ 208.131192][ T8477] [ 208.131197][ T8477] dump_stack_lvl+0x16c/0x1f0 [ 208.131217][ T8477] should_fail_ex+0x512/0x640 [ 208.131235][ T8477] _copy_from_user+0x2e/0xd0 [ 208.131246][ T8477] do_sys_poll+0x1d5/0xdf0 [ 208.131263][ T8477] ? kernel_text_address+0x8d/0x100 [ 208.131280][ T8477] ? arch_stack_walk+0xa6/0x100 [ 208.131292][ T8477] ? __pfx_do_sys_poll+0x10/0x10 [ 208.131320][ T8477] ? __lock_acquire+0x622/0x1c90 [ 208.131354][ T8477] ? __pfx_timespec64_add_safe+0x10/0x10 [ 208.131367][ T8477] ? ktime_get_ts64+0x2d2/0x400 [ 208.131382][ T8477] ? read_tsc+0x9/0x20 [ 208.131393][ T8477] ? ktime_get_ts64+0x256/0x400 [ 208.131412][ T8477] __x64_sys_poll+0x1a6/0x450 [ 208.131427][ T8477] ? __pfx___x64_sys_poll+0x10/0x10 [ 208.131447][ T8477] do_syscall_64+0xcd/0x4c0 [ 208.131458][ T8477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.131469][ T8477] RIP: 0033:0x7f427b18e9a9 [ 208.131478][ T8477] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 208.131487][ T8477] RSP: 002b:00007f427c0a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 208.131498][ T8477] RAX: ffffffffffffffda RBX: 00007f427b3b5fa0 RCX: 00007f427b18e9a9 [ 208.131504][ T8477] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000200000000140 [ 208.131510][ T8477] RBP: 00007f427c0a1090 R08: 0000000000000000 R09: 0000000000000000 [ 208.131516][ T8477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.131522][ T8477] R13: 0000000000000000 R14: 00007f427b3b5fa0 R15: 00007ffeae388478 [ 208.131535][ T8477] [ 208.133260][ T8477] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.155372][ T5910] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 208.158560][ T5830] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 208.186904][ T5910] usb 4-1: device descriptor read/8, error -71 [ 208.377907][ T8477] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.401775][ T5909] usb 5-1: USB disconnect, device number 22 [ 208.410503][ T5909] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 208.425684][ T5830] usb 3-1: Using ep0 maxpacket: 16 [ 208.449847][ T5830] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.465877][ T5830] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 208.523391][ T5910] usb usb4-port1: unable to enumerate USB device [ 208.589631][ T5830] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 208.599715][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.746661][ T5830] usb 3-1: Product: syz [ 208.768997][ T5830] usb 3-1: Manufacturer: syz [ 208.799260][ T5830] usb 3-1: SerialNumber: syz [ 208.977938][ T5910] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 209.186456][ T5910] usb 2-1: Using ep0 maxpacket: 8 [ 209.210888][ T5910] usb 2-1: config 6 has an invalid interface number: 101 but max is 0 [ 209.239024][ T5910] usb 2-1: config 6 has an invalid descriptor of length 106, skipping remainder of the config [ 209.303012][ T5910] usb 2-1: config 6 has no interface number 0 [ 209.321003][ T5910] usb 2-1: New USB device found, idVendor=aaca, idProduct=5eab, bcdDevice=40.79 [ 209.336999][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.347471][ T5910] usb 2-1: Product: syz [ 209.351762][ T5910] usb 2-1: Manufacturer: syz [ 209.360073][ T5910] usb 2-1: SerialNumber: syz [ 209.367828][ T8502] netlink: 12 bytes leftover after parsing attributes in process `syz.3.848'. [ 209.642489][ T10] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 209.815627][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 209.822421][ T10] usb 4-1: config 0 has an invalid descriptor of length 104, skipping remainder of the config [ 210.035318][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 210.053209][ T8515] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8515 comm=syz.0.851 [ 210.123355][ T10] usb 4-1: New USB device found, idVendor=04b3, idProduct=3108, bcdDevice= 0.00 [ 210.342897][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.395889][ T10] usb 4-1: config 0 descriptor?? [ 210.421831][ T10] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 210.509658][ T8519] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8519 comm=syz.4.853 [ 210.567305][ T30] audit: type=1400 audit(1753618139.928:354): avc: denied { mounton } for pid=8516 comm="syz.0.852" path="/173/file0/bus" dev="ramfs" ino=22619 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 210.603119][ T8517] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 210.612457][ T8517] overlayfs: failed to set xattr on upper [ 210.662014][ T8517] overlayfs: ...falling back to redirect_dir=nofollow. [ 210.693635][ T8517] overlayfs: ...falling back to metacopy=off. [ 210.735241][ T8517] overlayfs: ...falling back to index=off. [ 210.768803][ T8517] overlayfs: ...falling back to uuid=null. [ 210.938498][ T30] audit: type=1400 audit(1753618140.298:355): avc: denied { nlmsg_read } for pid=8516 comm="syz.0.852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 211.089485][ T8527] netlink: 32 bytes leftover after parsing attributes in process `syz.4.854'. [ 211.349418][ T5830] usb 3-1: 0:2 : does not exist [ 211.517346][ T5830] usb 3-1: USB disconnect, device number 25 [ 211.611241][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 211.709657][ T8533] netlink: 32 bytes leftover after parsing attributes in process `syz.2.855'. [ 211.807113][ T30] audit: type=1400 audit(1753618141.168:356): avc: denied { unmount } for pid=5829 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 212.434631][ T8539] nfs: Deprecated parameter 'nointr' [ 212.714104][ T5945] usb 4-1: USB disconnect, device number 20 [ 213.023315][ T8546] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8546 comm=syz.2.860 [ 213.088665][ T8547] ubi31: attaching mtd0 [ 213.100758][ T8547] ubi31: scanning is finished [ 213.106657][ T8547] ubi31: empty MTD device detected [ 213.648573][ T8551] netlink: 32 bytes leftover after parsing attributes in process `syz.3.861'. [ 213.684829][ T8547] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.692418][ T8547] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.700799][ T8547] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.709050][ T8547] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 213.717542][ T8547] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.726027][ T8547] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 213.735620][ T8547] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2162102486 [ 213.746745][ T8547] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.778632][ T8552] ubi31: background thread "ubi_bgt31d" started, PID 8552 [ 213.909439][ T8555] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8555 comm=syz.3.864 [ 213.971574][ T8558] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8558 comm=syz.4.862 [ 214.427130][ T8567] FAULT_INJECTION: forcing a failure. [ 214.427130][ T8567] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 215.175626][ T30] audit: type=1800 audit(1753618144.538:357): pid=8562 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.866" name="bus" dev="overlay" ino=916 res=0 errno=0 [ 215.197190][ C1] vkms_vblank_simulate: vblank timer overrun [ 215.207856][ T8567] CPU: 0 UID: 0 PID: 8567 Comm: syz.4.867 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 215.207873][ T8567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 215.207881][ T8567] Call Trace: [ 215.207885][ T8567] [ 215.207889][ T8567] dump_stack_lvl+0x16c/0x1f0 [ 215.207910][ T8567] should_fail_ex+0x512/0x640 [ 215.207929][ T8567] strncpy_from_user+0x3b/0x2e0 [ 215.207945][ T8567] getname_flags.part.0+0x8f/0x550 [ 215.207961][ T8567] getname_flags+0x93/0xf0 [ 215.207976][ T8567] user_path_at+0x24/0x60 [ 215.207992][ T8567] __x64_sys_mount+0x1fc/0x310 [ 215.208004][ T8567] ? __pfx___x64_sys_mount+0x10/0x10 [ 215.208019][ T8567] do_syscall_64+0xcd/0x4c0 [ 215.208031][ T8567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.208042][ T8567] RIP: 0033:0x7f427b18e9a9 [ 215.208050][ T8567] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 215.208060][ T8567] RSP: 002b:00007f427c080038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 215.208071][ T8567] RAX: ffffffffffffffda RBX: 00007f427b3b6080 RCX: 00007f427b18e9a9 [ 215.208077][ T8567] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000 [ 215.208083][ T8567] RBP: 00007f427c080090 R08: 0000000000000000 R09: 0000000000000000 [ 215.208089][ T8567] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 215.208095][ T8567] R13: 0000000000000001 R14: 00007f427b3b6080 R15: 00007ffeae388478 [ 215.208109][ T8567] [ 215.831668][ T5909] usb 2-1: USB disconnect, device number 13 [ 216.235512][ T8590] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8590 comm=syz.0.873 [ 216.363254][ T8593] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8593 comm=syz.0.876 [ 216.425788][ T30] audit: type=1400 audit(1753618145.778:358): avc: denied { listen } for pid=8581 comm="syz.1.872" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 216.551136][ T8596] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8596 comm=syz.2.877 [ 216.592156][ T30] audit: type=1400 audit(1753618145.948:359): avc: denied { create } for pid=8597 comm="syz.4.878" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 216.986888][ T30] audit: type=1400 audit(1753618145.988:360): avc: denied { bind } for pid=8597 comm="syz.4.878" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 217.177535][ T8608] lo speed is unknown, defaulting to 1000 [ 217.227686][ T30] audit: type=1400 audit(1753618146.458:361): avc: denied { create } for pid=8604 comm="syz.2.881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 217.512134][ T30] audit: type=1400 audit(1753618146.468:362): avc: denied { bind } for pid=8604 comm="syz.2.881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 217.635010][ T30] audit: type=1400 audit(1753618146.468:363): avc: denied { name_bind } for pid=8604 comm="syz.2.881" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 217.659875][ T8612] usb usb9: usbfs: process 8612 (syz.0.883) did not claim interface 0 before use [ 217.670158][ T30] audit: type=1400 audit(1753618146.468:364): avc: denied { node_bind } for pid=8604 comm="syz.2.881" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 217.886320][ T30] audit: type=1400 audit(1753618146.468:365): avc: denied { connect } for pid=8604 comm="syz.2.881" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 217.919158][ T30] audit: type=1400 audit(1753618146.478:366): avc: denied { ioctl } for pid=8604 comm="syz.2.881" path="socket:[22836]" dev="sockfs" ino=22836 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 218.023726][ T30] audit: type=1400 audit(1753618146.498:367): avc: denied { watch } for pid=8599 comm="syz.3.879" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=45 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 218.402120][ T8624] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8624 comm=syz.4.886 [ 218.557836][ T8630] netlink: 'syz.0.889': attribute type 1 has an invalid length. [ 218.590199][ T8630] 8021q: adding VLAN 0 to HW filter on device bond1 [ 218.866735][ T8630] bond1: (slave veth3): Enslaving as an active interface with a down link [ 218.890323][ T8639] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8639 comm=syz.4.892 [ 219.140156][ T8646] netlink: 'syz.4.895': attribute type 9 has an invalid length. [ 219.153203][ T8646] netlink: 'syz.4.895': attribute type 8 has an invalid length. [ 219.218205][ T8646] netlink: 143452 bytes leftover after parsing attributes in process `syz.4.895'. [ 220.037892][ T5945] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 220.204461][ T5945] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.227824][ T5945] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.261918][ T5945] usb 4-1: config 0 interface 0 has no altsetting 0 [ 220.303075][ T5945] usb 4-1: New USB device found, idVendor=1ea7, idProduct=0907, bcdDevice= 0.00 [ 220.334158][ T5945] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.374835][ T5945] usb 4-1: config 0 descriptor?? [ 220.398430][ T9] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 220.599629][ T8666] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8666 comm=syz.4.903 [ 220.669337][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 220.683417][ T5945] usbhid 4-1:0.0: can't add hid device: -71 [ 220.697244][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 220.709451][ T5945] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 220.748178][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 220.789281][ T5945] usb 4-1: USB disconnect, device number 21 [ 220.800542][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 220.817554][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.837358][ T9] usb 1-1: Product: syz [ 220.872289][ T9] usb 1-1: Manufacturer: syz [ 220.893491][ T9] usb 1-1: SerialNumber: syz [ 221.327773][ T8689] can0: slcan on ptm0. [ 221.622873][ T8686] lo speed is unknown, defaulting to 1000 [ 221.958116][ T8683] can0 (unregistered): slcan off ptm0. [ 222.396791][ T9] usb 1-1: 0:2 : does not exist [ 222.432741][ T9] usb 1-1: USB disconnect, device number 21 [ 222.639952][ T8707] FAULT_INJECTION: forcing a failure. [ 222.639952][ T8707] name failslab, interval 1, probability 0, space 0, times 0 [ 222.682601][ T8707] CPU: 1 UID: 0 PID: 8707 Comm: syz.1.910 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 222.682625][ T8707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 222.682634][ T8707] Call Trace: [ 222.682640][ T8707] [ 222.682646][ T8707] dump_stack_lvl+0x16c/0x1f0 [ 222.682678][ T8707] should_fail_ex+0x512/0x640 [ 222.682704][ T8707] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 222.682745][ T8707] should_failslab+0xc2/0x120 [ 222.682762][ T8707] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 222.682788][ T8707] ? copy_process+0x4b6/0x7650 [ 222.682816][ T8707] copy_process+0x4b6/0x7650 [ 222.682851][ T8707] ? __pfx_copy_process+0x10/0x10 [ 222.682919][ T8707] ? lockdep_init_map_type+0x5c/0x280 [ 222.682940][ T8707] ? lockdep_init_map_type+0x5c/0x280 [ 222.682959][ T8707] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 222.682990][ T8707] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 222.683010][ T8707] vhost_task_create+0x1d2/0x2e0 [ 222.683029][ T8707] ? __pfx_vhost_task_create+0x10/0x10 [ 222.683055][ T8707] ? __pfx_vhost_task_fn+0x10/0x10 [ 222.683092][ T8707] kvm_mmu_post_init_vm+0x1b7/0x370 [ 222.683117][ T8707] kvm_arch_vcpu_ioctl_run+0x66/0x18c0 [ 222.683139][ T8707] ? kvm_vcpu_ioctl+0x14c6/0x1690 [ 222.683170][ T8707] kvm_vcpu_ioctl+0x5eb/0x1690 [ 222.683195][ T8707] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 222.683224][ T8707] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 222.683246][ T8707] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 222.683272][ T8707] ? hook_file_ioctl_common+0x145/0x410 [ 222.683302][ T8707] ? selinux_file_ioctl+0x180/0x270 [ 222.683318][ T8707] ? selinux_file_ioctl+0xb4/0x270 [ 222.683336][ T8707] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 222.683359][ T8707] __x64_sys_ioctl+0x18e/0x210 [ 222.683387][ T8707] do_syscall_64+0xcd/0x4c0 [ 222.683408][ T8707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.683426][ T8707] RIP: 0033:0x7f80b618e9a9 [ 222.683441][ T8707] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 222.683458][ T8707] RSP: 002b:00007f80b6fab038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 222.683475][ T8707] RAX: ffffffffffffffda RBX: 00007f80b63b5fa0 RCX: 00007f80b618e9a9 [ 222.683487][ T8707] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 222.683497][ T8707] RBP: 00007f80b6fab090 R08: 0000000000000000 R09: 0000000000000000 [ 222.683507][ T8707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.683516][ T8707] R13: 0000000000000000 R14: 00007f80b63b5fa0 R15: 00007ffc8b6078f8 [ 222.683541][ T8707] [ 223.021359][ T8709] netlink: 96 bytes leftover after parsing attributes in process `syz.2.914'. [ 223.031591][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 223.031605][ T30] audit: type=1400 audit(1754666728.230:373): avc: denied { append } for pid=8708 comm="syz.2.914" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 223.174027][ T8709] binder: binder_mmap: 8708 200000000000-200000b36000 bad vm_flags failed -1 [ 223.332517][ T8709] binder: 8708:8709 ioctl 40046210 0 returned -14 [ 223.539971][ T8713] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8713 comm=syz.1.917 [ 223.586005][ T8716] FAULT_INJECTION: forcing a failure. [ 223.586005][ T8716] name failslab, interval 1, probability 0, space 0, times 0 [ 223.627100][ T8716] CPU: 0 UID: 0 PID: 8716 Comm: syz.0.915 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 223.627127][ T8716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 223.627137][ T8716] Call Trace: [ 223.627143][ T8716] [ 223.627149][ T8716] dump_stack_lvl+0x16c/0x1f0 [ 223.627183][ T8716] should_fail_ex+0x512/0x640 [ 223.627213][ T8716] should_failslab+0xc2/0x120 [ 223.627231][ T8716] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 223.627257][ T8716] ? skb_clone+0x190/0x3f0 [ 223.627278][ T8716] skb_clone+0x190/0x3f0 [ 223.627296][ T8716] netlink_deliver_tap+0xabd/0xd30 [ 223.627321][ T8716] netlink_unicast+0x702/0x850 [ 223.627344][ T8716] ? __pfx_netlink_unicast+0x10/0x10 [ 223.627372][ T8716] netlink_ack+0x696/0xb80 [ 223.627399][ T8716] netlink_rcv_skb+0x332/0x420 [ 223.627418][ T8716] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 223.627438][ T8716] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 223.627471][ T8716] ? netlink_deliver_tap+0x1ae/0xd30 [ 223.627495][ T8716] netlink_unicast+0x58a/0x850 [ 223.627519][ T8716] ? __pfx_netlink_unicast+0x10/0x10 [ 223.627546][ T8716] netlink_sendmsg+0x8d1/0xdd0 [ 223.627569][ T8716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.627599][ T8716] ____sys_sendmsg+0xa98/0xc70 [ 223.627622][ T8716] ? copy_msghdr_from_user+0x10a/0x160 [ 223.627638][ T8716] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.627663][ T8716] ? __pfx__kstrtoull+0x10/0x10 [ 223.627689][ T8716] ___sys_sendmsg+0x134/0x1d0 [ 223.627706][ T8716] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.627731][ T8716] ? find_held_lock+0x2b/0x80 [ 223.627766][ T8716] __sys_sendmmsg+0x200/0x420 [ 223.627786][ T8716] ? __pfx___sys_sendmmsg+0x10/0x10 [ 223.627809][ T8716] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 223.627837][ T8716] ? fput+0x70/0xf0 [ 223.627853][ T8716] ? ksys_write+0x1ac/0x250 [ 223.627877][ T8716] ? __pfx_ksys_write+0x10/0x10 [ 223.627905][ T8716] __x64_sys_sendmmsg+0x9c/0x100 [ 223.627920][ T8716] ? lockdep_hardirqs_on+0x7c/0x110 [ 223.627946][ T8716] do_syscall_64+0xcd/0x4c0 [ 223.627963][ T8716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.627980][ T8716] RIP: 0033:0x7f00fe18e9a9 [ 223.627993][ T8716] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 223.628008][ T8716] RSP: 002b:00007f00fdff7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 223.628024][ T8716] RAX: ffffffffffffffda RBX: 00007f00fe3b5fa0 RCX: 00007f00fe18e9a9 [ 223.628035][ T8716] RDX: 0000000004924b68 RSI: 0000200000000140 RDI: 0000000000000004 [ 223.628046][ T8716] RBP: 00007f00fdff7090 R08: 0000000000000000 R09: 0000000000000000 [ 223.628060][ T8716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 223.628069][ T8716] R13: 0000000000000000 R14: 00007f00fe3b5fa0 R15: 00007fff4a0590f8 [ 223.628093][ T8716] [ 224.151808][ T30] audit: type=1400 audit(1754666729.305:374): avc: denied { mount } for pid=8725 comm="syz.0.921" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 224.183645][ T9] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 224.209522][ T30] audit: type=1400 audit(1754666729.363:375): avc: denied { append } for pid=8725 comm="syz.0.921" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 224.372527][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 224.400285][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.441217][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 224.483397][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 224.494370][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.530382][ T9] usb 4-1: Product: syz [ 224.550532][ T8740] netlink: 8 bytes leftover after parsing attributes in process `syz.4.925'. [ 224.570997][ T9] usb 4-1: Manufacturer: syz [ 224.578517][ T8740] netlink: 4 bytes leftover after parsing attributes in process `syz.4.925'. [ 224.578726][ T9] usb 4-1: SerialNumber: syz [ 224.616848][ T8740] netlink: 'syz.4.925': attribute type 7 has an invalid length. [ 224.653345][ T30] audit: type=1400 audit(1754666729.803:376): avc: denied { cmd } for pid=8737 comm="syz.4.925" path="socket:[23153]" dev="sockfs" ino=23153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 225.628603][ T9] usb 4-1: 0:2 : does not exist [ 225.711591][ T8771] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8771 comm=syz.4.933 [ 225.730013][ T8769] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8769 comm=syz.0.932 [ 225.754809][ T9] usb 4-1: USB disconnect, device number 22 [ 225.842441][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 226.010236][ T7595] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0xff [ 226.280478][ T8783] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8783 comm=syz.4.935 [ 226.547568][ T8788] comedi comedi3: comedi_config --init_data is deprecated [ 226.901173][ T8804] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8804 comm=syz.4.943 [ 226.916898][ T8801] 9pnet_fd: Insufficient options for proto=fd [ 226.994968][ T30] audit: type=1400 audit(1754666732.117:377): avc: denied { connect } for pid=8800 comm="syz.2.942" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 227.060065][ T30] audit: type=1326 audit(1754666732.146:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8795 comm="syz.0.939" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f00fe18e9a9 code=0x0 [ 227.257922][ T8817] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8817 comm=syz.1.945 [ 228.168805][ T5830] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 228.177386][ T30] audit: type=1400 audit(1754666733.276:379): avc: denied { ioctl } for pid=8836 comm="syz.3.953" path="socket:[24344]" dev="sockfs" ino=24344 ioctlcmd=0x9365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 228.503018][ T30] audit: type=1400 audit(1754666733.305:380): avc: denied { ioctl } for pid=8829 comm="syz.0.950" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 228.578347][ T5830] usb 5-1: Using ep0 maxpacket: 16 [ 228.588863][ T5830] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 228.608013][ T5830] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 228.678040][ T8837] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.953'. [ 228.700302][ T30] audit: type=1400 audit(1754666733.777:381): avc: denied { setopt } for pid=8836 comm="syz.3.953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 228.700435][ T5830] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 228.738656][ T5830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.746807][ T5830] usb 5-1: Product: syz [ 228.751969][ T5830] usb 5-1: Manufacturer: syz [ 228.756582][ T5830] usb 5-1: SerialNumber: syz [ 228.831924][ T30] audit: type=1400 audit(1754666733.905:382): avc: denied { accept } for pid=8840 comm="syz.2.954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 229.116940][ T8846] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8846 comm=syz.0.956 [ 229.863926][ T5830] usb 5-1: 0:2 : does not exist [ 229.977349][ T8858] trusted_key: encrypted_key: insufficient parameters specified [ 230.138974][ T8860] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8860 comm=syz.0.961 [ 230.149122][ T5830] usb 5-1: USB disconnect, device number 23 [ 230.262887][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 230.304541][ T30] audit: type=1400 audit(1754666735.362:383): avc: denied { ioctl } for pid=8862 comm="syz.1.960" path="socket:[24412]" dev="sockfs" ino=24412 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 230.467268][ T8873] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2579 sclass=netlink_route_socket pid=8873 comm=syz.2.963 [ 230.540284][ T8873] netlink: 755 bytes leftover after parsing attributes in process `syz.2.963'. [ 230.624156][ T8881] netlink: 32 bytes leftover after parsing attributes in process `syz.4.966'. [ 230.628897][ T30] audit: type=1400 audit(1754666735.687:384): avc: denied { ioctl } for pid=8880 comm="syz.1.969" path="socket:[24458]" dev="sockfs" ino=24458 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 230.695097][ T8882] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 230.705641][ T8885] fuse: Unknown parameter 'rûÿÿÿÿÿÿÿ00000000000000000100000' [ 231.031563][ T8887] netlink: 32 bytes leftover after parsing attributes in process `syz.0.965'. [ 231.076539][ T9] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 231.490995][ T9] usb 4-1: device descriptor read/64, error -71 [ 231.721819][ T30] audit: type=1400 audit(1754666736.771:385): avc: denied { write } for pid=8896 comm="syz.2.974" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 231.786540][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 231.819168][ T30] audit: type=1400 audit(1754666736.771:386): avc: denied { open } for pid=8896 comm="syz.2.974" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 231.966510][ T8902] binder: BINDER_SET_CONTEXT_MGR already set [ 231.972658][ T8902] binder: 8900:8902 ioctl 4018620d 2000000001c0 returned -16 [ 232.065131][ T30] audit: type=1400 audit(1754666736.771:387): avc: denied { ioctl } for pid=8896 comm="syz.2.974" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x9439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 232.160580][ T9] usb 4-1: device descriptor read/64, error -71 [ 232.272716][ T9] usb usb4-port1: attempt power cycle [ 232.374121][ T8908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8908 comm=syz.2.977 [ 232.423496][ T5945] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 232.626398][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 232.639959][ T5945] usb 5-1: Using ep0 maxpacket: 16 [ 232.658275][ T9] usb 4-1: device descriptor read/8, error -71 [ 232.667176][ T5945] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 232.689804][ T5945] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 232.870967][ T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 232.880819][ T5945] usb 5-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 232.892415][ T5945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.910045][ T5945] usb 5-1: config 0 descriptor?? [ 233.105048][ T8915] can0: slcan on ptm0. [ 233.487315][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 233.505629][ T5945] usbhid 5-1:0.0: can't add hid device: -71 [ 233.511629][ T5945] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 233.525724][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 233.539472][ T9] usb 4-1: device descriptor read/8, error -71 [ 233.558474][ T5945] usb 5-1: USB disconnect, device number 24 [ 233.588289][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 233.618098][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 233.650231][ T9] usb usb4-port1: unable to enumerate USB device [ 233.662016][ T8912] can0 (unregistered): slcan off ptm0. [ 233.670795][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 233.692844][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.825412][ T10] usb 3-1: Product: syz [ 233.851955][ T10] usb 3-1: Manufacturer: syz [ 233.856680][ T10] usb 3-1: SerialNumber: syz [ 233.999328][ T8902] syz.0.975 (8902): drop_caches: 2 [ 234.509155][ T8925] netlink: 32 bytes leftover after parsing attributes in process `syz.1.981'. [ 234.920270][ T8937] FAULT_INJECTION: forcing a failure. [ 234.920270][ T8937] name failslab, interval 1, probability 0, space 0, times 0 [ 234.939442][ T8937] CPU: 0 UID: 0 PID: 8937 Comm: syz.0.983 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 234.939468][ T8937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 234.939477][ T8937] Call Trace: [ 234.939482][ T8937] [ 234.939489][ T8937] dump_stack_lvl+0x16c/0x1f0 [ 234.939519][ T8937] should_fail_ex+0x512/0x640 [ 234.939551][ T8937] should_failslab+0xc2/0x120 [ 234.939568][ T8937] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 234.939592][ T8937] ? __alloc_skb+0x2b2/0x380 [ 234.939622][ T8937] __alloc_skb+0x2b2/0x380 [ 234.939647][ T8937] ? __pfx___alloc_skb+0x10/0x10 [ 234.939677][ T8937] ? if_nlmsg_size+0x475/0xaf0 [ 234.939697][ T8937] rtmsg_ifinfo_build_skb+0x81/0x280 [ 234.939722][ T8937] rtmsg_ifinfo+0x9f/0x1a0 [ 234.939746][ T8937] __dev_notify_flags+0x24c/0x2e0 [ 234.939774][ T8937] ? __pfx___dev_notify_flags+0x10/0x10 [ 234.939798][ T8937] ? __dev_change_flags+0x3d5/0x720 [ 234.939816][ T8937] ? __pfx___dev_change_flags+0x10/0x10 [ 234.939836][ T8937] ? __pfx_validate_linkmsg+0x10/0x10 [ 234.939855][ T8937] netif_change_flags+0x108/0x160 [ 234.939874][ T8937] do_setlink.constprop.0+0xb53/0x4380 [ 234.939900][ T8937] ? __pfx_do_setlink.constprop.0+0x10/0x10 [ 234.939927][ T8937] ? __lock_acquire+0xb8a/0x1c90 [ 234.939946][ T8937] ? find_held_lock+0x2b/0x80 [ 234.939978][ T8937] ? __mutex_trylock_common+0xe9/0x250 [ 234.939996][ T8937] ? __pfx___mutex_trylock_common+0x10/0x10 [ 234.940012][ T8937] ? __pfx___might_resched+0x10/0x10 [ 234.940032][ T8937] ? rcu_is_watching+0x12/0xc0 [ 234.940060][ T8937] ? trace_contention_end+0xdd/0x130 [ 234.940076][ T8937] ? __mutex_lock+0x1ca/0xb90 [ 234.940099][ T8937] ? irqentry_exit+0x3b/0x90 [ 234.940112][ T8937] ? lockdep_hardirqs_on+0x7c/0x110 [ 234.940144][ T8937] ? rtnl_setlink+0x33c/0x770 [ 234.940163][ T8937] rtnl_setlink+0x3cb/0x770 [ 234.940183][ T8937] ? __pfx_rtnl_setlink+0x10/0x10 [ 234.940198][ T8937] ? netlink_sendmsg+0x8d1/0xdd0 [ 234.940219][ T8937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.940282][ T8937] ? __lock_acquire+0x622/0x1c90 [ 234.940309][ T8937] ? find_held_lock+0x2b/0x80 [ 234.940328][ T8937] ? __pfx_rtnl_setlink+0x10/0x10 [ 234.940344][ T8937] ? __pfx_rtnl_setlink+0x10/0x10 [ 234.940358][ T8937] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 234.940375][ T8937] ? __pfx_rtnl_setlink+0x10/0x10 [ 234.940396][ T8937] rtnetlink_rcv_msg+0x95b/0xe90 [ 234.940415][ T8937] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 234.940439][ T8937] ? ref_tracker_free+0x37c/0x830 [ 234.940458][ T8937] netlink_rcv_skb+0x158/0x420 [ 234.940477][ T8937] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 234.940495][ T8937] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 234.940521][ T8937] ? netlink_deliver_tap+0x1ae/0xd30 [ 234.940543][ T8937] netlink_unicast+0x58a/0x850 [ 234.940565][ T8937] ? __pfx_netlink_unicast+0x10/0x10 [ 234.940592][ T8937] netlink_sendmsg+0x8d1/0xdd0 [ 234.940615][ T8937] ? __pfx_netlink_sendmsg+0x10/0x10 [ 234.940642][ T8937] ____sys_sendmsg+0xa98/0xc70 [ 234.940662][ T8937] ? copy_msghdr_from_user+0x10a/0x160 [ 234.940677][ T8937] ? __pfx_____sys_sendmsg+0x10/0x10 [ 234.940707][ T8937] ___sys_sendmsg+0x134/0x1d0 [ 234.940722][ T8937] ? __pfx____sys_sendmsg+0x10/0x10 [ 234.940735][ T8937] ? __lock_acquire+0x622/0x1c90 [ 234.940780][ T8937] __sys_sendmsg+0x16d/0x220 [ 234.940796][ T8937] ? __pfx___sys_sendmsg+0x10/0x10 [ 234.940828][ T8937] do_syscall_64+0xcd/0x4c0 [ 234.940845][ T8937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.940860][ T8937] RIP: 0033:0x7f00fe18e9a9 [ 234.940874][ T8937] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 234.940889][ T8937] RSP: 002b:00007f00fdff7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 234.940904][ T8937] RAX: ffffffffffffffda RBX: 00007f00fe3b5fa0 RCX: 00007f00fe18e9a9 [ 234.940915][ T8937] RDX: 0000000020040000 RSI: 0000200000000140 RDI: 0000000000000003 [ 234.940924][ T8937] RBP: 00007f00fdff7090 R08: 0000000000000000 R09: 0000000000000000 [ 234.940933][ T8937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 234.940942][ T8937] R13: 0000000000000000 R14: 00007f00fe3b5fa0 R15: 00007fff4a0590f8 [ 234.940970][ T8937] [ 235.492738][ T10] usb 3-1: 0:2 : does not exist [ 235.510206][ T10] usb 3-1: USB disconnect, device number 26 [ 235.694328][ T5842] Bluetooth: hci3: ACL packet too small [ 235.699259][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 235.738130][ T8947] IPv6: NLM_F_CREATE should be specified when creating new route [ 236.003510][ T8960] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8960 comm=syz.1.988 [ 236.460497][ T10] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 236.621157][ T10] usb 1-1: device descriptor read/64, error -71 [ 236.875432][ T10] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 236.888078][ T8987] binder: 8986:8987 unknown command 0 [ 237.036469][ T10] usb 1-1: device descriptor read/64, error -71 [ 237.143466][ T8987] binder: 8986:8987 ioctl c0306201 200000000080 returned -22 [ 237.145283][ T8990] binder: BINDER_SET_CONTEXT_MGR already set [ 237.207944][ T8996] fuse: Bad value for 'user_id' [ 237.217941][ T8990] binder: 8986:8990 ioctl 4018620d 200000000040 returned -16 [ 237.218881][ T8996] fuse: Bad value for 'user_id' [ 237.261212][ T8996] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 237.272343][ T9000] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9000 comm=syz.2.1001 [ 237.315635][ T8996] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 237.339984][ T10] usb usb1-port1: attempt power cycle [ 237.352798][ T30] audit: type=1400 audit(1754666742.335:388): avc: denied { setopt } for pid=8995 comm="syz.1.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 237.426586][ T30] audit: type=1400 audit(1754666742.395:389): avc: denied { connect } for pid=8995 comm="syz.1.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 237.579005][ T30] audit: type=1400 audit(1754666742.553:390): avc: denied { ioctl } for pid=9007 comm="syz.4.1004" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 237.612250][ T5830] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 237.738331][ T10] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 237.781945][ T10] usb 1-1: device descriptor read/8, error -71 [ 237.793374][ T5830] usb 3-1: Using ep0 maxpacket: 16 [ 237.808035][ T5830] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 237.824810][ T5830] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 237.849894][ T5830] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 237.860065][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.920030][ T5830] usb 3-1: Product: syz [ 237.949371][ T5830] usb 3-1: Manufacturer: syz [ 237.960807][ T5830] usb 3-1: SerialNumber: syz [ 238.349748][ T10] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 238.407325][ T10] usb 1-1: device descriptor read/8, error -71 [ 238.608751][ T10] usb usb1-port1: unable to enumerate USB device [ 239.405958][ T5830] usb 3-1: 0:2 : does not exist [ 239.454734][ T5830] usb 3-1: USB disconnect, device number 27 [ 239.531386][ T9031] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9031 comm=syz.0.1009 [ 239.550682][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 239.652384][ T9034] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9034 comm=syz.4.1013 [ 239.678632][ T30] audit: type=1400 audit(1754666744.634:391): avc: denied { watch } for pid=9036 comm="syz.3.1012" path="/198" dev="tmpfs" ino=1039 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 240.238174][ T9045] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1016'. [ 240.641813][ T30] audit: type=1400 audit(1754666745.596:392): avc: denied { bind } for pid=9043 comm="syz.4.1016" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 240.735292][ T9058] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1020'. [ 240.866380][ T5882] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 241.071637][ T5882] usb 4-1: device descriptor read/64, error -71 [ 241.313656][ T5882] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 241.417667][ T9068] fuse: Unknown parameter 'gro' [ 241.454033][ T5882] usb 4-1: device descriptor read/64, error -71 [ 241.529828][ T9070] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9070 comm=syz.4.1026 [ 241.566113][ T5882] usb usb4-port1: attempt power cycle [ 241.669428][ T9074] evm: overlay not supported [ 241.739444][ T9076] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9076 comm=syz.4.1029 [ 241.825593][ T6145] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 241.902230][ T9080] netlink: 'syz.4.1031': attribute type 4 has an invalid length. [ 241.918354][ T5882] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 241.938957][ T5882] usb 4-1: device descriptor read/8, error -71 [ 242.021175][ T6145] usb 3-1: Using ep0 maxpacket: 16 [ 242.041939][ T6145] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 242.387380][ T30] audit: type=1400 audit(1754666747.313:393): avc: denied { remount } for pid=9082 comm="syz.0.1032" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 242.431812][ T5882] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 242.671991][ T6145] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 242.690742][ T6145] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 242.701031][ T5882] usb 4-1: device descriptor read/8, error -71 [ 242.711399][ T6145] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.720569][ T6145] usb 3-1: Product: syz [ 242.726015][ T6145] usb 3-1: Manufacturer: syz [ 242.730612][ T6145] usb 3-1: SerialNumber: syz [ 242.824708][ T5882] usb usb4-port1: unable to enumerate USB device [ 242.935769][ T9089] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9089 comm=syz.0.1035 [ 243.114305][ T9087] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1034'. [ 243.736617][ T30] audit: type=1400 audit(1754666748.654:394): avc: denied { create } for pid=9097 comm="syz.1.1037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 243.883580][ T6145] usb 3-1: 0:2 : does not exist [ 243.937523][ T6145] usb 3-1: USB disconnect, device number 28 [ 243.946316][ T9100] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9100 comm=syz.0.1038 [ 244.259570][ T9110] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1039'. [ 245.092315][ T9115] can0: slcan on ptm0. [ 245.161384][ T9120] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9120 comm=syz.1.1046 [ 245.235359][ T9111] can0 (unregistered): slcan off ptm0. [ 245.495948][ T9127] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1047'. [ 245.536882][ T9134] syz.1.1048: attempt to access beyond end of device [ 245.536882][ T9134] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 245.550894][ T9134] hpfs: hpfs_map_sector(): read error [ 245.703375][ T6145] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 245.942787][ T9138] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9138 comm=syz.0.1052 [ 245.974966][ T6145] usb 4-1: Using ep0 maxpacket: 8 [ 246.154265][ T6145] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 246.166027][ T6145] usb 4-1: config 0 has no interfaces? [ 246.172039][ T6145] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 246.182197][ T6145] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.207203][ T6145] usb 4-1: config 0 descriptor?? [ 246.381043][ T9148] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 246.466113][ T9150] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1056'. [ 246.481184][ T9150] netlink: 'syz.1.1056': attribute type 1 has an invalid length. [ 246.493001][ T9150] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1056'. [ 246.523833][ T30] audit: type=1326 audit(1754666751.436:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.548998][ T30] audit: type=1326 audit(1754666751.436:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.558813][ T9154] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9154 comm=syz.4.1058 [ 246.574495][ T30] audit: type=1326 audit(1754666751.436:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=237 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.612264][ T30] audit: type=1326 audit(1754666751.436:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.643615][ T30] audit: type=1326 audit(1754666751.436:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.669026][ T30] audit: type=1326 audit(1754666751.436:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=450 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.695660][ T30] audit: type=1326 audit(1754666751.436:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.720252][ T30] audit: type=1326 audit(1754666751.436:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.745209][ T30] audit: type=1326 audit(1754666751.436:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9149 comm="syz.1.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f80b618e9a9 code=0x7ffc0000 [ 246.750857][ T6145] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 246.841146][ T9164] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1060'. [ 246.930292][ T6145] usb 3-1: Using ep0 maxpacket: 16 [ 247.002109][ T6145] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 247.063907][ T6145] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 247.151690][ T6145] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 247.182454][ T6145] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.220054][ T6145] usb 3-1: Product: syz [ 247.237701][ T6145] usb 3-1: Manufacturer: syz [ 247.249644][ T6145] usb 3-1: SerialNumber: syz [ 247.485635][ T9171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1063'. [ 247.959787][ T9178] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9178 comm=syz.4.1065 [ 248.069081][ T6145] usb 3-1: 0:2 : does not exist [ 248.108992][ T6145] usb 3-1: USB disconnect, device number 29 [ 248.165060][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 248.197630][ T9184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9184 comm=syz.1.1069 [ 248.354725][ T9191] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1070'. [ 248.406368][ T9192] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1071'. [ 248.456604][ T10] usb 4-1: USB disconnect, device number 31 [ 248.468944][ T9] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 248.640669][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 248.648487][ T9] usb 1-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 248.657916][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.670856][ T9] usb 1-1: Product: syz [ 248.675200][ T9] usb 1-1: Manufacturer: syz [ 248.686447][ T9] usb 1-1: SerialNumber: syz [ 248.699624][ T9] usb 1-1: config 0 descriptor?? [ 248.710247][ T9] gspca_main: se401-2.14.0 probing 047d:5003 [ 248.724449][ T9199] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1073'. [ 248.737916][ T9199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1073'. [ 248.757432][ T9199] pim6reg: entered allmulticast mode [ 248.818239][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 248.818255][ T30] audit: type=1400 audit(1754666753.714:418): avc: denied { write } for pid=9198 comm="syz.2.1073" path="socket:[26215]" dev="sockfs" ino=26215 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 248.904611][ T9199] pim6reg: left allmulticast mode [ 249.123006][ T9] gspca_se401: Wrong descriptor type [ 249.201977][ T6145] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 249.354031][ T9208] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1075'. [ 249.370184][ T30] audit: type=1400 audit(1754666754.272:419): avc: denied { unmount } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 249.384313][ T6145] usb 3-1: Using ep0 maxpacket: 8 [ 249.742893][ T6145] usb 3-1: config 201 has an invalid interface number: 249 but max is 0 [ 249.795444][ T6145] usb 3-1: config 201 has no interface number 0 [ 249.813020][ T6145] usb 3-1: config 201 interface 249 has no altsetting 0 [ 249.856312][ T6145] usb 3-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=fa.df [ 249.869839][ T9216] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9216 comm=syz.3.1077 [ 249.887937][ T6145] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.933548][ T6145] usb 3-1: Product: syz [ 249.949263][ T6145] usb 3-1: Manufacturer: syz [ 249.961617][ T6145] usb 3-1: SerialNumber: syz [ 250.427057][ T9225] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9225 comm=syz.1.1081 [ 250.429804][ T6145] ath6kl: Failed to submit usb control message: -71 [ 250.451029][ T6145] ath6kl: unable to send the bmi data to the device: -71 [ 250.463709][ T6145] ath6kl: Unable to send get target info: -71 [ 250.474002][ T6145] ath6kl: Failed to init ath6kl core: -71 [ 250.484504][ T6145] ath6kl_usb 3-1:201.249: probe with driver ath6kl_usb failed with error -71 [ 250.606724][ T9227] can0: slcan on ptm0. [ 250.883797][ T10] usb 1-1: USB disconnect, device number 26 [ 250.902284][ T6145] usb 3-1: USB disconnect, device number 30 [ 251.111322][ T9221] can0 (unregistered): slcan off ptm0. [ 251.249807][ T5882] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 251.464845][ T9240] can0: slcan on ptm0. [ 251.843839][ T5882] usb 5-1: Using ep0 maxpacket: 16 [ 251.852302][ T5882] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.867665][ T5882] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 251.912006][ T5882] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 251.921860][ T9242] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9242 comm=syz.3.1085 [ 251.936129][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.951993][ T5882] usb 5-1: Product: syz [ 251.964916][ T5882] usb 5-1: Manufacturer: syz [ 251.984547][ T5882] usb 5-1: SerialNumber: syz [ 252.005652][ T9233] can0 (unregistered): slcan off ptm0. [ 252.351637][ T9255] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1087'. [ 252.835353][ T9265] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1091'. [ 252.929085][ T9271] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9271 comm=syz.2.1090 [ 253.001788][ T9270] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1092'. [ 253.064244][ T9265] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1091'. [ 253.099297][ T5882] usb 5-1: 0:2 : does not exist [ 253.157920][ T5882] usb 5-1: USB disconnect, device number 25 [ 253.188640][ T9265] nbd: device at index 64 is going down [ 253.346749][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 253.423694][ T5835] udevd[5835]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 253.483604][ T6066] udevd[6066]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 253.608180][ T9284] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9284 comm=syz.3.1094 [ 253.854300][ T30] audit: type=1326 audit(1754666758.733:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9288 comm="syz.4.1096" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f427b18e9a9 code=0x0 [ 254.401025][ T9298] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1097'. [ 254.692148][ T9305] netlink: 'syz.3.1098': attribute type 5 has an invalid length. [ 254.786236][ T9309] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9309 comm=syz.0.1099 [ 255.533104][ T30] audit: type=1400 audit(1754666760.407:421): avc: denied { read write } for pid=9324 comm="syz.1.1105" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 255.590272][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.611463][ T30] audit: type=1400 audit(1754666760.437:422): avc: denied { open } for pid=9324 comm="syz.1.1105" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 255.643883][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.661318][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.683841][ T9336] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 255.713769][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.743024][ T30] audit: type=1400 audit(1754666760.556:423): avc: denied { mount } for pid=9324 comm="syz.1.1105" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 255.770265][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.798906][ T5830] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 255.801063][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.813064][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.822129][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.839307][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 255.863820][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.885122][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.900098][ T30] audit: type=1400 audit(1754666760.775:424): avc: denied { shutdown } for pid=9339 comm="syz.3.1108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 255.924226][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.943713][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 255.983842][ T5830] usb 1-1: Using ep0 maxpacket: 16 [ 255.996211][ T5830] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 255.996780][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.019219][ T5830] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 256.047454][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.057082][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 256.064824][ T9] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 256.073959][ T9] usb 5-1: config 0 has no interface number 0 [ 256.086068][ T9] usb 5-1: config 0 interface 132 has no altsetting 0 [ 256.089378][ T5830] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 256.104303][ T5830] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.113725][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.118994][ T5830] usb 1-1: Product: syz [ 256.126966][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=9901, bcdDevice=39.75 [ 256.143805][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.144883][ T5830] usb 1-1: Manufacturer: syz [ 256.162764][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.171752][ T5830] usb 1-1: SerialNumber: syz [ 256.176737][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.189823][ T9] usb 5-1: Product: syz [ 256.197104][ T9] usb 5-1: Manufacturer: syz [ 256.208090][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.225363][ T9] usb 5-1: SerialNumber: syz [ 256.236583][ T10] hid-generic 0002:0004:0009.0004: unknown main item tag 0x0 [ 256.251510][ T9] usb 5-1: config 0 descriptor?? [ 256.285809][ T10] hid-generic 0002:0004:0009.0004: hidraw0: HID v0.04 Device [syz0] on syz0 [ 256.342137][ T30] audit: type=1400 audit(1754666761.214:425): avc: denied { unmount } for pid=5824 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 256.448375][ T9349] fido_id[9349]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 256.663869][ T9355] random: crng reseeded on system resumption [ 256.672735][ T30] audit: type=1400 audit(1754666761.523:426): avc: denied { append } for pid=9327 comm="syz.4.1107" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 257.183713][ T30] audit: type=1400 audit(1754666761.533:427): avc: denied { open } for pid=9327 comm="syz.4.1107" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 257.294844][ T9358] can0: slcan on ptm0. [ 257.404166][ T9351] can0 (unregistered): slcan off ptm0. [ 257.414621][ T9364] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9364 comm=syz.2.1112 [ 258.055827][ T30] audit: type=1400 audit(1754666762.829:428): avc: denied { ioctl } for pid=9365 comm="syz.1.1114" path="socket:[26914]" dev="sockfs" ino=26914 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 258.394555][ T30] audit: type=1400 audit(1754666762.839:429): avc: denied { append } for pid=9365 comm="syz.1.1114" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 258.628039][ T10] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 259.019452][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 259.089465][ T10] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 259.104711][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.125703][ T10] usb 4-1: Product: syz [ 259.143341][ T10] usb 4-1: Manufacturer: syz [ 259.152834][ T10] usb 4-1: SerialNumber: syz [ 259.166808][ T10] usb 4-1: config 0 descriptor?? [ 259.362124][ T9379] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1117'. [ 259.650155][ T10] usb 4-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 260.010407][ T9386] can0: slcan on ptm0. [ 260.152400][ T9385] can0 (unregistered): slcan off ptm0. [ 261.307898][ T5830] usb 1-1: 0:2 : does not exist [ 261.358930][ T9] cdc_subset 5-1:0.132: probe with driver cdc_subset failed with error -110 [ 261.408067][ T9410] FAULT_INJECTION: forcing a failure. [ 261.408067][ T9410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 261.445880][ T9] usb 5-1: USB disconnect, device number 26 [ 261.487508][ T5830] usb 1-1: USB disconnect, device number 27 [ 261.493573][ T9410] CPU: 1 UID: 0 PID: 9410 Comm: syz.1.1122 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 261.493601][ T9410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 261.493611][ T9410] Call Trace: [ 261.493617][ T9410] [ 261.493628][ T9410] dump_stack_lvl+0x16c/0x1f0 [ 261.493658][ T9410] should_fail_ex+0x512/0x640 [ 261.493686][ T9410] _copy_from_iter+0x29f/0x16f0 [ 261.493706][ T9410] ? __alloc_skb+0x200/0x380 [ 261.493733][ T9410] ? __pfx__copy_from_iter+0x10/0x10 [ 261.493758][ T9410] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 261.493787][ T9410] netlink_sendmsg+0x829/0xdd0 [ 261.493811][ T9410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 261.493842][ T9410] ____sys_sendmsg+0xa98/0xc70 [ 261.493864][ T9410] ? copy_msghdr_from_user+0x10a/0x160 [ 261.493879][ T9410] ? __pfx_____sys_sendmsg+0x10/0x10 [ 261.493913][ T9410] ___sys_sendmsg+0x134/0x1d0 [ 261.493931][ T9410] ? __pfx____sys_sendmsg+0x10/0x10 [ 261.493944][ T9410] ? __lock_acquire+0x622/0x1c90 [ 261.493996][ T9410] __sys_sendmsg+0x16d/0x220 [ 261.494012][ T9410] ? __pfx___sys_sendmsg+0x10/0x10 [ 261.494047][ T9410] do_syscall_64+0xcd/0x4c0 [ 261.494065][ T9410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.494083][ T9410] RIP: 0033:0x7f80b618e9a9 [ 261.494096][ T9410] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 261.494112][ T9410] RSP: 002b:00007f80b6fab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 261.494128][ T9410] RAX: ffffffffffffffda RBX: 00007f80b63b5fa0 RCX: 00007f80b618e9a9 [ 261.494139][ T9410] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 261.494149][ T9410] RBP: 00007f80b6fab090 R08: 0000000000000000 R09: 0000000000000000 [ 261.494158][ T9410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.494168][ T9410] R13: 0000000000000000 R14: 00007f80b63b5fa0 R15: 00007ffc8b6078f8 [ 261.494190][ T9410] [ 261.815429][ T9416] Bluetooth: MGMT ver 1.23 [ 261.888270][ T9420] tipc: Started in network mode [ 261.931243][ T9420] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 261.997229][ T9420] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa [ 262.024778][ T9420] tipc: Enabled bearer , priority 10 [ 262.104654][ T10] usb write operation failed. (-71) [ 262.280103][ T9427] can0: slcan on ptm0. [ 262.537187][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 262.560627][ T10] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 262.652960][ T10] dvbdev: DVB: registering new adapter (Terratec H7) [ 262.748640][ T10] usb 4-1: media controller created [ 262.781003][ T10] usb read operation failed. (-71) [ 262.842958][ T10] usb write operation failed. (-71) [ 262.922384][ T10] dvb_usb_az6007 4-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 262.938955][ T9418] can0 (unregistered): slcan off ptm0. [ 263.401833][ T5830] tipc: Node number set to 1 [ 263.605253][ T5910] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 263.627323][ T10] usb 4-1: USB disconnect, device number 32 [ 263.649513][ T5830] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 263.834610][ T5910] usb 3-1: Using ep0 maxpacket: 16 [ 263.853084][ T5910] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.874503][ T5910] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 263.899004][ T5910] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 263.923296][ T9449] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1133'. [ 263.932206][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.963575][ T5910] usb 3-1: Product: syz [ 263.967801][ T5910] usb 3-1: Manufacturer: syz [ 263.975879][ T5830] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 264.003055][ T5910] usb 3-1: SerialNumber: syz [ 264.035037][ T5830] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 264.102989][ T5830] usb 5-1: New USB device found, idVendor=0499, idProduct=103e, bcdDevice=4e.18 [ 264.135257][ T5830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.175750][ T5830] usb 5-1: Product: syz [ 264.194439][ T5830] usb 5-1: Manufacturer: syz [ 264.199207][ T5830] usb 5-1: SerialNumber: syz [ 264.219913][ T5830] usb 5-1: config 0 descriptor?? [ 264.391843][ T6145] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 264.692100][ T6145] usb 4-1: Using ep0 maxpacket: 16 [ 264.703753][ T6145] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 264.772562][ T6145] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 264.810239][ T6145] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 264.824663][ T6145] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.840527][ T6145] usb 4-1: Product: syz [ 264.988384][ T6145] usb 4-1: Manufacturer: syz [ 264.994577][ T6145] usb 4-1: SerialNumber: syz [ 264.997694][ T5910] usb 3-1: 0:2 : does not exist [ 265.049317][ T5910] usb 3-1: USB disconnect, device number 31 [ 265.217690][ T9477] can0: slcan on ptm0. [ 265.750411][ T5830] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 266.076207][ T9471] can0 (unregistered): slcan off ptm0. [ 266.297234][ T9490] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 266.762316][ T5830] usb 5-1: USB disconnect, device number 27 [ 267.020497][ T6145] usb 4-1: 0:2 : does not exist [ 267.621618][ T6145] usb 4-1: USB disconnect, device number 33 [ 267.946097][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 268.119198][ T5830] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 268.344548][ T9528] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1148'. [ 268.509565][ T5830] usb 5-1: Using ep0 maxpacket: 8 [ 268.527235][ T5830] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 268.703071][ T5830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.767863][ T5830] usb 5-1: Product: syz [ 268.788094][ T5830] usb 5-1: Manufacturer: syz [ 268.830434][ T5830] usb 5-1: SerialNumber: syz [ 268.848385][ T5830] usb 5-1: config 0 descriptor?? [ 268.942473][ T9] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 269.081421][ T5910] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 269.155747][ T5830] dvb_usb_rtl28xxu 5-1:0.0: chip type detection failed -71 [ 269.171379][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 269.204057][ T5830] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 269.224768][ T9] usb 3-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 269.231988][ T9552] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1156'. [ 269.254128][ T5830] usb 5-1: USB disconnect, device number 28 [ 269.271297][ T5910] usb 4-1: Using ep0 maxpacket: 8 [ 269.281624][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.291815][ T5910] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 269.300684][ T9552] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1156'. [ 269.668327][ T5910] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 269.688172][ T9] usb 3-1: Product: syz [ 269.749224][ T5910] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.758436][ T9] usb 3-1: Manufacturer: syz [ 269.778927][ T9] usb 3-1: SerialNumber: syz [ 269.807209][ T9] usb 3-1: config 0 descriptor?? [ 269.831244][ T5910] usb 4-1: config 0 descriptor?? [ 269.883562][ T9] ssu100 3-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 270.022170][ T5882] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 270.097910][ T5910] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 270.192468][ T5882] usb 5-1: Using ep0 maxpacket: 32 [ 270.206998][ T9571] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1157'. [ 270.209684][ T5882] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 270.279307][ T5882] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 270.330444][ T5882] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 270.365441][ T5882] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 270.427363][ T5882] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 270.499175][ T5882] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 270.518434][ T5830] usb 4-1: USB disconnect, device number 34 [ 270.628472][ T5882] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.676577][ T5882] usb 5-1: config 0 descriptor?? [ 271.004069][ T9] ssu100 3-1:0.0: probe with driver ssu100 failed with error -110 [ 271.027063][ T9581] binder: 9579:9581 unknown command 0 [ 271.039651][ T9581] binder: 9579:9581 ioctl c0306201 200000000080 returned -22 [ 271.162323][ T9584] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1162'. [ 271.783246][ T9587] 8021q: VLANs not supported on ipvlan1 [ 271.833152][ T5910] hid-generic 0003:0004:0000.0005: unknown main item tag 0x0 [ 271.862065][ T5910] hid-generic 0003:0004:0000.0005: unknown main item tag 0x0 [ 271.876444][ T5910] hid-generic 0003:0004:0000.0005: unknown main item tag 0x0 [ 271.925990][ T5910] hid-generic 0003:0004:0000.0005: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 271.973352][ T9595] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9595 comm=syz.0.1166 [ 272.036150][ T5882] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 272.196017][ T5882] usb 4-1: Using ep0 maxpacket: 8 [ 272.207865][ T5882] usb 4-1: config 0 has no interfaces? [ 272.369051][ T9602] can0: slcan on ptm0. [ 272.713033][ T5882] usb 4-1: New USB device found, idVendor=0853, idProduct=0146, bcdDevice= 0.00 [ 272.731922][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.760108][ T5910] usb 5-1: USB disconnect, device number 29 [ 272.763990][ T5882] usb 4-1: config 0 descriptor?? [ 273.019721][ T9585] [U]  [ 273.023780][ T5945] usb 4-1: USB disconnect, device number 35 [ 273.078157][ T9597] can0 (unregistered): slcan off ptm0. [ 273.950277][ T7605] Bluetooth: hci5: Frame reassembly failed (-84) [ 274.012581][ T5910] usb 3-1: USB disconnect, device number 32 [ 274.030425][ T9628] netlink: 'syz.3.1172': attribute type 1 has an invalid length. [ 274.175410][ T9633] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9633 comm=syz.3.1172 [ 274.783022][ T9643] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1172'. [ 274.804234][ T9628] 8021q: adding VLAN 0 to HW filter on device bond2 [ 274.820285][ T9638] can0: slcan on ptm1. [ 274.920370][ T9649] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1176'. [ 274.930811][ T9641] binder: 9637:9641 unknown command 0 [ 274.943539][ T9641] binder: 9637:9641 ioctl c0306201 200000000080 returned -22 [ 274.952904][ T9629] can0 (unregistered): slcan off ptm1. [ 275.100143][ T5945] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 275.272884][ T5945] usb 4-1: config index 0 descriptor too short (expected 31, got 27) [ 275.297174][ T5945] usb 4-1: config 1 interface 0 altsetting 253 endpoint 0x1 has invalid wMaxPacketSize 0 [ 275.783833][ T5945] usb 4-1: config 1 interface 0 has no altsetting 0 [ 275.802174][ T5945] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= b.72 [ 275.813025][ T5945] usb 4-1: New USB device strings: Mfr=28, Product=37, SerialNumber=3 [ 275.835103][ T5945] usb 4-1: Product: syz [ 275.852355][ T5945] usb 4-1: Manufacturer: syz [ 275.864648][ T5945] usb 4-1: SerialNumber: syz [ 276.011342][ T5842] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 276.120979][ T30] audit: type=1800 audit(1754666780.923:430): pid=9666 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1179" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 276.426720][ T9677] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 276.437782][ T30] audit: type=1400 audit(1754666781.253:431): avc: denied { setopt } for pid=9676 comm="syz.1.1183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 276.458170][ T5838] Bluetooth: hci0: ACL packet for unknown connection handle 0 [ 276.491567][ T30] audit: type=1400 audit(1754666781.253:432): avc: denied { read write } for pid=9676 comm="syz.1.1183" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 276.517534][ T30] audit: type=1400 audit(1754666781.253:433): avc: denied { open } for pid=9676 comm="syz.1.1183" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 276.547417][ T5945] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 36 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 277.271392][ T5910] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 277.303985][ T30] audit: type=1400 audit(1754666782.122:434): avc: denied { read write } for pid=9625 comm="syz.3.1172" name="lp0" dev="devtmpfs" ino=3252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 277.330167][ T9628] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1172'. [ 277.345554][ T5882] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 277.352157][ T30] audit: type=1400 audit(1754666782.122:435): avc: denied { open } for pid=9625 comm="syz.3.1172" path="/dev/usb/lp0" dev="devtmpfs" ino=3252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 277.386945][ T9628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=9628 comm=syz.3.1172 [ 277.404168][ T9628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=9628 comm=syz.3.1172 [ 277.418309][ T9628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=9628 comm=syz.3.1172 [ 277.432964][ T9628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2560 sclass=netlink_route_socket pid=9628 comm=syz.3.1172 [ 277.446334][ T30] audit: type=1400 audit(1754666782.282:436): avc: denied { module_request } for pid=9625 comm="syz.3.1172" kmod="netdev-veth0_to_batadv" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 277.488033][ T5910] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 277.514831][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.526536][ T9628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2565 sclass=netlink_route_socket pid=9628 comm=syz.3.1172 [ 277.549178][ T5910] usb 5-1: Product: syz [ 277.587105][ T5910] usb 5-1: Manufacturer: syz [ 277.604544][ T5882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 277.610557][ T5910] usb 5-1: SerialNumber: syz [ 277.623786][ T5945] usb 4-1: USB disconnect, device number 36 [ 277.644011][ T5945] usblp0: removed [ 277.654409][ T5882] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 277.667570][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.678804][ T5882] usb 2-1: Product: syz [ 277.684472][ T5882] usb 2-1: Manufacturer: syz [ 277.689274][ T5882] usb 2-1: SerialNumber: syz [ 277.708353][ T5882] usb 2-1: config 0 descriptor?? [ 277.713455][ T5910] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 277.760206][ T9] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 278.199015][ T9690] lo speed is unknown, defaulting to 1000 [ 278.430029][ T5882] usb 2-1: USB disconnect, device number 14 [ 278.998399][ T9690] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1182'. [ 279.301059][ T9] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 279.698460][ T9] ath9k_htc: Failed to initialize the device [ 279.752982][ T9] usb 5-1: ath9k_htc: USB layer deinitialized [ 279.828858][ T6062] udevd[6062]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 280.243181][ T9697] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1187'. [ 280.361000][ T5895] usb 5-1: USB disconnect, device number 30 [ 280.962256][ T9704] binder: 9698:9704 unknown command 0 [ 280.973236][ T9704] binder: 9698:9704 ioctl c0306201 200000000080 returned -22 [ 280.989036][ T9709] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1190'. [ 281.031852][ T9707] FAULT_INJECTION: forcing a failure. [ 281.031852][ T9707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.068315][ T9707] CPU: 1 UID: 0 PID: 9707 Comm: syz.3.1191 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 281.068345][ T9707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 281.068351][ T9707] Call Trace: [ 281.068355][ T9707] [ 281.068359][ T9707] dump_stack_lvl+0x16c/0x1f0 [ 281.068379][ T9707] should_fail_ex+0x512/0x640 [ 281.068398][ T9707] _copy_to_user+0x32/0xd0 [ 281.068410][ T9707] simple_read_from_buffer+0xcb/0x170 [ 281.068428][ T9707] proc_fail_nth_read+0x197/0x270 [ 281.068443][ T9707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 281.068459][ T9707] ? rw_verify_area+0xcf/0x680 [ 281.068472][ T9707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 281.068487][ T9707] vfs_read+0x1e1/0xc60 [ 281.068504][ T9707] ? __pfx___mutex_lock+0x10/0x10 [ 281.068514][ T9707] ? __pfx_vfs_read+0x10/0x10 [ 281.068532][ T9707] ? __fget_files+0x20e/0x3c0 [ 281.068545][ T9707] ksys_read+0x12a/0x250 [ 281.068560][ T9707] ? __pfx_ksys_read+0x10/0x10 [ 281.068574][ T9707] ? fput+0x70/0xf0 [ 281.068589][ T9707] do_syscall_64+0xcd/0x4c0 [ 281.068600][ T9707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.068611][ T9707] RIP: 0033:0x7f45bf58d3bc [ 281.068621][ T9707] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 281.068631][ T9707] RSP: 002b:00007f45c04b4030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 281.068642][ T9707] RAX: ffffffffffffffda RBX: 00007f45bf7b5fa0 RCX: 00007f45bf58d3bc [ 281.068648][ T9707] RDX: 000000000000000f RSI: 00007f45c04b40a0 RDI: 0000000000000005 [ 281.068654][ T9707] RBP: 00007f45c04b4090 R08: 0000000000000000 R09: 0000000000000000 [ 281.068660][ T9707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.068666][ T9707] R13: 0000000000000000 R14: 00007f45bf7b5fa0 R15: 00007ffcdaf8fed8 [ 281.068679][ T9707] [ 281.825454][ T30] audit: type=1400 audit(1754666786.647:437): avc: denied { ioctl } for pid=9721 comm="syz.4.1195" path="socket:[27569]" dev="sockfs" ino=27569 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 281.973538][ T9] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 282.097661][ T5882] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 282.105545][ T5895] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 282.148343][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 282.182174][ T9] usb 4-1: New USB device found, idVendor=10b9, idProduct=8000, bcdDevice=c0.fa [ 282.204985][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.233476][ T9] usb 4-1: Product: syz [ 282.241815][ T9] usb 4-1: Manufacturer: syz [ 282.255052][ T9] usb 4-1: SerialNumber: syz [ 282.267697][ T9] usb 4-1: config 0 descriptor?? [ 282.354276][ T5895] usb 1-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=7d.08 [ 282.368065][ T5895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.386545][ T5895] usb 1-1: Product: syz [ 282.402513][ T5895] usb 1-1: Manufacturer: syz [ 282.414178][ T5895] usb 1-1: SerialNumber: syz [ 282.431480][ T5895] usb 1-1: config 0 descriptor?? [ 282.454721][ T5895] gm12u320 1-1:0.0: [drm:gm12u320_misc_request.constprop.0] *ERROR* Misc. req. error -22 [ 282.466457][ T5895] gm12u320 1-1:0.0: probe with driver gm12u320 failed with error -5 [ 282.481102][ T5895] usb-storage 1-1:0.0: USB Mass Storage device detected [ 282.489581][ T30] audit: type=1400 audit(1754666787.306:438): avc: denied { create } for pid=9719 comm="syz.3.1194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 282.490557][ T9] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 282.541842][ T5895] usb-storage 1-1:0.0: device ignored [ 282.554704][ T9735] syzkaller1: entered promiscuous mode [ 282.563508][ T9735] syzkaller1: entered allmulticast mode [ 282.569123][ T5882] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 282.569154][ T5882] usb 5-1: can't read configurations, error -71 [ 282.589643][ T9] dvb_usb_af9015 4-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 282.651982][ T5895] usb 1-1: USB disconnect, device number 28 [ 282.741853][ T6145] usb 4-1: USB disconnect, device number 37 [ 283.090599][ T9740] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1201'. [ 283.106310][ T9740] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.117067][ T9726] delete_channel: no stack [ 284.130180][ T9740] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 284.196183][ T9749] can0: slcan on ptm0. [ 284.291199][ T9743] can0 (unregistered): slcan off ptm0. [ 284.356906][ T30] audit: type=1400 audit(1754666789.174:439): avc: denied { read } for pid=9754 comm="syz.3.1205" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 284.407070][ T30] audit: type=1400 audit(1754666789.174:440): avc: denied { open } for pid=9754 comm="syz.3.1205" path="/226/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 285.178750][ T30] audit: type=1400 audit(1754666789.984:441): avc: denied { read } for pid=9764 comm="syz.4.1210" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 285.434880][ T30] audit: type=1400 audit(1754666790.034:442): avc: denied { open } for pid=9764 comm="syz.4.1210" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 285.495223][ T9] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 285.624584][ T30] audit: type=1400 audit(1754666790.443:443): avc: denied { unmount } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 285.716350][ T9783] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1212'. [ 285.756913][ T9784] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 285.756913][ T9784] program syz.0.1213 not setting count and/or reply_len properly [ 285.804148][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 286.043130][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 286.068512][ T9] usb 5-1: config 1 interface 0 altsetting 127 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 286.100141][ T9] usb 5-1: config 1 interface 0 altsetting 127 endpoint 0x81 has invalid maxpacket 1536, setting to 1024 [ 286.171883][ T9] usb 5-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 286.202690][ T9] usb 5-1: config 1 interface 0 has no altsetting 0 [ 286.262838][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=0242, bcdDevice= 0.40 [ 286.285293][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.338698][ T9794] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1217'. [ 286.584174][ T9] usb 5-1: Product: syz [ 286.588782][ T9] usb 5-1: Manufacturer: syz [ 286.607254][ T9] usb 5-1: SerialNumber: syz [ 286.686254][ T9767] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 286.790621][ T9798] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9798 comm=syz.2.1219 [ 286.862939][ T974] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 286.909564][ T9] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input10 [ 286.959009][ T5186] bcm5974 5-1:1.0: could not read from device [ 286.977031][ T5186] bcm5974 5-1:1.0: could not read from device [ 287.006252][ T9] usb 5-1: USB disconnect, device number 33 [ 287.032691][ T974] usb 4-1: Using ep0 maxpacket: 16 [ 287.040084][ T974] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 287.117528][ T974] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 287.160454][ T30] audit: type=1400 audit(1754666791.962:444): avc: denied { map } for pid=9807 comm="syz.4.1223" path="socket:[29829]" dev="sockfs" ino=29829 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 287.162613][ T5882] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 287.245581][ T974] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 287.262839][ T974] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.306902][ T974] usb 4-1: Product: syz [ 287.311159][ T974] usb 4-1: Manufacturer: syz [ 287.318324][ T974] usb 4-1: SerialNumber: syz [ 287.439234][ T9815] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1225'. [ 287.462835][ T5882] usb 1-1: Using ep0 maxpacket: 16 [ 287.469422][ T5882] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 287.487003][ T5882] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 287.510862][ T5882] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 287.521344][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.539565][ T5882] usb 1-1: Product: syz [ 287.563201][ T5882] usb 1-1: Manufacturer: syz [ 287.563841][ T5945] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 287.568122][ T5882] usb 1-1: SerialNumber: syz [ 288.072578][ T30] audit: type=1400 audit(1754666792.901:445): avc: denied { write } for pid=9819 comm="syz.4.1226" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 288.454300][ T5910] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 288.617024][ T5910] usb 2-1: Using ep0 maxpacket: 16 [ 288.716522][ T5910] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 289.222437][ T5910] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 289.294589][ T974] usb 4-1: 0:2 : does not exist [ 289.328858][ T9834] No such timeout policy "syz0" [ 289.700949][ T974] usb 4-1: USB disconnect, device number 38 [ 289.709276][ T5910] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 289.725374][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.736663][ T5910] usb 2-1: Product: syz [ 289.740868][ T5910] usb 2-1: Manufacturer: syz [ 289.747342][ T5910] usb 2-1: SerialNumber: syz [ 289.852241][ T9839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9839 comm=syz.4.1231 [ 289.998354][ T9842] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1232'. [ 290.019006][ T5882] usb 1-1: 0:2 : does not exist [ 290.345280][ T5882] usb 1-1: USB disconnect, device number 29 [ 290.396775][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 290.546937][ T9851] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1234'. [ 292.161427][ T9868] overlayfs: workdir and upperdir must be separate subtrees [ 292.246748][ T9858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 292.558811][ T9879] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9879 comm=syz.4.1243 [ 293.561044][ T5910] usb 2-1: 0:2 : does not exist [ 293.681557][ T5910] usb 2-1: USB disconnect, device number 15 [ 293.738867][ T6066] udevd[6066]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 293.765764][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 293.794142][ T9] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 293.981243][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 293.990221][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 294.012007][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 294.052387][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 294.063856][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.328835][ T9] usb 4-1: Product: syz [ 294.333847][ T9] usb 4-1: Manufacturer: syz [ 294.345623][ T9] usb 4-1: SerialNumber: syz [ 294.553772][ T9903] netlink: 'syz.2.1251': attribute type 10 has an invalid length. [ 294.857247][ T9903] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1251'. [ 294.882020][ T9903] bridge0: port 3(team0) entered blocking state [ 294.891039][ T9903] bridge0: port 3(team0) entered disabled state [ 294.899433][ T9903] team0: entered allmulticast mode [ 294.905199][ T9903] team_slave_0: entered allmulticast mode [ 294.915364][ T9903] team_slave_1: entered allmulticast mode [ 294.927140][ T9903] team0: entered promiscuous mode [ 294.942775][ T9903] team_slave_0: entered promiscuous mode [ 295.156726][ T9903] team_slave_1: entered promiscuous mode [ 295.167323][ T9903] bridge0: port 3(team0) entered blocking state [ 295.174363][ T9903] bridge0: port 3(team0) entered forwarding state [ 295.304755][ T9901] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1250'. [ 295.367645][ T9] usb 4-1: 0:2 : does not exist [ 295.434730][ T9] usb 4-1: USB disconnect, device number 39 [ 295.514513][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.736612][ T9923] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1255'. [ 295.799813][ T974] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 295.850750][ T9925] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1257'. [ 296.085775][ T974] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.269513][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 296.375105][ T974] usb 5-1: New USB device found, idVendor=056a, idProduct=00c6, bcdDevice= 0.00 [ 296.414316][ T974] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.547111][ T974] usb 5-1: config 0 descriptor?? [ 296.555118][ T9] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 296.579463][ T9] usb 2-1: config 0 has no interface number 0 [ 296.672348][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.055088][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 297.073933][ T9] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 297.085181][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.105601][ T9] usb 2-1: config 0 descriptor?? [ 297.115974][ T9941] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9941 comm=syz.3.1262 [ 297.157815][ T9943] SELinux: failed to load policy [ 297.164039][ T30] audit: type=1400 audit(1754666801.964:446): avc: denied { load_policy } for pid=9942 comm="syz.2.1263" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 297.250219][ T974] usbhid 5-1:0.0: can't add hid device: -71 [ 297.342036][ T974] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 297.355258][ T974] usb 5-1: USB disconnect, device number 34 [ 297.448703][ T9950] netlink: 'syz.3.1264': attribute type 1 has an invalid length. [ 297.498829][ T9950] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1264'. [ 297.608077][ T30] audit: type=1400 audit(1754666802.414:447): avc: denied { read } for pid=9951 comm="syz.0.1266" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 297.637345][ T30] audit: type=1400 audit(1754666802.414:448): avc: denied { open } for pid=9951 comm="syz.0.1266" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 297.733416][ T9958] FAULT_INJECTION: forcing a failure. [ 297.733416][ T9958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 297.734537][ T9958] [ 297.734544][ T9958] ====================================================== [ 297.734550][ T9958] WARNING: possible circular locking dependency detected [ 297.734557][ T9958] 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 Not tainted [ 297.734567][ T9958] ------------------------------------------------------ [ 297.734572][ T9958] syz.2.1265/9958 is trying to acquire lock: [ 297.734581][ T9958] ffffffff8e4d2380 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x9f/0xd0 [ 297.734625][ T9958] [ 297.734625][ T9958] but task is already holding lock: [ 297.734629][ T9958] ffff8880b843a2d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 297.734669][ T9958] [ 297.734669][ T9958] which lock already depends on the new lock. [ 297.734669][ T9958] [ 297.734674][ T9958] [ 297.734674][ T9958] the existing dependency chain (in reverse order) is: [ 297.734679][ T9958] [ 297.734679][ T9958] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 297.734701][ T9958] _raw_spin_lock_nested+0x31/0x40 [ 297.734725][ T9958] raw_spin_rq_lock_nested+0x29/0x130 [ 297.734744][ T9958] task_rq_lock+0xcf/0x490 [ 297.734762][ T9958] cgroup_move_task+0x81/0x2a0 [ 297.734784][ T9958] css_set_move_task+0x288/0x5f0 [ 297.734799][ T9958] cgroup_post_fork+0x201/0x9e0 [ 297.734817][ T9958] copy_process+0x5c82/0x7650 [ 297.734839][ T9958] kernel_clone+0xfc/0x960 [ 297.734858][ T9958] user_mode_thread+0xc7/0x110 [ 297.734879][ T9958] rest_init+0x23/0x2b0 [ 297.734896][ T9958] start_kernel+0x3ee/0x4d0 [ 297.734911][ T9958] x86_64_start_reservations+0x18/0x30 [ 297.734935][ T9958] x86_64_start_kernel+0x130/0x190 [ 297.734949][ T9958] common_startup_64+0x13e/0x148 [ 297.734964][ T9958] [ 297.734964][ T9958] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 297.734985][ T9958] _raw_spin_lock_irqsave+0x3a/0x60 [ 297.735006][ T9958] try_to_wake_up+0xb2/0x1680 [ 297.735024][ T9958] __wake_up_common+0x132/0x1f0 [ 297.735038][ T9958] __wake_up+0x31/0x60 [ 297.735058][ T9958] tty_port_default_wakeup+0x2a/0x40 [ 297.735076][ T9958] serial8250_tx_chars+0x68e/0x860 [ 297.735093][ T9958] serial8250_handle_irq+0x761/0xcb0 [ 297.735111][ T9958] serial8250_default_handle_irq+0x9a/0x210 [ 297.735129][ T9958] serial8250_interrupt+0x106/0x210 [ 297.735149][ T9958] __handle_irq_event_percpu+0x22c/0x7d0 [ 297.735168][ T9958] handle_irq_event+0xab/0x1e0 [ 297.735186][ T9958] handle_edge_irq+0x28e/0xab0 [ 297.735202][ T9958] __common_interrupt+0xdf/0x250 [ 297.735221][ T9958] common_interrupt+0xba/0xe0 [ 297.735244][ T9958] asm_common_interrupt+0x26/0x40 [ 297.735259][ T9958] pv_native_safe_halt+0xf/0x20 [ 297.735281][ T9958] default_idle+0x13/0x20 [ 297.735296][ T9958] default_idle_call+0x6d/0xb0 [ 297.735311][ T9958] do_idle+0x391/0x510 [ 297.735328][ T9958] cpu_startup_entry+0x4f/0x60 [ 297.735347][ T9958] start_secondary+0x21d/0x2b0 [ 297.735367][ T9958] common_startup_64+0x13e/0x148 [ 297.735380][ T9958] [ 297.735380][ T9958] -> #2 (&tty->write_wait){-.-.}-{3:3}: [ 297.735401][ T9958] _raw_spin_lock_irqsave+0x3a/0x60 [ 297.735422][ T9958] __wake_up+0x1c/0x60 [ 297.735442][ T9958] tty_port_default_wakeup+0x2a/0x40 [ 297.735457][ T9958] serial8250_tx_chars+0x68e/0x860 [ 297.735473][ T9958] serial8250_handle_irq+0x761/0xcb0 [ 297.735490][ T9958] serial8250_default_handle_irq+0x9a/0x210 [ 297.735508][ T9958] serial8250_interrupt+0x106/0x210 [ 297.735527][ T9958] __handle_irq_event_percpu+0x22c/0x7d0 [ 297.735545][ T9958] handle_irq_event+0xab/0x1e0 [ 297.735563][ T9958] handle_edge_irq+0x28e/0xab0 [ 297.735579][ T9958] __common_interrupt+0xdf/0x250 [ 297.735596][ T9958] common_interrupt+0xba/0xe0 [ 297.735613][ T9958] asm_common_interrupt+0x26/0x40 [ 297.735627][ T9958] _raw_spin_unlock_irqrestore+0x31/0x80 [ 297.735648][ T9958] uart_write+0x2a4/0xb30 [ 297.735662][ T9958] n_tty_write+0x40f/0x1160 [ 297.735679][ T9958] file_tty_write.constprop.0+0x504/0x9b0 [ 297.735694][ T9958] redirected_tty_write+0xd4/0x150 [ 297.735708][ T9958] vfs_write+0x6c4/0x1150 [ 297.735730][ T9958] ksys_write+0x12a/0x250 [ 297.735751][ T9958] do_syscall_64+0xcd/0x4c0 [ 297.735764][ T9958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.735778][ T9958] [ 297.735778][ T9958] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 297.735798][ T9958] _raw_spin_lock_irqsave+0x3a/0x60 [ 297.735818][ T9958] serial8250_console_write+0x181/0x1890 [ 297.735837][ T9958] console_flush_all+0x801/0xc60 [ 297.735853][ T9958] console_unlock+0xd8/0x210 [ 297.735870][ T9958] vprintk_emit+0x418/0x6d0 [ 297.735888][ T9958] _printk+0xc7/0x100 [ 297.735900][ T9958] register_console+0xc2d/0x11b0 [ 297.735919][ T9958] univ8250_console_init+0x5f/0x90 [ 297.735933][ T9958] console_init+0x14f/0x680 [ 297.735946][ T9958] start_kernel+0x29f/0x4d0 [ 297.735958][ T9958] x86_64_start_reservations+0x18/0x30 [ 297.735982][ T9958] x86_64_start_kernel+0x130/0x190 [ 297.735995][ T9958] common_startup_64+0x13e/0x148 [ 297.736009][ T9958] [ 297.736009][ T9958] -> #0 (console_owner){-.-.}-{0:0}: [ 297.736028][ T9958] __lock_acquire+0x126f/0x1c90 [ 297.736041][ T9958] lock_acquire+0x179/0x350 [ 297.736053][ T9958] console_lock_spinning_enable+0xb0/0xd0 [ 297.736071][ T9958] console_flush_all+0x7aa/0xc60 [ 297.736088][ T9958] console_unlock+0xd8/0x210 [ 297.736104][ T9958] vprintk_emit+0x418/0x6d0 [ 297.736122][ T9958] _printk+0xc7/0x100 [ 297.736134][ T9958] should_fail_ex+0x4e7/0x640 [ 297.736157][ T9958] strncpy_from_user+0x3b/0x2e0 [ 297.736177][ T9958] strncpy_from_user_nofault+0x7f/0x180 [ 297.736192][ T9958] bpf_probe_read_user_str+0x26/0x70 [ 297.736213][ T9958] bpf_prog_bc7c5c6b9645592f+0x3e/0x44 [ 297.736225][ T9958] bpf_trace_run4+0x24c/0x5a0 [ 297.736245][ T9958] __bpf_trace_sched_switch+0x145/0x190 [ 297.736263][ T9958] __traceiter_sched_switch+0x6f/0xc0 [ 297.736279][ T9958] __schedule+0x1bee/0x5dd0 [ 297.736299][ T9958] preempt_schedule_irq+0x51/0x90 [ 297.736322][ T9958] irqentry_exit+0x36/0x90 [ 297.736334][ T9958] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 297.736349][ T9958] do_iter_readv_writev+0x5ab/0x950 [ 297.736369][ T9958] vfs_writev+0x35f/0xde0 [ 297.736388][ T9958] do_writev+0x28c/0x340 [ 297.736407][ T9958] do_syscall_64+0xcd/0x4c0 [ 297.736420][ T9958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.736435][ T9958] [ 297.736435][ T9958] other info that might help us debug this: [ 297.736435][ T9958] [ 297.736440][ T9958] Chain exists of: [ 297.736440][ T9958] console_owner --> &p->pi_lock --> &rq->__lock [ 297.736440][ T9958] [ 297.736462][ T9958] Possible unsafe locking scenario: [ 297.736462][ T9958] [ 297.736467][ T9958] CPU0 CPU1 [ 297.736470][ T9958] ---- ---- [ 297.736474][ T9958] lock(&rq->__lock); [ 297.736483][ T9958] lock(&p->pi_lock); [ 297.736494][ T9958] lock(&rq->__lock); [ 297.736504][ T9958] lock(console_owner); [ 297.736514][ T9958] [ 297.736514][ T9958] *** DEADLOCK *** [ 297.736514][ T9958] [ 297.736517][ T9958] 4 locks held by syz.2.1265/9958: [ 297.736526][ T9958] #0: ffff8880b843a2d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 297.736567][ T9958] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1cf/0x5a0 [ 297.736604][ T9958] #2: ffffffff8e5b27c0 (console_lock){+.+.}-{0:0}, at: _printk+0xc7/0x100 [ 297.736637][ T9958] #3: ffffffff8e5b2830 (console_srcu){....}-{0:0}, at: console_flush_all+0x158/0xc60 [ 297.736676][ T9958] [ 297.736676][ T9958] stack backtrace: [ 297.736683][ T9958] CPU: 0 UID: 0 PID: 9958 Comm: syz.2.1265 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 297.736704][ T9958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 297.736714][ T9958] Call Trace: [ 297.736719][ T9958] [ 297.736725][ T9958] dump_stack_lvl+0x116/0x1f0 [ 297.736752][ T9958] print_circular_bug+0x275/0x350 [ 297.736777][ T9958] check_noncircular+0x14c/0x170 [ 297.736804][ T9958] __lock_acquire+0x126f/0x1c90 [ 297.736823][ T9958] lock_acquire+0x179/0x350 [ 297.736836][ T9958] ? console_lock_spinning_enable+0x9f/0xd0 [ 297.736857][ T9958] ? console_lock_spinning_enable+0x88/0xd0 [ 297.736878][ T9958] console_lock_spinning_enable+0xb0/0xd0 [ 297.736896][ T9958] ? console_lock_spinning_enable+0x9f/0xd0 [ 297.736915][ T9958] console_flush_all+0x7aa/0xc60 [ 297.736937][ T9958] ? __pfx_console_flush_all+0x10/0x10 [ 297.736960][ T9958] ? is_printk_cpu_sync_owner+0x32/0x40 [ 297.736983][ T9958] console_unlock+0xd8/0x210 [ 297.737002][ T9958] ? __pfx_console_unlock+0x10/0x10 [ 297.737020][ T9958] ? do_raw_spin_unlock+0xd0/0x230 [ 297.737038][ T9958] ? _printk+0xc7/0x100 [ 297.737053][ T9958] ? __down_trylock_console_sem+0xb0/0x140 [ 297.737071][ T9958] vprintk_emit+0x418/0x6d0 [ 297.737091][ T9958] ? __pfx_vprintk_emit+0x10/0x10 [ 297.737112][ T9958] ? arch_irq_work_raise+0x4f/0x70 [ 297.737134][ T9958] _printk+0xc7/0x100 [ 297.737148][ T9958] ? __pfx__printk+0x10/0x10 [ 297.737165][ T9958] ? __pfx____ratelimit+0x10/0x10 [ 297.737187][ T9958] ? __lock_acquire+0x622/0x1c90 [ 297.737203][ T9958] should_fail_ex+0x4e7/0x640 [ 297.737227][ T9958] ? __pfx_bpf_send_signal_common+0x10/0x10 [ 297.737249][ T9958] strncpy_from_user+0x3b/0x2e0 [ 297.737270][ T9958] ? lock_acquire+0x179/0x350 [ 297.737285][ T9958] strncpy_from_user_nofault+0x7f/0x180 [ 297.737301][ T9958] bpf_probe_read_user_str+0x26/0x70 [ 297.737320][ T9958] bpf_prog_bc7c5c6b9645592f+0x3e/0x44 [ 297.737332][ T9958] bpf_trace_run4+0x24c/0x5a0 [ 297.737348][ T9958] ? __pfx_bpf_trace_run4+0x10/0x10 [ 297.737366][ T9958] ? bpf_trace_run4+0x27e/0x5a0 [ 297.737384][ T9958] ? __lock_acquire+0xb8a/0x1c90 [ 297.737400][ T9958] __bpf_trace_sched_switch+0x145/0x190 [ 297.737419][ T9958] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 297.737442][ T9958] ? tracing_record_taskinfo_sched_switch+0x54/0x400 [ 297.737463][ T9958] __traceiter_sched_switch+0x6f/0xc0 [ 297.737481][ T9958] __schedule+0x1bee/0x5dd0 [ 297.737504][ T9958] ? find_held_lock+0x2b/0x80 [ 297.737524][ T9958] ? avc_has_perm_noaudit+0x117/0x3b0 [ 297.737547][ T9958] ? __pfx___schedule+0x10/0x10 [ 297.737575][ T9958] preempt_schedule_irq+0x51/0x90 [ 297.737598][ T9958] irqentry_exit+0x36/0x90 [ 297.737611][ T9958] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 297.737627][ T9958] RIP: 0010:do_iter_readv_writev+0x5ab/0x950 [ 297.737649][ T9958] Code: e8 7a a2 89 ff 83 e3 20 31 ff 89 de e8 ae 9d 89 ff 85 db 0f 85 a6 01 00 00 e8 61 a2 89 ff 8b 44 24 18 41 09 c5 44 89 6c 24 70 50 a2 89 ff 31 db 4d 85 e4 74 24 e8 44 a2 89 ff 4c 89 e2 48 b8 [ 297.737665][ T9958] RSP: 0018:ffffc900045ffb88 EFLAGS: 00000246 [ 297.737677][ T9958] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8232439b [ 297.737687][ T9958] RDX: ffff888020ffa440 RSI: 0000000000000000 RDI: 0000000000000005 [ 297.737696][ T9958] RBP: ffff888036202fc0 R08: 0000000000000005 R09: 0000000000000000 [ 297.737705][ T9958] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 297.737714][ T9958] R13: ffff888020ffa440 R14: 0000000000000000 R15: 0000000000000000 [ 297.737727][ T9958] ? do_iter_readv_writev+0x30b/0x950 [ 297.737749][ T9958] ? do_iter_readv_writev+0x30b/0x950 [ 297.737770][ T9958] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 297.737791][ T9958] ? selinux_file_permission+0x126/0x660 [ 297.737817][ T9958] ? bpf_lsm_file_permission+0x9/0x10 [ 297.737835][ T9958] ? security_file_permission+0x71/0x210 [ 297.737851][ T9958] ? rw_verify_area+0xcf/0x680 [ 297.737872][ T9958] vfs_writev+0x35f/0xde0 [ 297.737895][ T9958] ? __pfx_vfs_writev+0x10/0x10 [ 297.737916][ T9958] ? rcu_is_watching+0x12/0xc0 [ 297.737935][ T9958] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 297.737958][ T9958] ? lockdep_hardirqs_on+0x7c/0x110 [ 297.737983][ T9958] ? rcu_preempt_deferred_qs_irqrestore+0x4f5/0xbc0 [ 297.738004][ T9958] ? __fget_files+0x20e/0x3c0 [ 297.738021][ T9958] ? do_writev+0x28c/0x340 [ 297.738041][ T9958] do_writev+0x28c/0x340 [ 297.738062][ T9958] ? __pfx_do_writev+0x10/0x10 [ 297.738086][ T9958] do_syscall_64+0xcd/0x4c0 [ 297.738101][ T9958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.738116][ T9958] RIP: 0033:0x7f8f2818e9a9 [ 297.738128][ T9958] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 297.738143][ T9958] RSP: 002b:00007f8f28f4b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 297.738157][ T9958] RAX: ffffffffffffffda RBX: 00007f8f283b6160 RCX: 00007f8f2818e9a9 [ 297.738167][ T9958] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 297.738176][ T9958] RBP: 00007f8f28f4b090 R08: 0000000000000000 R09: 0000000000000000 [ 297.738186][ T9958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 297.738195][ T9958] R13: 0000000000000000 R14: 00007f8f283b6160 R15: 00007ffd5f5a38c8 [ 297.738210][ T9958] [ 299.008846][ T9958] CPU: 0 UID: 0 PID: 9958 Comm: syz.2.1265 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) [ 299.008862][ T9958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 299.008869][ T9958] Call Trace: [ 299.008874][ T9958] [ 299.008880][ T9958] dump_stack_lvl+0x116/0x1f0 [ 299.008900][ T9958] should_fail_ex+0x512/0x640 [ 299.008916][ T9958] ? __pfx_bpf_send_signal_common+0x10/0x10 [ 299.008928][ T9958] strncpy_from_user+0x3b/0x2e0 [ 299.008943][ T9958] ? lock_acquire+0x179/0x350 [ 299.008953][ T9958] strncpy_from_user_nofault+0x7f/0x180 [ 299.008964][ T9958] bpf_probe_read_user_str+0x26/0x70 [ 299.008979][ T9958] bpf_prog_bc7c5c6b9645592f+0x3e/0x44 [ 299.008987][ T9958] bpf_trace_run4+0x24c/0x5a0 [ 299.008998][ T9958] ? __pfx_bpf_trace_run4+0x10/0x10 [ 299.009008][ T9958] ? bpf_trace_run4+0x27e/0x5a0 [ 299.009019][ T9958] ? __lock_acquire+0xb8a/0x1c90 [ 299.009028][ T9958] __bpf_trace_sched_switch+0x145/0x190 [ 299.009041][ T9958] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 299.009055][ T9958] ? tracing_record_taskinfo_sched_switch+0x54/0x400 [ 299.009068][ T9958] __traceiter_sched_switch+0x6f/0xc0 [ 299.009080][ T9958] __schedule+0x1bee/0x5dd0 [ 299.009095][ T9958] ? find_held_lock+0x2b/0x80 [ 299.009107][ T9958] ? avc_has_perm_noaudit+0x117/0x3b0 [ 299.009121][ T9958] ? __pfx___schedule+0x10/0x10 [ 299.009138][ T9958] preempt_schedule_irq+0x51/0x90 [ 299.009153][ T9958] irqentry_exit+0x36/0x90 [ 299.009162][ T9958] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 299.009173][ T9958] RIP: 0010:do_iter_readv_writev+0x5ab/0x950 [ 299.009187][ T9958] Code: e8 7a a2 89 ff 83 e3 20 31 ff 89 de e8 ae 9d 89 ff 85 db 0f 85 a6 01 00 00 e8 61 a2 89 ff 8b 44 24 18 41 09 c5 44 89 6c 24 70 50 a2 89 ff 31 db 4d 85 e4 74 24 e8 44 a2 89 ff 4c 89 e2 48 b8 [ 299.009197][ T9958] RSP: 0018:ffffc900045ffb88 EFLAGS: 00000246 [ 299.009207][ T9958] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8232439b [ 299.009213][ T9958] RDX: ffff888020ffa440 RSI: 0000000000000000 RDI: 0000000000000005 [ 299.009219][ T9958] RBP: ffff888036202fc0 R08: 0000000000000005 R09: 0000000000000000 [ 299.009225][ T9958] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 299.009230][ T9958] R13: ffff888020ffa440 R14: 0000000000000000 R15: 0000000000000000 [ 299.009242][ T9958] ? do_iter_readv_writev+0x30b/0x950 [ 299.009256][ T9958] ? do_iter_readv_writev+0x30b/0x950 [ 299.009269][ T9958] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 299.009283][ T9958] ? selinux_file_permission+0x126/0x660 [ 299.009300][ T9958] ? bpf_lsm_file_permission+0x9/0x10 [ 299.009311][ T9958] ? security_file_permission+0x71/0x210 [ 299.009322][ T9958] ? rw_verify_area+0xcf/0x680 [ 299.009334][ T9958] vfs_writev+0x35f/0xde0 [ 299.009350][ T9958] ? __pfx_vfs_writev+0x10/0x10 [ 299.009363][ T9958] ? rcu_is_watching+0x12/0xc0 [ 299.009375][ T9958] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 299.009390][ T9958] ? lockdep_hardirqs_on+0x7c/0x110 [ 299.009405][ T9958] ? rcu_preempt_deferred_qs_irqrestore+0x4f5/0xbc0 [ 299.009418][ T9958] ? __fget_files+0x20e/0x3c0 [ 299.009429][ T9958] ? do_writev+0x28c/0x340 [ 299.009441][ T9958] do_writev+0x28c/0x340 [ 299.009454][ T9958] ? __pfx_do_writev+0x10/0x10 [ 299.009469][ T9958] do_syscall_64+0xcd/0x4c0 [ 299.009479][ T9958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.009489][ T9958] RIP: 0033:0x7f8f2818e9a9 [ 299.009498][ T9958] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 299.009507][ T9958] RSP: 002b:00007f8f28f4b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 299.009516][ T9958] RAX: ffffffffffffffda RBX: 00007f8f283b6160 RCX: 00007f8f2818e9a9 [ 299.009522][ T9958] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 299.009528][ T9958] RBP: 00007f8f28f4b090 R08: 0000000000000000 R09: 0000000000000000 [ 299.009533][ T9958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.009539][ T9958] R13: 0000000000000000 R14: 00007f8f283b6160 R15: 00007ffd5f5a38c8 [ 299.009548][ T9958] [ 299.409367][ T30] audit: type=1400 audit(1754666802.414:449): avc: denied { ioctl } for pid=9951 comm="syz.0.1266" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 299.523664][ T9] usbhid 2-1:0.1: can't add hid device: -71 [ 299.534421][ T9] usbhid 2-1:0.1: probe with driver usbhid failed with error -71 [ 299.553324][ T9] usb 2-1: USB disconnect, device number 16