last executing test programs: 23m39.64157145s ago: executing program 32 (id=453): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) r0 = open(&(0x7f0000000140)='./file0\x00', 0x800, 0x70) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0x400, 0x0) chdir(&(0x7f0000000140)='./bus\x00') link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') mkdir(&(0x7f0000000300)='./bus\x00', 0x0) 21m3.44856235s ago: executing program 1 (id=2147): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) write$binfmt_elf32(r1, &(0x7f00000014c0)=ANY=[], 0x46b) sendmmsg$inet(r1, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000006c0)="ed", 0x1}, {&(0x7f0000000200)="b5", 0x1}, {&(0x7f0000000340)='.', 0x1}, {&(0x7f0000000140)='U', 0x1}, {&(0x7f0000000180)="f3", 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000580)="f1", 0x1}, {&(0x7f0000000c80)='a', 0x1}, {&(0x7f0000000b40)='M', 0x1}, {&(0x7f0000000d80)='o', 0x1}, {0x0}], 0x5}, 0x70040000}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="bb", 0x1}, {&(0x7f00000007c0)="a1", 0x1}, {&(0x7f0000000800)='s', 0x1}, {&(0x7f00000009c0)='\\', 0x1}], 0x4}}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000440)="88", 0x1}, {&(0x7f0000000840)="e5", 0x1}, {&(0x7f0000001040)="96", 0x1}], 0x3}}], 0x4, 0x4048841) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) shutdown(r2, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 21m3.271091024s ago: executing program 1 (id=2149): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x50}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000140)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x2000000}) bind$rose(0xffffffffffffffff, &(0x7f0000000000)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, 0x5, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 21m2.966694178s ago: executing program 1 (id=2152): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101043, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open(&(0x7f00000003c0)='.\x00', 0x100, 0x97) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {0x20000, 0x4}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0x2, 0x0, 0x0, 0x2004cb, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffff2a4, 0x2000000000003ff, 0x2], 0x0, 0x200306}) pipe2(&(0x7f0000000200), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 4) 21m2.273934153s ago: executing program 1 (id=2155): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000080)=@x86={0x23, 0x1, 0x6, 0x0, 0x0, 0xf3, 0xc, 0x57, 0x51, 0x9, 0x75, 0x1a, 0x0, 0x4, 0x4, 0x10, 0x4, 0x4, 0x81, '\x00', 0x6, 0x4}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f00000000c0)={r5}, &(0x7f0000000180)=0x8) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000000000070000040"]) r6 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r6, &(0x7f0000000080), 0x0, 0x24020804, &(0x7f0000000140)={0x2, 0x4e24, @multicast2}, 0x10) 21m2.215441672s ago: executing program 1 (id=2156): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001580), 0x80000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x103800, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x149000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0), 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) ioprio_get$pid(0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000340)='./file0\x00', 0x0) syz_open_dev$dri(&(0x7f0000000300), 0x5, 0x80) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x40080, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x3f00, 0x0) 21m1.956489028s ago: executing program 1 (id=2159): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r2}}, 0x30) (fail_nth: 1) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000140)={0xb, 0x10, 0xfa00, {&(0x7f00000004c0), r2, 0x2}}, 0x18) 20m46.838712421s ago: executing program 33 (id=2159): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r2}}, 0x30) (fail_nth: 1) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000140)={0xb, 0x10, 0xfa00, {&(0x7f00000004c0), r2, 0x2}}, 0x18) 13m34.929878883s ago: executing program 3 (id=4522): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r2, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r4, &(0x7f00000002c0)=[{0x4000}], 0xdeadbeef, 0x8, 0x1}) r5 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000c4b20710"], 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000000000020ef0e01000000000000010902240001000080000904000001f2ff0100092100000001220500090581"], 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) sendmsg$kcm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1b7f000001bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r8, 0xc0105b08, &(0x7f0000000040)) 13m33.476181064s ago: executing program 3 (id=4530): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_usb_connect(0x4, 0x4a, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r2, @ANYRESDEC=r3, @ANYRESHEX=r3, @ANYRES32=r1, @ANYRES32=r0], 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000006c0), r5) sendmsg$NLBL_MGMT_C_REMOVE(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="f9002dbd7000fcdbdf2502002000050001"], 0x1c}, 0x1, 0x0, 0x0, 0x20008011}, 0x10) syz_usb_control_io$cdc_ncm(r4, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r4, 0x82, 0xc38, &(0x7f0000001240)=ANY=[@ANYBLOB="7c2f0aec9d222ea5ee20e6b25cf191669d6293d87d67cbc22a8dca55b40c545d1439d9ab278a279afd807e25e3c9aacca664836fec718e063c9b06cd66442b6407fec5c3e5cd9d0f1001c90a801c4fadce8e13a5e0209edf5c5693acccefa24d4f5a2ef062e701d054d19e9e6340a1651e05fd87b70942c679234426f9b19c0723563d0e38ec970aec02a6154ab61081aae03050d00192bd9d59977bb2f1297a7cd0571a0dfc5688a8e3d5f4a226b7e397b43c186967c74821bc70005059ab5606c70045a6a9915285c8215b9abd839f50530dde8ad500d70d8f7c1a0093293e6d632f8e8939f3199ab4ec92caed14c26975b57578c8ea666a2e4253ca9516f3c07bdc5ad27c2ff29e1569795f9dfbd1b92919432e423ff4f9a35b77419d6a8540fc9431ca78e05e278bef5a21b1423a3c9f7c1e2bd16a1ecdfde51cfa4aef38e6afb92770bcefb5fcb277ccede1ddc8647db538661b3d10effa1b6f705ef1b74e5bea20b4f98421b7b4be4c5c6be101f5503a4ecaffae335ef565920d678ed5b41031122b21f9d9b7f270b95f94624a7ddc657c83d3722a8d01f321fd7f685fc74d61a4e1914dda6df4be639c4910c56a84c24a41b9ef07eee4083dd9a30a53a58b50186c12180da4186fe5845b6b325fd112378a82d53bee449bc9d4c2d4331a1323c69c99c778560fc2142d138b23000c5403156cd8223f07a73811ab5b81e287bd6ad95c2fefce002ac77a1ac74d5e868870f29277da69987652b0055b3072efab2fe56fe0fe287f7d51aa772b2e3ae77954a938be2792442e1ab2e6fc078d821c70222142568b6db9609f1db23e8a4a460b9fbbeb48469e6bf0acffd85af86e69535a95c02c30d5ad776002c48e19e134688780bbafaf81097358b0c8f63bcefb61d8f29aacb3dc1a485bb7343539387f1e83b9283674bdc0d7fe8bf86948439f4b4a20e2832c560c743e4c2d37eddbf341c47f71a93101a08a533e96601f98752531428944d88c836c7d7a082859a3120721afd99130e83f689720638e889ddf4a23228dc23e955ae67fe5447e134b63f4c72e5664d2ed8a7406568e08f3582661006cf5800615fc4a5ec88ef3361ea027d2a1a550ac3e017a212570cd145fcc2e1984e4fca28bf4110f33a5ac847fcd3605e546ee8ea49a7de5d4b599926a76028e9d5259db7fd6f908c7a8657d42f895380c88ac85cdc183f6b61172b966a41888ceae895eaf18cb8da8d1918411b297959a8abacf8c4cee15ca87048aae13ffe068dee23a9edc2b259aeb0595b7ed2633431067a999f915934aef1be5f360f0db726f24e8eb89adb8db535de6fd7c06678831d17e47c67cd22f047b92d8fba83a49a1285def4dfdf634408cb05ae73f24df76e7393d1e90d40c50bd388bb53e281b889084a1a19efdfa6be16aed1a621d964c1ac332b65765e7440ccc75ef44851409c458905127bd161bf98cb6a3681af073e3650f52d5ee691c347e86360c3aebae4a691b2485d68c57d09e269656b1efbfd3413d54c8d3e467c0bfa84669d0cc5e9cfd50b9c79171f8b6a5e66e8c6f66c0916083b8e8a464498aed3badd2f267fb56adb0953b9ebd0370f941d796abffa81722d502c8d1e9d844802f4197067598b2394dddf76641f9c2ec0403bd379e8f712668b98e1121a27888b227104875999cd562fa9833458879652bfeffabc6bbb5c354dc36ad91354ccb5050d69b28b562a72bbf277f96bd1d5dc6408329f6f850a96762a6aebf2a7b5bacbbc032be8b29c453867a47094289f6b8aa38f85051fc4d4478a02af664b3250a396583001a7971cfa6f5a4931e32e7bfb7b4c3f7be3bc5f91ba46554773b9102dbd4aba4344c6fe87bd050f79175d7918d57bc137cde33a884bba63a1adf6e7e71ba783eb1fe689b23d3ad18627b0b229c0d982631308a88c4bf1e2079eb0fcc486ef864e7c6a75cce17b133577fa88d62807398b8a795ae2bb7610f8b17cfc56ff11b8ffc4aa316e612fc76955dc44e66467c4d632657d4cac3cc1bda8c2c6207915a89f76bf1fd61c156ba8720bb8048601cd1221f6996e6f04e44b842e00a4487cd59501a65db1f6ade7f22ba5d7ee8e67125e284eef41ad5f2069a48cc71c621eb08d832ef8592874199c5c03249d3ee03422535c2be6919c43724277d56a885ab67753ae8d7f1317b7e534bb1a111a0edb5d298c1374c7824a80fb00ae268f2fd641f1b2a12f712d9a5e027957941ffb4218c6d8a8e7950dca0b4c9018dcfb67244a30080d54781b5111c85cd89e08f51c55975301ff389baf2242ef0fb662122a2eb89c1dcaf82d6391906a1b235635e6c484cd5fa32bc80ce68d505df9a9c6b21e222c3b9330243b8e02a3e661c20e0da633d88f7debaf6643654050ab73613dbea6176109b5c35c4d280739aee77f81a1b58efa9e606259f45745b69523bc81828cfcfffd185ad51b4b183b7a1ef86757172ef67a4f153b7c3a3e99f15ef5b09d81cd1ccec8016ecc9864ccf2efdbf7a79ff9ba814a4a9e3124d735a591c649cdefa98bd569c5f4db18a537c55544c671d398ec50d9fc2b1ca1f9b0278acc9a21779c3815fcb0ee1c66c774b6591e8f6b5c9828db8a5d104213cd4513974be404a50c11009c15a1e2aaa81abc6c706c341f145f975717819c4429007ee648f6c3fca45d714981cd9240beea8b02a19e0ddb083dc8115d64d75ab087c87e00792b8b83551ca82b311444067923656b0e70015ca4775da3d5e984ea8af20955f92d9cbd9acca8cd258df4276a118505d440b74e93bd0b97caeb0e24dbb09e7dbdfe0c3b4bdc0983a7d1eee02bee9c5d381bfbd7dfbb6329539698477f3a8bc7f82c01588d679a167e91487f150e5923cbf3030f09c8fb89cf178f5e953618887b7e56afdfd6a6b5e3003cecdbcba76ed86bc48907fada5e0178f9194970323ae9c818215ae2feb1ee56b289d83e8e9d2ab27056ede5651d2a92a93dd3d6c519ac128a44f1414f93e96c55485a73f3cb7e4750d0f2a2acef87e46a7012a30712f7cfe2ac9372af0efcb6475e3a1a8db1961040002915038412b892eee569aae8f38fb07c27aef5bbab7750a244a7c3b0193004246afa1a72368db45cd3649a89b54e880ea12c92beb59e366d7893f725bb8080aebcd35857ff686d03eddc33af248cecc5198bda6f395b55294821f6853232cb5bde67a4166a35224cd9c5b54e6b5a38376b1fdfaeb7563a8ea93148997e2bf490c67916f059e3e1992a986f96d2720a6418cf8c57d6e72eb90d7ca59a3a20fd414e404900aa4a45f381ff7828e15558b4862055bf795c9134836878999200e71e9ba9f83a2e28955c7b37244f3abc8f9d15a5e6c3d9b2f76620b3b2bcb13c0c44c63b9bddd51e339aedfc3a4d995df0eca66c6891ca9099923577e7cd84cb58cf0d6d6eda2baeb00775c4e717e31dbc881615d5f1a0898017954e882a444017e947b1fc05fdcf4495c5dbe3b7b4ce4c1535070fbc64d135df094fe4f6cdd452e7a5f844145af9b746dc5eecede9a834de1ff65525ea3017478ee08dc1bcff852a9d2ad94f46840bdcf1b6226fb0cdb620787692e52aae3b9b703f30b3ce6ca6dcaeb8b3a5884c30c570b29741c70ad99f5d7f463c7e5e1b4bbaafae33e789c0ae1114674732d50c0a799bfa6388365c392d47c3e0d2992a61d21e4ca034ed3d386fe959a94601a4007f1f2060b59359747635b076db7697ba5ad45af0423dbb9966113fa5eb59118cac394c2e2b17ebec1b7ce18ede120b1f56956b12a95de708e780ba7a1ac3a9e31267a2c195acfcb3b20c2f5d20de288846045211da53649a6d8b23008449b763fe6a58243cde95093a9755e5725307af09c997520f159f4ec7d1e687a0cf5148721062ecc6b080f65a550730da9257f1515a10830e29b85de3138a77ee8d2f0cb129c971417d7bbcd982d684b697364084c5764bafb4e2211a82e8c962eefb1f000ac8f5f2567b580931676943cea9b95977d842c247a98672b5c73594eb51f927ee5ec2b0c45eda29fb83a092880e542c60113ca653923aa0c16e2e1604e5f437876cb7fa7d1498584f8800ff80804d41c7b89e9cba341fed8d260a6abd0fc242ba6b3d624c91c468e269069d0a121f0951c3765f18693a2c547d9bc924058d0ecece5c7802126d293d3033d6bbf83d4b8b0144d27cbb985dba465d75b62a93bf7a438cce59f", @ANYRES16=r4]) 13m32.962273488s ago: executing program 3 (id=4534): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000002c0)=0x1) ioctl$TCSETS(r1, 0x8910, &(0x7f0000000080)={0x2, 0xe, 0x10, 0x6af, 0x15, "1a9f0a3f7b52f26ea6fa6a6638d7219c6a5310"}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) migrate_pages(0xffffffffffffffff, 0x1, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) recvmmsg(r3, &(0x7f00000002c0), 0x220, 0x100, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)={@val={0x0, 0x197}, @void, @eth={@local, @remote, @void, {@mpls_uc={0x8847, {[{0x2, 0x0, 0x1}, {0x3}, {}, {0x40}, {0x3, 0x0, 0x1}, {0xffffd, 0x0, 0x1}], @ipv4=@generic={{0x16, 0x4, 0x2, 0x2d, 0x62, 0x68, 0x0, 0x3, 0x85, 0x0, @remote, @private=0xa010100, {[@ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x23, 0x3a, [@dev={0xac, 0x14, 0x14, 0x44}, @empty, @empty, @broadcast, @broadcast, @multicast2, @rand_addr=0x64010100, @multicast1]}, @cipso={0x86, 0x1b, 0xffffffffffffffff, [{0x1, 0xa, "6f351807cbc3fc9d"}, {0x2, 0xb, "51d846fb91b0694452"}]}, @end]}}, "e363194690ecd9f914bf"}}}}}}, 0x8c) 13m32.728062616s ago: executing program 3 (id=4536): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='gfs2\x00', 0x208002, 0x0) 13m32.604098452s ago: executing program 3 (id=4537): ptrace$setregs(0xd, 0x0, 0x100, 0x0) (async) syz_clone3(0x0, 0x0) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000a00000008001240"], 0x60}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x35}, {0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) socket(0x1d, 0x5, 0x1173) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r1, 0x45809000) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) sendfile(r2, r3, 0x0, 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, 0x0, &(0x7f0000048000), 0x2) 13m32.253565886s ago: executing program 3 (id=4539): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) unshare(0x22020600) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) dup2(r4, r3) (async, rerun: 64) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r3, 0x0) (async, rerun: 64) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async, rerun: 32) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}}) (rerun: 32) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) (async, rerun: 32) personality(0x5400004) (async, rerun: 32) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x4, 0x3}, {0xfffc, 0x4, 0x1, 0xae3}, {0x1000, 0x40, 0xf, 0x3}]}) mmap(&(0x7f00005ed000/0x2000)=nil, 0x2000, 0x0, 0x8010, r9, 0xc9dff000) (async) r10 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f0000000340)={r10}) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r8, 0x7dfff000) 13m31.97582851s ago: executing program 34 (id=4539): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) unshare(0x22020600) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) dup2(r4, r3) (async, rerun: 64) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r3, 0x0) (async, rerun: 64) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async, rerun: 32) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}}) (rerun: 32) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) (async, rerun: 32) personality(0x5400004) (async, rerun: 32) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x4, 0x3}, {0xfffc, 0x4, 0x1, 0xae3}, {0x1000, 0x40, 0xf, 0x3}]}) mmap(&(0x7f00005ed000/0x2000)=nil, 0x2000, 0x0, 0x8010, r9, 0xc9dff000) (async) r10 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f0000000340)={r10}) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r8, 0x7dfff000) 9m28.820582423s ago: executing program 6 (id=5755): mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='udf\x00', 0x200000, 0x0) 9m28.728051236s ago: executing program 6 (id=5756): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) (async, rerun: 32) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 32) read$char_usb(r1, &(0x7f0000000000)=""/188, 0xbc) syz_usb_disconnect(r0) (async) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x6, 0x8, 0xd, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x4, 0x1, 0x3}, {0x6, 0x24, 0x1a, 0x6, 0x9}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0xa, 0xfc, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0xbd, 0x8, 0xa}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x2, 0x0, 0x3}}}}}}}]}}, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vxfs\x00', 0x200000, 0x0) 9m25.73492222s ago: executing program 6 (id=5767): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000034000000030a010200000000000000000100fffb0900030073797a32000000000900010073797a300000000008000a400000000420000000080a01080000000000000000010000000900010073797a30"], 0x9c}}, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x4) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}}, @NFT_MSG_NEWSET={0x120, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_EXPRESSIONS={0x104, 0x12, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x1}]}}}, {0x60, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_RT_KEY={0x8}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RT_KEY={0x8}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x38, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_FWD_SREG_DEV={0x8}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_FWD_SREG_DEV={0x8}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}]}}}, {0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", "", ""]}}}, {0x20, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x4b}]}}}]}]}, @NFT_MSG_DELFLOWTABLE={0x4c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8c}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x6, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWSET={0x30, 0x9, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWCHAIN={0xd0, 0x3, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_USERDATA={0xae, 0xc, "707bb9e9a42e6525d8dc15956872ee90f475aa191966c3c8085d944d5fb99e012f87b236429478fe547b01db5215884063773a45cfe55f0be3029856ed0e650d0071038a9ca2d0c21c97d8a8506844eb6f96f2f6b0d869df88017f998c677dda2e8ca9f3cd9085124f10a7ac8552c2382d4091dc389bbb584235f55d6729c07dc47b2cef90ec7cd92fee943220be8d18bf7017d788453315757c494c1972ebabfa1c88c2e0cddae18323"}]}, @NFT_MSG_NEWFLOWTABLE={0x34, 0x16, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELCHAIN={0x238, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_CHAIN_USERDATA={0x7c, 0xc, "fbee0aa8bf9117891a2581745949b59261ae126feee17fb5069214122fbf6d74b15983ef9b80a902e7f29b642eee27c519ae8cf98d5044b5b835f2524d0152a89ed4ac42d3de2cb0d188213f101a34ac8f02786298ca2c87c907988995b6455ca5da69089500b258b6d6886be37cc1561081adbb7a13b8c2"}, @NFTA_CHAIN_COUNTERS={0x58, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x40}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x4}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x3}, @NFTA_COUNTER_PACKETS={0xc}]}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_COUNTERS={0x58, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x66}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x4000}]}, @NFTA_CHAIN_USERDATA={0xd6, 0xc, "9fc928e1c7602e9bfa687ee4c2ff24a59333695da79105424ffd47e4d53dc9a64dc244c0e0e99d21852e8b774a34a238557d69e9df2b2364d95691ac10b24f98165500ee4717ec2fc91501f009570d7545a12fca6092f34a92bb5f786a371db3e99b4a4f87c05e7d9da8250aed1ff24efd91e7e48d1362c0fbab0ffaf05a20d1765fa5936e86f3467cab777c6432f30b056525b4b8b627c5e5ee2f12df5763324b4559307f2fdfea778d50bfa91dab541d3cb72346a628beea3f7763a10825aab6d47668562fb9693d8f17ce0521adf1dba5"}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffe}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x554}, 0x1, 0x0, 0x0, 0x40408c1}, 0x0) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x2, @any, 0x1}, 0xe) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000040)={@val={0x0, 0x6003}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0xfc, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0x8000, 0x6558, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x9, 0x0, @void}}}}}}}}, 0x32) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x4, 0x0, 0xfffffffffffffffe, 0x2}, 0x10}, 0x1, 0x7}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x5, 0x5}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r6) sendmsg$tipc(r6, &(0x7f00000008c0)={&(0x7f00000005c0)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x7fffffff}}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000600)="cb1c8b7cbabfbca2bd1a0fae16d48b2faa25a5ce60c761396ca2cad8b33cd7754790cd7f90782770dfebd7c27bd8b642f91fff68fbec3e4e14ebe01f9bdc37af7d75e723974b351f973e64a706338439318f660b5ed05852cecf87d1a3fe81e4a488ba9fd57e24da142f5f7bd40cfdae496efb836bc05737a7e009bce822cdc413fbf135fbf93a0c3abdd56e55a2bfe7836d4be7c08022d1126ff4e8ad7980e0c3c40214787408db2b1d31623d267eead7da4d70c39fc092ca62f4db8ee5d6560578c2a469bb7bc9aae263", 0xcb}, {&(0x7f0000000700)="ac1ca44b7f787235faee1c8a865d2719dcadf7db83b404e7b8f48ba10534dfa109c6a4ce5ea26356baf622a4b4b2e7ccc6d24765c86a8b571fc3ccf1127cde0d059732eb4be1d135cbd84015c0386de4e94812509a07034509489ed5da69a2db1e9fd5762bc8e80f5cea7004916af6e5365ed3ff624f6543d0148bdd912ee1df9c17981a966d5222c37f543a77ba256f1c636554f43f61f07c68041e689d26a3ecc8fc90b883b4d76f2d3121a4a51c03d75e403cb98e3eca39c26fc493f3573271548571798fde2103", 0xc9}, {&(0x7f0000000800)="0bd3ff3d864dfbe62d4692d07b122c32416a47520cef67b60a7ebfeff16d0e1f2937c762da37a0fea0325ef3b1", 0x2d}, {&(0x7f0000000840)="943f20e8155586e4623932ba7a24e75536814ea2edf2c2cd096ab8ea999cf742353c329d8233dcb044c0431cb6", 0x2d}], 0x4, &(0x7f0000000f00)="e1d99b539ec7b3cb685ecd4a9492866bee1c5d03fbc9e4d0867564963fe5dabf743b97be8789d110deb87ba8d7975ab2ef981a11efc158fc41d49693d04ab53efef3dced393fd6e27a533de9c327994301dd54b3d316b93f2b962769ad10f53217e16fab68332397512c0ec5819a63e88d8eb09fc6890a235407c22ae80acff71bdafe183458c91048fcdc484f1908e4207e", 0x92, 0x40}, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x84, r7, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x1ff}, {0x6, 0x11, 0xc571}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x80}}, {0x8, 0xb, 0x65}, {0x6, 0x11, 0x8}}]}, 0x84}, 0x1, 0x0, 0x0, 0x8040000}, 0x4810) gettid() r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc287, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x6, [{{0x9, 0x4, 0x0, 0x0, 0x10, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1ff, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xc, 0x1}}}}}]}}]}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYRESDEC=r1], 0x14) mbind(&(0x7f000078a000/0x2000)=nil, 0x2000, 0xc002, 0x0, 0x90b, 0x5) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) syz_usb_control_io(r8, &(0x7f00000002c0)={0x2c, &(0x7f0000000540)=ANY=[@ANYBLOB="2d1731a62a452711ebb4b9438c1e59f6835611d82f8b33c2c96de86b1707ec59a33b0ce8bd656167a03a9cbe7c54bb9568fa21cb5c2790b2e05731be9004935d248e6f8cb276879544781d97680cacb319fabf5fba4d76b7c14f5dc9f464022d91cf84b36255ccfca79db94405e3ee3f936ac6f2a66ba3f68ea1104fc3"], 0x0, 0x0, 0x0, 0x0}, 0x0) r10 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000940), 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r10, 0xc0145401, &(0x7f0000000000)={{0x3, 0x0, 0x1, 0x2}, 0x0, 0x0, 'id0\x00', 'timer0\x00'}) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x8000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)) 9m22.650574723s ago: executing program 6 (id=5785): r0 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) ioctl$SIOCAX25GETUID(r1, 0x89e0, &(0x7f00000005c0)={0x3, @bcast}) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x80040, 0x1b9, 0x23}, 0x18) getdents64(r2, &(0x7f0000000180)=""/186, 0xba) 9m22.605445572s ago: executing program 6 (id=5786): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x566afa30a48730) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='btrfs\x00', 0x4400, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r2, 0x6f000) ioctl$BTRFS_IOC_DEFRAG_RANGE(r2, 0x40309410, &(0x7f00000000c0)={0x1, 0x5, 0x0, 0xff, 0x2, [0x4, 0x4, 0x5, 0x1]}) 9m22.462724043s ago: executing program 6 (id=5788): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2001"], 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0xfe3a, 0x3e, 0x200, 0x1070bd2b, 0x0, {0x1}, [@typed={0x4}, @generic="a430d2c332bd4cb63755c7b20853cb7c3d343ebeb2de", @nested={0x4, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) syz_usb_control_io$uac1(r0, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x0, 0x21, 0x3e, {0x3e, 0x21, "287e50f6918180c4aecefe8159c1041eff2b65c0f3e474858f6caba7cb92166c91447ddf9e0ca9bc95832c549a6993baa049bed96c987386128f60e7"}}, &(0x7f0000000000)={0x0, 0x3, 0x24, @string={0x24, 0x3, "4496b5be5e46b807d65a008651ffed69022503c6813129541b509b0c4d99e605fc73"}}}, &(0x7f0000000340)={0x44, &(0x7f0000000140)={0x0, 0x7}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0xc4}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000200)={0x20, 0x81, 0x1, '2'}, &(0x7f0000000240)={0x20, 0x82, 0x1, "db"}, &(0x7f0000000280)={0x20, 0x83, 0x2, '0\r'}, &(0x7f00000002c0)={0x20, 0x84, 0x2, "ac51"}, &(0x7f0000000300)={0x20, 0x85, 0x3, '|q9'}}) 9m7.449081511s ago: executing program 35 (id=5788): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2001"], 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0xfe3a, 0x3e, 0x200, 0x1070bd2b, 0x0, {0x1}, [@typed={0x4}, @generic="a430d2c332bd4cb63755c7b20853cb7c3d343ebeb2de", @nested={0x4, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) syz_usb_control_io$uac1(r0, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x0, 0x21, 0x3e, {0x3e, 0x21, "287e50f6918180c4aecefe8159c1041eff2b65c0f3e474858f6caba7cb92166c91447ddf9e0ca9bc95832c549a6993baa049bed96c987386128f60e7"}}, &(0x7f0000000000)={0x0, 0x3, 0x24, @string={0x24, 0x3, "4496b5be5e46b807d65a008651ffed69022503c6813129541b509b0c4d99e605fc73"}}}, &(0x7f0000000340)={0x44, &(0x7f0000000140)={0x0, 0x7}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0xc4}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000200)={0x20, 0x81, 0x1, '2'}, &(0x7f0000000240)={0x20, 0x82, 0x1, "db"}, &(0x7f0000000280)={0x20, 0x83, 0x2, '0\r'}, &(0x7f00000002c0)={0x20, 0x84, 0x2, "ac51"}, &(0x7f0000000300)={0x20, 0x85, 0x3, '|q9'}}) 8m56.978493393s ago: executing program 5 (id=5912): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x4) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x6, r2, &(0x7f00000001c0), 0x0, 0x9, 0x0, 0x2}]) r3 = eventfd(0x2) io_submit(0x0, 0x1, &(0x7f0000000140)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x200, r1, &(0x7f0000000040)="1359b519e234878818b8a5071353df3b9c0151bd74314161609d27d0a03f5cb95a305e594a235531687fa00f4996d6036147ee18d3a1c06a5a3ed4f5a189e1ddba139145ab12b4", 0x47, 0xfffffffffffffffa, 0x0, 0x0, r3}]) open(&(0x7f0000000000)='./file0\x00', 0x480, 0x44) r4 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_int(r4, 0x0, 0x21, 0x0, &(0x7f0000000100)) sendfile(r1, r1, 0x0, 0x7ffff000) 8m56.62717765s ago: executing program 5 (id=5913): syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000904000001020d00000524060001052400a9b30d240f01020000000300ff000606241a0c001407240a050905580c241b04000200a90c090003042402"], 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setreuid(0xee01, 0x0) setns(r2, 0x24020000) syz_clone(0xfdba2180, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r4, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0xf, 0x20203243, 0x3, [0x2], [0x80ffff, 0x0, 0x0, 0xfffffffe], [0x0, 0x0, 0x0, 0x3], [0xfff]}) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x2, 0x1}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x91, @remote, 0x1}}, 0x0, 0x0, 0x32, 0x0, "0c9e089c1b4a04000bde79f04103c458187eb46c2d996aff287154e786455261c425a7519cc275d04e6205abd307a0c4fa3838bf399ad5bd35f21907c7988d1300"}, 0xd8) syz_usb_connect$hid(0x4, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x2006, 0x118, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0x50, 0x4, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x4, 0x0, 0x1, {0x22, 0xbb6}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x1, 0x8, 0x4}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0xe, 0x8, 0xa8, 0xff, 0x69}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x4, [{0x1c, &(0x7f0000000180)=@string={0x1c, 0x3, "268df2d3f83302232a609c17fb96be40287613f4f1a75aee7df7"}}, {0xcf, &(0x7f0000000280)=@string={0xcf, 0x3, "474392b8e6ea781343476430c2901393cf853057742d062e8449a756664972a0542539b38f6f25254b0abf0e40e2118c7b267aafbe8fb2c9f5e2ef1b6cf197e4ce0f8c204a7e12c66ca5e61c171ab3e3cdcfffbcb466efb1a6106b481bbaa5fcf112fa4edc6625eeb773e005a06df74326c9358fb5631d2b6833612aafc6100918431b5b19db12d473cfa04593bdafc743cf0a0b312e44c80be4eac30e4745be857c0f8977dcb665f10a563985e4fd49a19b8e249d51b01a5ed8ed7f832ddcc5849790f858f355f3c9d6ad6531"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x860}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x140c}}]}) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000500)={@in6={{0xa, 0x4e24, 0x0, @loopback, 0x2}}, 0x0, 0x0, 0x4, 0x0, "a1c1dd75a6843e10951cd4b347113e55eb499519becf7542c90bc21470e441225642855b5f2faed4a18d67efd5f2fdf98328de94410300"}, 0xd8) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vxfs\x00', 0x20080c4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 8m55.795241241s ago: executing program 5 (id=5917): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000000000106d0413c500000000000109022400010000000009040000010300000009210500000122050009058103"], 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x80842, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r1, 0x40047459, &(0x7f0000009280)={0xfffffffffffffff7, 0x0}) readv(r1, &(0x7f0000009500)=[{&(0x7f00000092c0)=""/71, 0x47}], 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000003c0)={0x2, 0x0, [{0x40000000, 0x0, 0x6}, {0x40000001, 0x0, 0x7}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(streebog256-generic,pcbc(fcrypt-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000300)="09000000f5e57aa04e", 0x9) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000002480)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, &(0x7f0000000040)}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, 0x1c) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') creat(&(0x7f0000001380)='./file0\x00', 0xb4) 8m54.888368315s ago: executing program 5 (id=5922): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, {}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x2, 0x1, 0x4}}, 0xe8) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x4d, 0x0, 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000001400)) writev(r3, &(0x7f00000001c0)=[{&(0x7f00000006c0)="2e31b69c9bd4beb2ce56518bf0aea548722f054677edd0cb67e2afb987c3e16e3b65bfe50c4d55086a56832bebeb32802ecd8e61032995b891d24c782afea345ed2f0a87bc1bfc6101fa7d1d2c2e57f889dbb28fe7b7e2fc562acebfd86566be11c267f5c5c5e1707a44f2795400fb26cd4170d76c6807d8270435f365", 0x7d}, {&(0x7f00000002c0)="9ab78b2a2070fc9a35faf724bcfc3546586961a4fb508efaa05e67d08df5cce33d600cbb4edc4e4fee1d4c8fe5d1e527301b19f628b917b07cd1fd5936f8f1", 0x3f}], 0x2) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 8m54.082860526s ago: executing program 5 (id=5924): r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xcd) accept4$ax25(r0, &(0x7f00000000c0)={{0x3, @default}, [@null, @null, @default, @default, @netrom, @default, @bcast, @null]}, &(0x7f0000000140)=0x48, 0x1800) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='msdos\x00', 0x200000, 0x0) 8m53.975483935s ago: executing program 5 (id=5926): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) fadvise64(r0, 0x1000, 0x1, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8000, &(0x7f00000024c0)=ANY=[@ANYBLOB='quota']) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) r2 = gettid() r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) tkill(r3, 0x0) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f00000000c0)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x23) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$BTRFS_IOC_BALANCE_V2(r5, 0xc4009420, &(0x7f0000001580)={0x1e, 0xb, {0x4, @usage=0x56df0716, 0x0, 0x5, 0x86, 0x4, 0xb, 0xffff, 0x1, @struct={0x9, 0xffff}, 0x0, 0x80000001, [0xf2da, 0xfffffffffffffffd, 0x6, 0x91bc, 0x3, 0x100]}, {0x8000000000000001, @struct={0x4, 0x4a0e}, 0x0, 0xdf2, 0x3, 0x3, 0x4, 0x0, 0x82, @struct={0x7, 0x1ff}, 0x8, 0x1, [0x10, 0x8, 0x0, 0x3, 0x1e, 0xffffffff]}, {0x0, @struct={0x5}, 0x0, 0x100, 0x10000, 0x0, 0x81, 0xcf56, 0x20, @usage=0x9, 0x1, 0x401, [0x7, 0x8000000000000000, 0x4948, 0x308400000000000, 0xcf1, 0x9]}, {0x9, 0x1, 0x6b47}}) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000200)={0x6, 0x2, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000080)=0x2) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r10 = dup(r9) r11 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {'wfdno', 0x3d, r11}}) prctl$PR_SET_THP_DISABLE(0x41, 0x3) mmap(&(0x7f00002ea000/0x1000)=nil, 0x1000, 0x37fffff, 0x4002011, 0xffffffffffffffff, 0x0) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) write$binfmt_misc(r7, &(0x7f0000000980), 0xfdef) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) 8m38.874697697s ago: executing program 36 (id=5926): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) fadvise64(r0, 0x1000, 0x1, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8000, &(0x7f00000024c0)=ANY=[@ANYBLOB='quota']) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) r2 = gettid() r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) tkill(r3, 0x0) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f00000000c0)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x23) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$BTRFS_IOC_BALANCE_V2(r5, 0xc4009420, &(0x7f0000001580)={0x1e, 0xb, {0x4, @usage=0x56df0716, 0x0, 0x5, 0x86, 0x4, 0xb, 0xffff, 0x1, @struct={0x9, 0xffff}, 0x0, 0x80000001, [0xf2da, 0xfffffffffffffffd, 0x6, 0x91bc, 0x3, 0x100]}, {0x8000000000000001, @struct={0x4, 0x4a0e}, 0x0, 0xdf2, 0x3, 0x3, 0x4, 0x0, 0x82, @struct={0x7, 0x1ff}, 0x8, 0x1, [0x10, 0x8, 0x0, 0x3, 0x1e, 0xffffffff]}, {0x0, @struct={0x5}, 0x0, 0x100, 0x10000, 0x0, 0x81, 0xcf56, 0x20, @usage=0x9, 0x1, 0x401, [0x7, 0x8000000000000000, 0x4948, 0x308400000000000, 0xcf1, 0x9]}, {0x9, 0x1, 0x6b47}}) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000200)={0x6, 0x2, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000080)=0x2) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r10 = dup(r9) r11 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {'wfdno', 0x3d, r11}}) prctl$PR_SET_THP_DISABLE(0x41, 0x3) mmap(&(0x7f00002ea000/0x1000)=nil, 0x1000, 0x37fffff, 0x4002011, 0xffffffffffffffff, 0x0) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) write$binfmt_misc(r7, &(0x7f0000000980), 0xfdef) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) 7m58.169463265s ago: executing program 7 (id=6273): mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) (async) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) mount$binder(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0), 0x1800071, &(0x7f0000000100)={[{@stats}, {@stats}, {}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x4}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x2}}], [{@fsuuid={'fsuuid', 0x3d, {[0x7b46fa05e92e3644, 0x62, 0x33, 0x33, 0x65, 0x31, 0x37, 0x35], 0x2d, [0x62, 0x32, 0x36, 0x33], 0x2d, [0x63, 0x66, 0xe6fbb3d678f4e1a5, 0x66], 0x2d, [0x31, 0x66, 0x66, 0x61], 0x2d, [0x66, 0x39, 0x63, 0x34, 0x32, 0x36, 0x66, 0x64]}}}]}) 7m58.039799066s ago: executing program 7 (id=6275): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mprotect(&(0x7f00003fd000/0xc00000)=nil, 0xc00000, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000100), 0x80000, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x20) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mlock2(&(0x7f00002e5000/0xc00000)=nil, 0xc00000, 0x0) 7m57.892581111s ago: executing program 7 (id=6278): r0 = socket(0x840000000002, 0x3, 0xff) setsockopt$MRT_DONE(r0, 0x0, 0xc9, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x28, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x287}, @NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x28}}, 0x0) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x60080, 0x0) ioctl$COMEDI_LOCK(r6, 0x6405) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x80108906, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, 0x0, 0x2, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x8067, 0x5c}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0xfb42fa9cf14cf4a5}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x361}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x5}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x17e6dc870d3c5c3f) mount(&(0x7f0000000000)=@filename='./cgroup\x00', &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='gfs2\x00', 0x208002, 0x0) 7m57.700178958s ago: executing program 7 (id=6279): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000240)='./cgroup\x00', 0x0, 0x0, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$bind(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='./cgroup\x00', &(0x7f00000001c0), 0x40000, 0x0) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x1228800, 0x0) 7m57.589545642s ago: executing program 7 (id=6281): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r0, 0xf648e000) madvise(&(0x7f000026d000/0x2000)=nil, 0x2000, 0x16) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001180)=ANY=[@ANYBLOB="18000200000004005100"], 0x18}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 7m57.186878275s ago: executing program 7 (id=6286): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004f864920ca0768a8998a010203010902120001030010000904e300e3a5636200"], 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x80002) ioctl$LOOP_SET_STATUS(r1, 0x1277, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000100)={0x28, 0x7, r2, r2, 0x8, 0x3e5, 0x4}) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006300)={0x14, 0x14, 0x1, 0x70bd2a, 0x25dfdbfe, {0x2b, 0x28}}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x840) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000a00)={0x28, 0x1, r2, 0x0, &(0x7f0000000040)='\x00\x00\x00', 0x3, 0x555ff391}) creat(&(0x7f0000001380)='./file0\x00', 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0) 7m57.018300058s ago: executing program 37 (id=6286): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004f864920ca0768a8998a010203010902120001030010000904e300e3a5636200"], 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x80002) ioctl$LOOP_SET_STATUS(r1, 0x1277, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000100)={0x28, 0x7, r2, r2, 0x8, 0x3e5, 0x4}) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006300)={0x14, 0x14, 0x1, 0x70bd2a, 0x25dfdbfe, {0x2b, 0x28}}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x840) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000a00)={0x28, 0x1, r2, 0x0, &(0x7f0000000040)='\x00\x00\x00', 0x3, 0x555ff391}) creat(&(0x7f0000001380)='./file0\x00', 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ntfs3\x00', 0x8000, 0x0) 1m13.260001302s ago: executing program 9 (id=9239): creat(&(0x7f0000001380)='./file0\x00', 0x4) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) close(r0) socket$packet(0x11, 0x2, 0x300) ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000080)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r1, 0x8b21, &(0x7f0000000040)) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000011401e827bd7000fedbdf25080001"], 0x18}, 0x1, 0x0, 0x0, 0x40001}, 0x10) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r3, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x7c, 0x20203843, 0x2, [0x2], [0x800]}) mount(&(0x7f0000000140)=@filename='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='rootfs\x00', 0xc00c0, 0x0) 1m13.067869187s ago: executing program 9 (id=9242): syz_clone3(&(0x7f0000000740)={0x1c021a480, &(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440), {0x17}, &(0x7f0000000580)=""/249, 0xf9, &(0x7f0000000680)=""/146, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) prlimit64(r0, 0xb, &(0x7f0000000500)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) clock_getres(0x7, &(0x7f0000000240)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$sock_int(r3, 0x1, 0x2f, &(0x7f0000000280)=0xc9b, 0x4) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = accept$inet6(r4, &(0x7f0000000300)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000380)=0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f00000000c0)={@ipv4={'\x00', '\xff\xff', @local}, 0x20800, 0x0, 0x1, 0x1, 0x0, 0x6}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000080)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x10000, 0x2, 0x1, 0x5, 0x0, 0x3}, 0x20) socket$l2tp6(0xa, 0x2, 0x73) r6 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000200)='blacklist\x00', &(0x7f0000000000)=@secondary) r7 = socket$l2tp6(0xa, 0x2, 0x73) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFCONF(r8, 0x8912, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r9, 0x0, 0x483, 0x0, &(0x7f0000000880)) bind$l2tp6(r7, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) mount(&(0x7f0000000480)=@sg0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000140)='cramfs\x00', 0x2808005, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r10, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0xc000) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) 1m12.048760564s ago: executing program 9 (id=9247): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="2001000010003b620000000000000000fe8000000000000000000000000000bbac1414bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000002b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000108001d000000000008001e000000000014000e"], 0x120}}, 0x0) 1m11.868989536s ago: executing program 9 (id=9249): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r1 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) lsetxattr$security_capability(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100), &(0x7f0000000600)=@v3={0x3000000, [{0x4, 0x3}, {0xffff, 0xc4}]}, 0x18, 0x0) lsetxattr$security_ima(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080), &(0x7f0000000480)=ANY=[], 0xc, 0x1) chdir(&(0x7f0000000140)='./bus\x00') r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) splice(r1, &(0x7f0000000180)=0x8, r2, &(0x7f0000000200)=0x1b, 0x100000001, 0x8) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) (async) lsetxattr$security_capability(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100), &(0x7f0000000600)=@v3={0x3000000, [{0x4, 0x3}, {0xffff, 0xc4}]}, 0x18, 0x0) (async) lsetxattr$security_ima(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080), &(0x7f0000000480)=ANY=[], 0xc, 0x1) (async) chdir(&(0x7f0000000140)='./bus\x00') (async) creat(&(0x7f0000000140)='./file0\x00', 0x0) (async) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) (async) sendfile(r0, r0, 0x0, 0x7ffff000) (async) splice(r1, &(0x7f0000000180)=0x8, r2, &(0x7f0000000200)=0x1b, 0x100000001, 0x8) (async) 1m11.668001894s ago: executing program 9 (id=9251): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x419, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e3210500000057e7e30c63"], 0x0}, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_FRAME(r1, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) 1m11.391883888s ago: executing program 9 (id=9252): r0 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) (async) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write(r1, &(0x7f0000001280)='\f', 0x1) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, &(0x7f0000000000)={{@my=0x0, 0x1}, 0x1000, 0x9}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, &(0x7f0000000000)={{@my=0x0, 0x1}, 0x1000, 0x9}) 1m11.154672168s ago: executing program 38 (id=9252): r0 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x808000, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) (async) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write(r1, &(0x7f0000001280)='\f', 0x1) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, &(0x7f0000000000)={{@my=0x0, 0x1}, 0x1000, 0x9}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, &(0x7f0000000000)={{@my=0x0, 0x1}, 0x1000, 0x9}) 9.352072599s ago: executing program 4 (id=9694): syz_usb_connect(0x0, 0x24, &(0x7f0000001f40)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001f40)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x107, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000ffa6e828b56e5b861c980999e42e593f499391fa75e42583d938d3e970c6c43f81c9041c34185ce096c9615d7a1ebcf2d0ee4d1c34eebafd2e4493166de3a61630ed84fdda0a0543a9b17a3dcd5b7a6b7ff3942483be36a46fc781c697614fc7700bc39cc0485777b28c714cb7a53fc6168a48210098010909860950950f1a0cb748715084a4c241d963f29db0c661055041f77e829c0a9c6c4f4f612e7254c7c63ea25ef161b1c5cef00bc7ff1104b85f81353c5085e22d9da4474b925e2e947e300ac70f52806dfe8170a395092d2c37523c1d65e510d13b25c7e4019ec341ce92c092167ace2a8d268214cd43749a4ce4fcb7781a622e8d0b2f10405e2bf38c43"]) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000440)={0x1c, &(0x7f0000000380)={0x60, 0x17, 0x1, "d6"}, 0x0, 0x0}) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x1200051, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x1200051, 0x0) 7.416108087s ago: executing program 2 (id=9700): mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x200000, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x20000}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(r1, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x4000005) lgetxattr(&(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)=@known='security.apparmor\x00', &(0x7f0000000100)=""/130, 0x82) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000300)=0x7fff, 0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x7}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffe, 0x1d, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000180)="b6881affa01a", 0x0, 0x0, 0x12, 0x0, 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_usb_connect(0x1, 0x521, &(0x7f0000000580)={{0x12, 0x1, 0x250, 0x4b, 0x71, 0x79, 0x40, 0x19d2, 0xffee, 0xd21e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x50f, 0x3, 0xff, 0x4, 0x10, 0x83, [{{0x9, 0x4, 0x13, 0x1, 0x5, 0xff, 0xff, 0xff, 0xb, [], [{{0x9, 0x5, 0x3, 0x0, 0x400, 0x7d, 0xa, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0xff, 0xb68}]}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x7, 0xf, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x7f, 0x4}, @generic={0x27, 0xa, "a010844ae10bbaa6d06936779db1c621fbf5f952ce5e2f362cf9ae1830592518659c432183"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x7, 0x3, 0x7, [@generic={0x24, 0x22, "9f8590cbf7b3f0cded8f4ac87125e8c09454db1a186e289b8a917c026c6c4a54fcb5"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x5, 0x1}]}}, {{0x9, 0x5, 0x7, 0x0, 0x20, 0x6, 0x80}}, {{0x9, 0x5, 0x2, 0x0, 0x3ff, 0x6, 0x8, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x5, 0xff0c}, @generic={0x1f, 0x10, "1d76bcd250c482ea5c40cd068d19ca8bfb3746729644bf64e442128da5"}]}}]}}, {{0x9, 0x4, 0xeb, 0x4, 0x0, 0xff, 0xff, 0xff, 0x5}}, {{0x9, 0x4, 0x44, 0x1, 0x10, 0x2e, 0x5d, 0xbb, 0x4, [@cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "a6633a72a8f5"}, {0x5, 0x24, 0x0, 0x40}, {0xd, 0x24, 0xf, 0x1, 0x7d80, 0x1, 0x3, 0x6}, {0x6, 0x24, 0x1a, 0x9, 0x4}}, @hid_hid={0x9, 0x21, 0x7, 0x1, 0x1, {0x22, 0xe67}}], [{{0x9, 0x5, 0xf, 0x0, 0x8, 0x1, 0x2, 0xd6, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x24, 0x3ff}]}}, {{0x9, 0x5, 0x8, 0x1, 0x400, 0x9, 0x7, 0x7}}, {{0x9, 0x5, 0x6, 0x0, 0x0, 0x6, 0x86, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x8}, @generic={0x8d, 0x24, "2589f391bd56824551c2b20e0a78233dbcd364eac919d2312efbe60bdd305376e29de27eecc676e7e2e41abd5351633ec6a54ecbabee574a2d6bcdcd32d026a4c3fce6e57a6a4f098cd45aedc6dbf4f54023e1883b8cc4947838fef7bdeeaa3501f2c142b32f8e30ffef0e1c18e795d3c0b1ec5994586b0612230994a665db93f475ed6489bb5945e57e2d"}]}}, {{0x9, 0x5, 0x9, 0x4, 0x400, 0xf9, 0x0, 0x2}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0x0, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x35, 0x4}]}}, {{0x9, 0x5, 0xc, 0x8, 0x200, 0xf3, 0x50, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0xf8, 0x2}]}}, {{0x9, 0x5, 0xd, 0x1, 0x40, 0x4, 0x9, 0x1}}, {{0x9, 0x5, 0x3, 0x0, 0x400, 0x5, 0x4, 0xff, [@generic={0x2f, 0x0, "b7906924e79a12629672578a908aa388f07af5cfb33b2108b54a0e8d3f47286eb7e71b5b392c86c9e94a275c3e"}, @uac_iso={0x7, 0x25, 0x1, 0x5, 0x6}]}}, {{0x9, 0x5, 0xb, 0x10, 0x40, 0xa9, 0x7, 0x6}}, {{0x9, 0x5, 0x2, 0xc, 0x3ff, 0x1, 0x0, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x102, 0x0, 0x9}]}}, {{0x9, 0x5, 0x3, 0x8, 0x40, 0x3, 0xe4, 0x7, [@generic={0x75, 0x9, "f6c7693cba71440528a2c320acfa516dd8cb74f577bc2e5e4c4251e61ce588df7c56a958acc7c6b42f5851e92828413c30a02e3c232e9979a14d02ce9f6199f0eed54d59107b995d11707ab8901357ad464cd076d5106ea357e00cca7e2c20e9c4bac85630f1549b684c19e0a7eed5e71a3532"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x400, 0x7, 0x4, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x40, 0xe4, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x86, 0x6, 0x10}]}}, {{0x9, 0x5, 0x5, 0x0, 0x0, 0x1, 0xe, 0x4}}, {{0x9, 0x5, 0x8, 0x0, 0x40, 0x40, 0xb0, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x5, 0x8}]}}, {{0x9, 0x5, 0x1, 0x10, 0x10, 0xd, 0x3, 0x2, [@generic={0xf1, 0x2, "c39ed4e3e43dca9f94eb515a2d713e2e81ef0d11292134b228159e6106eb742f5505092846ddb0d8ecb8eb4d5b54bd8efbb4d2ef57e1582a7c8725a9f028dd479f5131cf6d0900591fefce481351e65768bfc458692f2a7425ca52280c657fcba429ebe930d039b6796ed445c3c8aa2400ef9f8e1c0b2ce54055d14a3bafdcde17683c1287a183b8e2e4c0d54ed8e9023bed41b04a9dabebbed0d787052a2af4335059aac96fa14732ef3eeb197b8cb3824f40a139e7be447d659b8760512a36f39b3755b938e546cd6d18a3933283b9b1298181e4938527d7a49d9730db5de4ac6fd29afc9b3af4ab3f0db80eb227"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x33, 0x40, 0x0, [@generic={0x5e, 0x21, "309c4484b3703ad000ace51598d32449584acc9b6639dacad9bf0d013de107217afea0020c0e242e0ad16941dd9c0b515d2b9c1fa70c59d4d80ed119691a78407f6ef29ca279fa6cf29ce774ead7453d0d1d69e5c9878696440bb91f"}, @generic={0xb6, 0x30, "3fdd0d5a7a9ec3efe894e9bab7f5be0d60c84e8c6eb2f22a84c3f94d9a3f5796f5b50a4d4986d62f8f99295740c047c7232cb451b0f037bbd6f94be453392def7fea35dda0a300cb24f1c285c8c3dda43244628c7f42aef4590433bdfa69208bfe6ecc763428a44b4614bcefd920e693820c5ee7f215afbc09e15ec7d473a686b1a9cd72b5fcf899c7d1ad8fa701b29ac09f8164fa827b540db9fc2347920bf6e4a1b6036176725a147dac39704c2e699ed55640"}]}}]}}]}}]}}, &(0x7f0000000cc0)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x0, 0x7, 0x7, 0x80, 0x40, 0x7}, 0x5, &(0x7f0000000480)={0x5, 0xf, 0x5}, 0x7, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x459}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x444}}, {0xa7, &(0x7f0000000b40)=@string={0xa7, 0x3, "373f9d97f19d25f74bf62e4f11331b1940406f182b96f8a7d6f3817de348bcaa0fd61638dc4f73365fdad07124152b1c084857f015a5d8955cd7bc87f759edb0a9ef713c49f7067abc56b6877a2337ce840967a5f9580923636baaf024e06114e4ce0a8a729934d6bbf18ad3716c70d0820aa343e0528d4b82018e4e8202fda023bd917e40dd356ff840d9b13c32b7719ee247cee4980b5dcf77854d4921ed30e0e971de3d"}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x1004}}, {0x4, &(0x7f0000000c40)=@lang_id={0x4, 0x3, 0x1407}}, {0x4, &(0x7f0000000c80)=@lang_id={0x4, 0x3, 0x425}}]}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x40, r4, 0xd80, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0xd, 0x42}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x1df}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004801}, 0x4040000) 6.340634898s ago: executing program 4 (id=9707): mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x1200051, 0x0) 6.183252161s ago: executing program 4 (id=9708): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x48, 0x5, r0}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003400200000300000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x20000080) creat(&(0x7f0000001380)='./file0\x00', 0x4) syz_usb_connect$cdc_ecm(0x3, 0x56, &(0x7f0000000300)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x3, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x16, 0x2, 0x2, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x0, 0x9}}, {[{{0x9, 0x5, 0x81, 0x3, 0x0, 0x2}}], {{0x9, 0x5, 0x82, 0x2, 0x200, 0xbc, 0xff, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x240}}}}}]}}]}}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x2000, @none}, 0xe) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0) 4.360279608s ago: executing program 2 (id=9710): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r0, &(0x7f0000000000)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0302}}}, 0x14) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r1, 0x45809000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) open_by_handle_at(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="0300000001000000"], 0x8400) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x21, &(0x7f0000000000)=0xffffffff, 0x4) getsockopt$WPAN_SECURITY_LEVEL(r3, 0x0, 0x2, 0x0, &(0x7f0000000240)) 3.751601235s ago: executing program 8 (id=9711): syz_usb_connect(0x1, 0x46f, &(0x7f0000000440)={{0x12, 0x1, 0x300, 0xda, 0x8f, 0xbc, 0x40, 0x2cb7, 0x10a, 0x56b0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45d, 0x4, 0xe2, 0x9, 0x80, 0x2, [{{0x9, 0x4, 0x96, 0x40, 0x2, 0xff, 0xcc, 0x50, 0x4, [], [{{0x9, 0x5, 0x3, 0x4, 0x200, 0x8, 0x17, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x3ff, 0x1, 0x5, 0x9, [@generic={0x29, 0x2, "e6d05601beac4acf525e46b568d870f73f52d7a7f1d85d99d631f6fe233c573d13a361151f707c"}, @generic={0xa, 0x21, "081b96914739cbdb"}]}}]}}, {{0x9, 0x4, 0x1f, 0x5, 0x0, 0xcf, 0x1d, 0xac, 0x2, [@hid_hid={0x9, 0x21, 0x2, 0x1, 0x1, {0x22, 0x4a8}}, @generic={0x7b, 0x0, "4a9f39632d5f940e5b865cc109958557dba0d43d10e4b8f2ef5c8fcf4b1eae7743ba9396dc3c0c8bea326f3a72d0bbf316253c5aad8bb02b08a9d9de89f40f4f20d303674700b1c6868c092d9ee8d174fccacc027b52a8c6e122bcdeb4363ed71df247dcc22063d01ccdcbb2ae5af8e0749ae2416bfa5e6f33"}]}}, {{0x9, 0x4, 0x7c, 0x9, 0x2, 0x3f, 0x12, 0xea, 0x7, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "e54e423e1693"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0xfffffffd, 0x2, 0x401, 0x6}}, @uac_control={{0xa, 0x24, 0x1, 0x8000, 0x6}, [@feature_unit={0xd, 0x24, 0x6, 0x5, 0x6, 0x3, [0x2, 0x9, 0x3], 0x6}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x200, 0x4, 0x8, 0x51a2, 0xa9, 0x8}, @selector_unit={0xa, 0x24, 0x5, 0x5, 0xb, "a9d32c7a80"}, @selector_unit={0x6, 0x24, 0x5, 0x2, 0xb3, "af"}]}], [{{0x9, 0x5, 0xb, 0x2, 0x10, 0xf8, 0xe, 0x9f, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x91, 0x8}]}}, {{0x9, 0x5, 0x6, 0xc, 0x200, 0x8, 0x7, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x181, 0x24, 0xfff}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x1, 0x400}]}}]}}, {{0x9, 0x4, 0x98, 0x6, 0xb, 0x48, 0x9d, 0xa, 0xdb, [@uac_as={[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x5, 0x3, 0x0, 0x2, "d0f9b04f"}, @as_header={0x7, 0x24, 0x1, 0x9, 0x6}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x9896, 0x8, 0x21, "d9e2838b76f1bc89"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x7, 0x2, 0x0, 0x9}]}, @uac_as={[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x6, 0x1, 0xa, 0x7c, "e749ae"}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x52, 0x3, 0x1, 0x2, "9b12"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x3, 0x1, 0x96, 0x8, "69a9"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x0, 0x1, 0x65, 0x56, "", "78cb"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x40, 0x4, 0x6, 0x2, "d0aec3", "875219"}, @as_header={0x7, 0x24, 0x1, 0x4, 0x6, 0x1}]}], [{{0x9, 0x5, 0x80, 0x10, 0x20, 0x1, 0x4, 0xee}}, {{0x9, 0x5, 0xe, 0x0, 0x20, 0x2, 0x6, 0x4}}, {{0x9, 0x5, 0xd, 0x10, 0x200, 0x6, 0x1, 0x1, [@generic={0x3, 0x24, "cd"}]}}, {{0x9, 0x5, 0x6, 0x15, 0x10, 0x71, 0x4, 0x21, [@generic={0x5e, 0x21, "ec734e57cb84502bcf21e39769263baf59476af931c1318b0fd00b4fb0b8213de0fd9a10939ff03b8f04b14882ac98e78bb2470f0088202fe356dc1be836252e890ac646c53e2ea145e1259f9096ed0a5eb56899f9db5c2e1d93a1e4"}]}}, {{0x9, 0x5, 0x8, 0x8, 0x8, 0x10, 0x8, 0x4d, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1c, 0x2}]}}, {{0x9, 0x5, 0x3, 0x0, 0x200, 0x1b, 0x7, 0xb}}, {{0x9, 0x5, 0x9, 0x8, 0x0, 0x7, 0x8, 0x80}}, {{0x9, 0x5, 0x5, 0xc, 0x400, 0x10, 0x1c, 0x8}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x21, 0x5, 0x63, [@generic={0x82, 0xf, "3966696be7b1b1eaeb64e00aa2ebd29ecca2e3a43a2b16ef03eb171ea527a736cf44d891cf4bc219945d22cb0ca39e08b06e1ce7f16a7ec2cdf45111049f00b78ad6d2e3761a306b8201c953d12d5b6e0c1a4f7ffaa696091f87653036544e2b54b7e6ff3c0dcd97d1019a1728b5cb629d9172829bd5a94d318642a8959f6d4a"}, @generic={0x68, 0xf, "fd96eb02a628276144d4787b668b5fe41435c321a87583b483e854002bce96bcf63d49d5d57a0a7d06c47b9c730dcd73867eed280f41d4614fc6a70ee81b230151c7e0b41bb2388904f81e1e29d15508cb7e2c2e0d133f70a5d0e69ef4737d14098b8e414dd6"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x40, 0xa, 0x2}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x7, 0x8, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0xfc, 0x49f0}, @generic={0xcb, 0x5, "09a4aa596f993178bb61e2b48169e024a33fa9516b3dee0efd56de83abef19b6b76ff0e27d644fb374e6ca551829b5cdf62f2421eefb91a1cc32b763c17439e31f90a15efe3967266d9297ac8fed576c94c36a525d36fa264b03b557595aac76cf21d7550c495fffe90d7ba0e68a69a98b5637526869d80089e4c9f3a71a970d15cedacf9c9ec9c5628c499f5cd6e91d5eaa73c3383a0c458d0d2ca2829e6da42ac36a8c54ea654df747f29c297aee174ecdab746da6e0c771a286260d3169df4e60c6c32ab1485664"}]}}]}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x251, 0x7, 0xc, 0x3, 0x8, 0x6}, 0x19, &(0x7f0000000300)=ANY=[@ANYBLOB="050f190001141004109bf204cdd614178ab433938c05b61518a2684c6cdf0f086e4ea1f873c132e6712b6123a3257febada4430e1593f381b8e8cc777008978b000efe720ef5b2be1d187664200fc7f9d416ca3d07ff4b760a9116aabcf616eaee6ef137286452ef21b8b046151c640692c696254aac3350ae5cbf6d6df6537f"], 0x3, [{0x52, &(0x7f0000000100)=@string={0x52, 0x3, "c7bff7acffbdb32421e283422e343195415eb5c33df85008b2dcfb6f5935e89497adcc421475cafd5bed627a33dbff572ca4379d17e5e949896d7e5b6a44a27fec1dcb076a720b809f9cf54c1e50bd64"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x827}}]}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'ip6tnl0\x00', 0x0, 0x4, 0x5, 0xd4, 0x3, 0x40, @empty, @mcast1, 0x700, 0x7, 0x9, 0x6}}) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200005400700027c035c0461c1d67f7134cf6efb8000a007a290457f0189b3161efc0f27693c855100ec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c1a87718eb141a4583f5aeb4edbb57a5025cccac000360db77f002f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd48fd6e4edef3d93452492954b43370e9703920723f9a941000000", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) (async) madvise(&(0x7f00008d7000/0x1000)=nil, 0x1000, 0x4) readv(r2, &(0x7f0000000040)=[{&(0x7f0000000180)=""/73, 0x49}], 0x1) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000008c0), 0x200800, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r6, 0x3ba0, &(0x7f0000000a00)={0x48, 0x4, 0x0, 0x0, 0xd6, &(0x7f0000000900)="21f540cc8f000196c12884ad99a8bdf923ca6c4bd3df8a04da902e7e9fda058a1cbd201399df3900d49cda3f6a544da94a071932a3cbe2d490f3ea12fdaf3e62b3224b529a68c36de8af6cd39c296f4113d6d86baef11b63b3a40d1bc1d7280a3e52a0694373b4aed2e5bfc9e47260cd12addc82c440a278296f07585b1d98594b9c90fd8298750c8f58eb37890c01bdae8b8fcdb6a7470ca66051639a47116acc9cdb7cc2ea285849d33f6223f7e08a9eb91b3555813710e17c37e5b5e4d452df40076f865bba82c344cd04681c4b58de9c2ffcbd85", 0x5}) (async) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) (async) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f00000005c0)={{0x3000, 0xd000, 0x9, 0x7, 0xe, 0x40, 0x9, 0x80, 0x0, 0x4, 0xb8, 0x9}, {0x8080000, 0x4, 0x4, 0xeb, 0xed, 0x1, 0x1, 0x8, 0x2c, 0x5, 0x2, 0x8}, {0x1, 0x2, 0x4, 0xb, 0x7, 0x40, 0x1, 0x0, 0x9, 0x4, 0xc, 0xc5}, {0x100000, 0x2000, 0x1, 0x9, 0xb5, 0x8, 0x4, 0x6, 0xa6, 0x8, 0x8, 0xb}, {0xdddd1000, 0xffff1000, 0xb, 0xc, 0xd0, 0xc, 0x3, 0xc, 0x4, 0x6, 0x10, 0x2b}, {0x0, 0x8000000, 0xd, 0x81, 0x6, 0xfb, 0x7, 0x5, 0x2, 0x67, 0x7}, {0x8000000, 0x1000, 0x3, 0x8, 0x5, 0x3, 0x23, 0x0, 0xd, 0x8, 0x38}, {0x4, 0xeeee8000, 0x4, 0xc, 0x4, 0xb2, 0xbc, 0x80, 0x4, 0x9, 0x6, 0xb}, {0x102001, 0xa1b}, {0x6000, 0x7}, 0x0, 0x0, 0xeeee8000, 0x80, 0xc, 0x4000, 0x6000, [0x9, 0x81, 0x8, 0x8]}) (async) r11 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x4, 0x804, 0x7, 0xf, 0x120000, 0x5, 0x0, 0x8, 0x8000000000000001, 0x2, 0x0, 0x101, 0x3, 0x1], 0x8000000, 0x141200}) ioctl$KVM_RUN(r11, 0xae80, 0x0) (async) r12 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r13) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000400)='cramfs\x00', 0xc400, 0x0) 3.672676741s ago: executing program 0 (id=9713): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x220841, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async, rerun: 64) r2 = userfaultfd(0x80001) (rerun: 64) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x7c8}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0x0, 0x0) (async, rerun: 64) close_range(r2, 0xffffffffffffffff, 0x0) (async, rerun: 64) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async, rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 64) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000140)={0x10020, 0x3, 0x0, 0x2471}) (async) syz_fuse_handle_req(r3, 0x0, 0x7, 0x0) (async) readlink(0x0, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="20ff04000000f4b361a217"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) pwritev(r0, &(0x7f0000001280), 0x0, 0x0, 0xfffffffe) 3.417681269s ago: executing program 2 (id=9714): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000002"], 0x30}], 0x1, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000040)={0x0, @raw_data="73acf3faaede464344b9e4ad7353388f061732160eef04f07919ef29c9e9f21c39ca482d2bcc76b49ce17d544b8d21792474e7fd3640d9c5e0b63639e828272994de7e38fd0daf5cd95ac98072d63468a8d70c7d77b26501d3f9bc2015280e7ef703a34539d7d5f3ba6246a435a9f7de88fd5cb4703a552a985444579fcb28e567ecd2ffabeb673f3eb960427f44a6b1e896f6cb1a73e6d781f4ea311b6883301ea9377efc44a3d3064e2e48352800"}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x12, r2, 0x0) ioctl$COMEDI_INSN(r2, 0x8028640c, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x4, 0x8, 0x301, 0x0, 0x0, {0x1, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4004054}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="cc010000100001000000000000000000ac1414aa0000000000000000000000000000000000000000000000000000000044030000000300030000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000000000000000000000100000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000002040000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000500000000000000000000000a000100000000000000000008002300f8ffffff4800010073686132353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c0017000400000029bd700029bd700029bd700029bd70000900000009000000000000800800000001000000550003"], 0x1cc}}, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x94040, 0x0) syz_clone(0x2051000, &(0x7f0000000280)="efccc3939b31e70e48b4d79e34363c746b0f0d3c0b6eda507f36f9fac83dcbf3328a53835deb2d0c1b5c18d81123f8bffcf4be46471680c7d8304ce9819be900"/79, 0x4f, &(0x7f0000000300), &(0x7f0000000440), &(0x7f0000000340)="a28f1bf2f01297b254d5521c9c0b4bc34a862fe381b6f534aa0e75b15cc157a94089a1897555b65d21976ff9a1ff") ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f00000003c0)={0x0, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000400)={r5, 0x31}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r4, 0x45809000) r6 = socket$kcm(0x10, 0x2, 0x4) close(r6) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x3, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac0080002000f000c00040005c00364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r7, &(0x7f0000000380)="e4c8cdd80303d231", 0x8, 0x24020804, &(0x7f0000000140)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10) 3.332060301s ago: executing program 2 (id=9715): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x13, r0, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='gfs2\x00', 0x200000, 0x0) 3.331565789s ago: executing program 2 (id=9716): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) r2 = add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000480)={0x0, "d53c0eb582cba9f1bc16e9ca85647283ccf9e9b7cfa617c953f8334fb77453e9d63eafb578307ceb8c0de24e1a2799fbe25a20bdffddd2b9708a52e314708472", 0x3d}, 0x48, r1) keyctl$KEYCTL_WATCH_KEY(0x20, r2, 0xffffffffffffffff, 0xfffffffffffffffe) socketpair(0x26, 0x80000, 0x5, &(0x7f0000000600)) r3 = socket(0x10, 0x3, 0x0) fsopen(0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010a"], 0x14}}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') ioctl$NS_GET_USERNS(r6, 0xb701, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x18, 0x41, 0x107, 0x0, 0x25dfdbfc, {0x1, 0x7c}, [@nested={0x4, 0x31}]}, 0x18}}, 0x4010) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) splice(r8, 0x0, r5, 0x0, 0x8002, 0x0) dup(0xffffffffffffffff) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100006e40b740e1092151c1400102030109021200010000800000000000003cac2400"], 0x0) r10 = socket$inet(0x2, 0x800, 0x4) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, 0x0, 0x0) r11 = shmget$private(0x0, 0x3000, 0x200, &(0x7f00001d7000/0x3000)=nil) shmat(r11, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) shmctl$IPC_INFO(r11, 0x3, &(0x7f0000001180)=""/4096) clock_gettime(0x0, 0x0) recvmmsg(r4, 0x0, 0x0, 0x52418e567e5a9d8b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000005, 0x22052, r0, 0xc3cf5000) syz_usb_control_io$printer(r9, 0x0, 0x0) 3.137090949s ago: executing program 4 (id=9717): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x419, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e3210500000057e7e30c63"], 0x0}, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5c300000000fb04003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001"], 0x448}}, 0x0) socket$packet(0x11, 0x2, 0x300) 2.805326651s ago: executing program 0 (id=9718): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x20004000) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xe}]}}}]}]}], {0x14}}, 0xa8}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='gfs2\x00', 0x200000, 0x0) (async) rename(&(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000280)='./cgroup\x00') mount$bind(&(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x0, 0x0) 2.696012173s ago: executing program 0 (id=9719): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r1 = syz_open_dev$usbmon(&(0x7f00000002c0), 0x13dd, 0xc01) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000240), 0x8080, &(0x7f0000002440)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@loopback, 0xf, 0x0, 0x2, 0x7, 0x6, 0x4}, 0x20) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) 2.64328475s ago: executing program 0 (id=9720): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20041, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, 0x0, 0xfffffffffffffd69}], 0x1, 0x6fcef00345e8684, 0x0, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000000)) 2.477980249s ago: executing program 0 (id=9721): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x401, 0x46}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x38}}, 0x1) r2 = creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='qnx4\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000140)=0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000180)=0x9) 2.387979345s ago: executing program 0 (id=9722): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000000), &(0x7f0000000040)=0x8) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r2 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) r3 = add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000480)={0x0, "d53c0eb582cba9f1bc16e9ca85647283ccf9e9b7cfa617c953f8334fb77453e9d63eafb578307ceb8c0de24e1a2799fbe25a20bdffddd2b9708a52e314708472", 0x3d}, 0x48, r2) keyctl$KEYCTL_WATCH_KEY(0x20, r3, 0xffffffffffffffff, 0xfffffffffffffffe) socketpair(0x26, 0x80000, 0x5, &(0x7f0000000600)) r4 = socket(0x10, 0x3, 0x0) fsopen(0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010a"], 0x14}}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) splice(r4, 0x0, r6, 0x0, 0x8002, 0x0) dup(0xffffffffffffffff) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100006e40b740e1092151c1400102030109021200010000800000000000003cac2400"], 0x0) r8 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmat(r8, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) shmctl$IPC_INFO(r8, 0x3, &(0x7f0000001180)=""/4096) clock_gettime(0x0, 0x0) recvmmsg(r5, 0x0, 0x0, 0x52418e567e5a9d8b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_usb_control_io$printer(r7, 0x0, 0x0) 689.577823ms ago: executing program 8 (id=9723): syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0x608440) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) read$FUSE(r0, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x200002, 0x0) 626.596285ms ago: executing program 8 (id=9724): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_buf(r1, 0x29, 0xcd, &(0x7f0000000080)="d97f7eb3dc786866e033d5344736475e64a4acd2d52608e8a5f73e17b8ec101fd7c9a5469a85531fac9f81843c3da37d52ab27a037c565956caad531ae9ba126391827271550ce4b27db8fb602e8c95ac146539f056b16c8dcb17facb5", 0x5d) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000007c0), 0x101000, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xc) ioctl$KVM_CAP_DISABLE_QUIRKS(r0, 0x4068aea3, &(0x7f0000000100)) r3 = syz_open_dev$swradio(&(0x7f0000000440), 0x0, 0x2) ioctl$VIDIOC_G_FMT(r3, 0xc0d05604, &(0x7f0000000980)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000000040), &(0x7f0000000180)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x80000000}, &(0x7f0000000080)=0xc) mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0) 527.999692ms ago: executing program 8 (id=9725): mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='qnx4\x00', 0x0, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x4300) ioctl$NBD_CLEAR_SOCK(r0, 0xab04) 527.783496ms ago: executing program 8 (id=9726): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='minix\x00', 0x1808440, 0x0) 486.19678ms ago: executing program 8 (id=9727): r0 = socket(0x10, 0x3, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) close(r1) socket$kcm(0x10, 0x400000002, 0x0) setxattr$incfs_metadata(0x0, &(0x7f00000000c0), 0x0, 0x0, 0x2) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x59}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d480004fbffffffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae24f89a565ee52dcd729cd39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc36024aa400", 0x57}], 0x2}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001a80)={'ip6gre0\x00', &(0x7f0000001880)={'syztnl2\x00', 0x0, 0x2f, 0x3, 0xdf, 0x4, 0x24, @ipv4={'\x00', '\xff\xff', @loopback}, @private2, 0x10, 0x8000, 0x3, 0xa}}) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) syz_io_uring_setup(0x4168, &(0x7f00000000c0)={0x0, 0x321a, 0x0, 0x3, 0x186}, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) mount(&(0x7f0000000080)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x1000, 0x800, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_GETNEXTQUOTA(0xffffffff80000901, &(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, r2, &(0x7f0000000280)) 288.441132ms ago: executing program 2 (id=9728): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) fadvise64(r0, 0x65f, 0x2, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45819000) r1 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x4, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @private0, 0x1000}, 0x1c) syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) r3 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_ifreq(r3, 0x891a, &(0x7f0000000040)={'veth1_to_batadv\x00', @ifru_flags=0x200}) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRESHEX=0x0, @ANYRES64=r2], 0x0) lseek(0xffffffffffffffff, 0x258, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) 47.747023ms ago: executing program 4 (id=9729): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x4) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = socket$igmp6(0xa, 0x3, 0x2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) recvmsg$inet_nvme(r3, &(0x7f00000024c0)={0x0, 0x0, &(0x7f0000002340)=[{&(0x7f0000000080)=""/56, 0x38}, {&(0x7f00000000c0)=""/182, 0xb6}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/168, 0xa8}, {&(0x7f0000002240)=""/248, 0xf8}], 0x6, &(0x7f00000023c0)=""/225, 0xe1}, 0x10000) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000002500)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000002600)=0xe8) ioctl$TUNSETOWNER(r2, 0x400454cc, r4) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000002640)={'caif0\x00', 0x4000}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000002680), 0x400080, 0x0) ioctl$TUNDETACHFILTER(r5, 0x401054d6, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000026c0)={[0x4, 0x8fe4, 0x6, 0x8, 0x5a8, 0x4, 0x7fff, 0x40, 0xdcc8, 0x9, 0x2, 0x0, 0xfffffffeffffffff, 0xffffffff00000000, 0x1, 0x4], 0x10000, 0x200000}) openat$tun(0xffffffffffffff9c, &(0x7f0000002780), 0x40000, 0x0) r6 = accept(r3, &(0x7f00000027c0)=@sco, &(0x7f0000002840)=0x80) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000002880), 0x400000, 0x0) ioctl$IOCTL_START_ACCEL_DEV(r7, 0x40096102, &(0x7f0000002c00)={{&(0x7f0000002b80)={'KERNEL\x00', {&(0x7f00000028c0)=@adf_str={@normal='NumberCyInstances\x00', {"9fc44d3853cef17f72b0eb49097997280894d9ef096dc11663cee3354d447afb6180a380971be973313c344de8961b29c7abc288c545a182f6cbe2ee0f2fcea4"}}}, {&(0x7f0000002b00)={'GENERAL\x00', {&(0x7f0000002a40)=@adf_hex={@normal='NumberDcInstances\x00', {0x4}, {&(0x7f0000002980)=@adf_str={@bank={'Bank', '3', 'InterruptCoalescingTimerNs\x00'}, {"1843452d8d0cb5fbfc8535e02940f8b96ce6cbddcdfac1332c84e990ca86852f92bc41ede0306c3ad8536cff00d45d1814a134384994905ae0993d8fd34ce59f"}}}}}}}}}, 0x3}) ioctl$TUNSETPERSIST(r5, 0x400454cb, 0x0) shutdown(r6, 0x0) syz_emit_vhci(&(0x7f0000002c40)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x1000}, "135947b22bba2e9dc6c2e9ae83bcd2c2615d0fff95302c2511f6c3f66809f3a25c938af2395ef465b9149d203eab2b85032e9a24f439c7401c11ee2084f573f1f46afa0e0a8dc809cd0c33266e404cfbd18a896da19dc57d15b62793db935b34fab4cc9f2559e60db69b89d6845b866e612ad6921c4e59622c203067951ced35a9ca112a4cb241984dab4534ae3cd3e7dbf4548e4bf5016b51b77ac625e1c05e2110b1487cb92e4386f9aa8892c656dde86d4564f6e720ae101abc5bbed64c1dd9b32c0061e4837015c266118c7ceacb5ee1395734b1a7f88cfcee9b86be7adf83b332f8cac74c38d554ff7825f66b1011e349050b530f9b4b3e8384cc55df7083ae4b6bf6f69173e837723b204d406b12611af16db0b8bcbce2c296e56111ae3f3c14427ddf30941f1087ce47ee3b1fdb7b78b2ce49620c12017e9c859be8bc731853cceda81dc402baa2860e5c1961e6fa73eb72baf6c961bd22de4a5e293890f0202e47d41906d5c97a0df536b144ad6967d8ab1df2d517fe3029d5b484f4201a09a2ae17b89e000d6d057741556647c3a0a714117e1c8fb84a0982e790a1d85b66057994fe7a0279bf0f9f15eb2d2037737f2cb10772be815a2b2c125e71c65b9f829943cfb7ca3ae2671d479b92be5ca9f7e350f3b33eba12b5795c42f7fa835b87b3775cd0ea6ff01408bc30a7869cf7772557d30134d2da34594f3763ca7dc915e3d84dd0cf77c36c1497dc659f156b8c58d626fdaec08bdf3b20219d8326024e2ab64548169c7cff25b9aef64dd1478836d46c739ae49e31d4aef526b7a940ace6a4b0b52a11b89249990cb60484e06dce0622bc1fd7e875a27bc22cba2dac9fa5a158bd8b4b6ba69b1c218a969ff0b65e74f92afd98bfe217e8d90ed7385ba1379f83ace9b41e6ed400398822bb3efddb7558d5afee2df2fbeb3349d142d2ab34dc1a4c29c2deb84acee2612c62c808a23e121331290d9aa3fa49e5e2ecd799d913bfbe0d4758df86b281bf9b9deebcd0f3a5fcd8faa178830a7c445cd087f5aa25e8405e83eec0f24d431eec4f11a67cb5e3ad87653516f5c81a51b837e57331539a59fade5a6dfbaf2c1fd110e2bffc03865deb8bd3814261b4b618cb16cc71dc463cbf15d1185b25ec807fbd7e3700d1aed145053803bda09832aa7fca114f820d42c8995dc32840be060900af4bfff640fcf3ad9585e8290990654fefd6645f7a0af4911309c2e2e7d58dd51f194f5e5d14a04de15007acca60c7aae16d958f08193a856707d05208b48a50ea2aea99ab95ad6850a30abdbcaca076872ca6f93a5a9052753c4e144d1943442d45662ba57c094ca12817730672524d9010ddbc45e7ddab3702d0553ff74e49c582b6cce8d6bc3e702e930aa6a2daa43f9cd38991a609460019bad971c408fd779b07294277f9a98d70a882ee1c7952548b3a7a2fe5274674d52be0f63b892cb7112539c659db550a86805920f37b70927b03ccbb5098cdf3f0c8def37312c1c3fa1d649084f7d1ca4b749e1de703da4432af5ca29940351940bfee471ecea1f6f06922834114a3ceb6135fa38984d31592244cc70f74b61aaa1cc48fa8a5d0dc48ac8b5d28ca7f704e29e4806bfc8f2449d094a674b11c4d060ab6a217320e3317420103a3fed9b63bb5c679bf5ecbfcd1ce9b4ed6a666fb993d1773c13180e45532c8b6593279c717b811410847efe3d3e6bee931c774f23d4538fe9d114203ef84d6e642809d8d4eebaa63172faaebfc223978d28adbad452ecd92c95d19a21b122b5f40943738fb05ed224306dba9ac7821756b3ad861d73e8be41a7e425bf7ca4d8e600f34e118cf75c6d82860c59024e5f8d4a0343491390119bc916a2c636ea8c8934b3a4677fb452350439ab76d1f05a5ee07e592bc99b7bc09361580c0e7920a29fe764b0f09da3f0056b4152843037c7e206e10c965407e759966931296abaab29b47385c0bd17aa774bb9d4d24f3c71d3d9c98cc731664ff287ac6241b7e66ec79e91f0aa6a3e84d97fc2082994f44cb3d5b9cde7c74cd82bf0e17fcc70e9742843cece4c346a7d911215748b5add2abeb45828af99fe6cedd6609333143d3897ea8c5fae91098c648f3af987e8cf021c7e7a45ea0f35eed671ad4d696cece263ada7fb802eb7a333fe44548154d86ef93097386105206658734200fd81d9d7eb8dc01784b45fe36670f5238b30f356c0b4636b26d0f6c1422eee37c5c0dbbb4131162c89be0a3f361d00600ed004fd2d94b5300506d0a2b4eba35be96617c9f9794563b3f87d4365c8aa0bb3b17773270734b77f00015c82c0dc63b620a5d57d42bf590238634fae52be296de52fc42808e37013bff448d6937b5bab2b477bfee08e80c6a90fd68da6cac7681bd18a721932adff9eec1b7ee8eec89a51d91586f0b12b03d1ffd5156d5a13b488f1e0bf99ee609a952ef4ca9ed6a04d412d59c2b5c93ab6e790ae25e02b0d9c8d8b884a6cbafd0b08c28cbd57b0af29a8130eefa7e235a2419b2bdb964eba371e5a4758d3674bccf76acabb3233a7810cba7b8695b212c98515b4e556b0806cec14f65f3aa1947b14ae30f786bfed60f9952b5099995215cd1269bbf0eea05b6d5df4590c05690952ea9000c03eb192c4d41e409114759ed72b01006f867aee00bcdb777f96c95c623a25278b7816a08c9778766528c1aecb6d93e29f19eea205adefd8c09bc2e923c43c564128f503fa7e5477cc60532475e50872821a5d5c058a37ea481c581c42799337e5a2c94088ce7161d6da333b938ef186b04b6308d219cb2c67fd578f0bc9496b7e9e738e6f341b95232fbf2da24fa6308473b8ef79b2f1338c32806c1d379325c2526cb582ec5326dc6d6567398d9bfc7f5fea442de4d6d4a975c9fcef19c72cbd060b3b1092728b1791b3703764fbdcd0b6cef25e37692fdebe51acb7e2039b55f9f3a4aa14acd0db9a402574a102b0328047c63ffbb1a9dadf73514bbbf8db693e581d385fb1a201078587c0f61e8e5524c0166b33dd4ee7d9858acf4d8374527083fcb7e8a85937972b8dbc4590a61cbef357a3e3683ce9c05f92a58cbfb2c0c6efbf7dc0ff10feed1580e352fa4956b137c518e79be92d0c7569f518a9e425edf3b363df73b13fbbd0409985ef5be1f1667ab80be578a68e49333ce011b253140183aea7970ddbc10f8ff24b67ac2997fc68ae235c2488a3336f11eb2639bbd02ee436e5b1e1c20cf9397bf3c539e099ba88970d6e6c698a5cf45354fc84db47ea3c2d337bc795c479abfcc42f2486d0ca842cf1521c79782c489f2c3f9ab370f4002fb7fa2ee91975494d6607e3b653968120226f199bd89558f8015e5a60d1a9efd93eeb598c0081b4fc77978f2a237576678fa895094cc48ce28bb150c1fca5dcc0d6ba62f0fa931aa07432ea34d2dd6011ae37e30acc02302bed4d1755fa1fecfccf33f1d63be61ca50f48a0a171224d0d7219fb2657f6786b8353ca8818440c9927283d0da29b4c84f629196aa0cbf4704f46f3580908327acebd6ad408a1f31230724a91683d14a0c0d2a0dc31c617219e8067999eaa23442e91a8d51eabf6e6f2ab2894ebd7b9541a6da844092c246e7edffa0e1a294bb30f2baaecb9ea3347087f35469cb5e08344dbbcd04e40cc55e86fd3c4fd538565462fadc30a5f29b84886853c28a5de88355cb40e7c606dc320fb865179859280e09bda462319197d73494b77013fcee683fdddba5b25c7d4b01384cf460d60cec3945485255e8608da1ab026cccd0be1ee68820790ff04043a06991152975afca40f88e438778784be8f137d4af186e13ead7f979dc05fe8ae690ed1599d21d8adeaa1eef98e6a9ccf142af2bbefb76e8a11b8ff482eaf3066660006932d6a9a187a7b89ee9d73ed28a87e9a7386c4880b64ca19c75045d67a7d6c1ae10ad2a150839377bbe143d820bf7f44bf1f9d864e77f85a0ce3b4de72ebc8350a45dcc1fe0e938647cc9003e2201fb5de5ab2c1926b1d9c5324924f3c7115b39fdff2d095073ed0d1d1ff63fcf63ba4d47d45c0ccf25945cf62fd5d147d1f287f97b7c9ae7f18843d6097437502bd935aa2f186462a7c73f0abb016dbefa2c5c4059323e318d9159487430b4077b95948e1fa24fdf81b254fb98b776ae6843853056c2811792bf2fb911ecbfe68ffb286abe4b10497b5ec7ab9a7a9e3d82aec12a3e9883f991e51418da98ec3f7e51f530e99a9602d04c5546fe5ea45542d77c738d2332fead3a59514ff85eac9670a99adcddecd02bf4e675eaf22150ba34a9cb3a2b1c522cac439b44d051a7c4397f10dbfd1fa0135049a08feb5f21bd5d73b278b10ea18f000ae198cdc06bff97ac056dac2eb077934424c3cef4ae57818ce10d5717f0d3f163e4636c2b177128df0a470b3a345d36096f9039de4549fda4f07c1646275c767f1b649fff84d11faf028fbd22746c311b061df16237f10d7bc9665f0b1f107265e33f2b89601364f7ba488d7ff9fe9276660ed3b6b244ca6acce5740549bbb15747971d40de022bcee219d9184d587a86369643fb784ba6938192cc54ceeddd90584272af33f4f2c2be18a7d860d436987196259a258c73b1cc3dd5d3dc4b22a23da78bff5058aea34d31ab0aba1f26494a929399c83eab9a1e4aa71de55e6e7c5eed36db12878fe3c2394e15f44ba688489aceb7e294d9d3522e65dcc9be02e82f4a5bdca1d1e81b6e29615229308483f5d49e34216b69c982af0e34d669157c1c6295587c97ffb9f8298e0d649170676842cb1301d920398c355c14736bd9f51eac1244d63994ee9ec8e1fdc5adfd44bb694ccdbc0721c30cceaf9d0badd0ade5065b1463324ff326f67f86bcf9d6a5ae0732f39bbc4c61f7e752ddf2e60caf965c4ea31a6c91123e29f1432ade18a8871c686511d18925495eb3c109d69b5090abcd9427518051c29af72efc952ce84b5aaf31a95f50321bf056d866f22e7f0da14b2d15bb2002d16e8db5558e9f1e3bf51d3a6894dddef90fb3c29d7a4fe05b36517928c36615586a5af09944251917d88c735dc149b9215abd47a6d960be62e1870e36338a0abcecc467ac161449e68eeeb11f794e5ba8925b5f00638ad6d2ee334bca911504a6609cdf60ca4f8b670f84e612b041cbf42345e03a10d50cac399372d83b5931148a54fc27c3b47985090c340133ad47664fd6838dc6b7dedc892ab7cd53b32731b9fd5f149ef1f571b3fb0a6ce4bf30007d0e6f5aae5dba091b324a65c39b57a80222863b29f07b40cf3b93ec1711818f556f199fa05d340d261cec3631818bb50781282d3bf1a16d810d048634cc49b722a5173f6ffb0f2777e30f440d570a7ba87050d7f869948de058fd72e026ede74573d77107e6e7b55936fc3d9462c0f7d328001b170085769f31cac4cf56e8a825be28de77d47d5c8988c068508307d2c8331e1cdd71d155887bac9baae5564892c0a1b2cfb951f0728d3f09cd1c9b8d549d167f27add4686687fb8a762b344e4d7e813dcf47ae789eea966ea194030442393a2ce0991da67bf07507b20eab5f79671ebb2aace4c3e1e6ae05ea4f1c70c8a2ffb31149acb27bbd4c23361c36d63feed3c92a1b0d57070b77a16b9db75a8e8b7201ca16c5fdd42f342386fd288c051795f1141f0e28521311cd8005af49705334c69de5189d59f4d8f458f58d5a64a58cd5fee9d7a8c9957037d528f23f37a862101514a9175a6b7fcc906f4ef2cd866337e3a8fff1db83736a03f26516d9889eb589"}, 0x1004) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r6) close(r3) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000003c80)={'geneve1\x00', 0x4000}) close(r0) ioctl$IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS(r7, 0x40096100, &(0x7f0000004000)={{&(0x7f0000003f80)={'Accelerator\x00', {&(0x7f0000003d80)=@adf_str={@bank={'Bank', '2', 'CoreAffinity\x00'}, {"ab41163a90ce08080bb9e0b0bff18c849ea83e17c662e95e8605124858b75bb55ec289e0138c9efcff2d8a27a991bccb9824e11334cf739272b29205275446f8"}, {&(0x7f0000003cc0)=@adf_dec={@bank={'Bank', '2', 'CoreAffinity\x00'}, {0x3}}}}}, {&(0x7f0000003f00)={'Accelerator1\x00', {&(0x7f0000003e40)=@adf_str={@bank={'Bank', '1', 'CoreAffinity\x00'}, {"1e28e23691dba06ec583d7d6c3ff904708707cb711b3e0023e59a68ea418358615457bc76cff20f3e0fa7e7cc2a1c711c12ba77f264757c4ba2bc6f35a8aa3d3"}}}}}}}, 0x8}) socket(0x0, 0x2, 0x8) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000004040), &(0x7f0000004080)=0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000040c0)={0x3, 0x200, 0x1, 'queue0\x00'}) sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000004280)={&(0x7f0000004180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000004240)={&(0x7f0000004200)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000844}, 0x6014) 0s ago: executing program 4 (id=9730): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$netlink(0x10, 0x3, 0x12) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000140)='\x00\xf4\x96\x89a\xdd\xb72\xe7\xaf\"\x85\x97\xd1\xd2', 0x0, r0) socket$unix(0x1, 0x1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r3, 0x5453, 0x7cb7562f2d67) r4 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r4, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x7, 0x2}]}}}], 0x18}, 0x20002800) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000000)=0xffff) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x20, 0x0) kernel console output (not intermixed with test programs): new high-speed USB device number 95 using dummy_hcd [ 1441.769197][T14427] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1441.779654][T14427] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1441.791007][T14427] usb 3-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1441.800306][T14427] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1441.808943][T14427] usb 3-1: Product: syz [ 1441.813202][T14427] usb 3-1: Manufacturer: syz [ 1441.827596][T14427] usb 3-1: SerialNumber: syz [ 1441.828206][ T2880] /dev/rnullb0: Can't lookup blockdev [ 1441.836223][T14427] usb 3-1: config 0 descriptor?? [ 1441.910232][ T2884] /dev/rnullb0: Can't lookup blockdev [ 1442.159470][ T2887] binder: 2886:2887 ioctl c0046209 0 returned -22 [ 1442.169587][ T2887] program syz.4.9022 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1442.367242][T29072] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1442.372648][T21921] Bluetooth: hci0: command 0x0c1a tx timeout [ 1442.515100][ T2893] /dev/rnullb0: Can't lookup blockdev [ 1442.527206][T21921] Bluetooth: hci1: command 0x0c1a tx timeout [ 1442.619573][ T2898] /dev/rnullb0: Can't lookup blockdev [ 1443.184723][ T2902] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9025'. [ 1443.327200][T21921] Bluetooth: hci2: command 0x0c1a tx timeout [ 1443.333329][T29072] Bluetooth: hci4: command 0x0c1a tx timeout [ 1443.333350][T14772] Bluetooth: hci5: command 0x0405 tx timeout [ 1443.346823][ T2893] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1443.353109][ T2893] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1443.359997][ T2893] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1443.366548][ T2893] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1443.375687][ T2893] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1443.640133][ T2914] /dev/rnullb0: Can't lookup blockdev [ 1443.692010][ T2917] /dev/rnullb0: Can't lookup blockdev [ 1443.703643][ T2917] comedi comedi4: bad chanlist[0]=0x032c0000 chan=0 range length=2 [ 1443.723317][ T2912] /dev/rnullb0: Can't lookup blockdev [ 1443.822844][ T2922] MTD: Couldn't look up '/dev/sg0': -15 [ 1443.828827][ T2922] /dev/sg0: Can't lookup blockdev [ 1443.883687][ T2925] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9035'. [ 1444.386771][T14427] usb 3-1: USB disconnect, device number 95 [ 1444.475000][ T2950] ieee802154 phy0 wpan0: encryption failed: -22 [ 1444.494915][ T2952] netlink: 'syz.2.9044': attribute type 4 has an invalid length. [ 1444.506594][ T2952] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.9044'. [ 1444.523724][ T2952] program syz.2.9044 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1444.584118][ T2954] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9045'. [ 1444.607614][T21921] Bluetooth: hci1: command 0x0c1a tx timeout [ 1444.906939][T14427] usb 10-1: new full-speed USB device number 37 using dummy_hcd [ 1445.083397][T14427] usb 10-1: config 0 has an invalid interface number: 144 but max is 0 [ 1445.095306][T14427] usb 10-1: config 0 has no interface number 0 [ 1445.106392][T14427] usb 10-1: New USB device found, idVendor=1a0a, idProduct=0102, bcdDevice=9e.0a [ 1445.117455][T14427] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1445.125665][T14427] usb 10-1: Product: syz [ 1445.130628][T14427] usb 10-1: Manufacturer: syz [ 1445.135420][T14427] usb 10-1: SerialNumber: syz [ 1445.144263][T14427] usb 10-1: config 0 descriptor?? [ 1445.162665][T14427] usb_ehset_test 10-1:0.144: probe with driver usb_ehset_test failed with error -32 [ 1445.417846][T21921] Bluetooth: hci2: command 0x0c1a tx timeout [ 1445.417868][T29072] Bluetooth: hci4: command 0x0c1a tx timeout [ 1445.424928][T21921] Bluetooth: hci0: command 0x0c1a tx timeout [ 1445.431659][T29072] Bluetooth: hci5: command 0x0405 tx timeout [ 1445.438585][T14772] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1445.477418][T14427] usb 10-1: USB disconnect, device number 37 [ 1445.900984][ T2984] /dev/rnullb0: Can't lookup blockdev [ 1446.100862][ T2989] /dev/rnullb0: Can't lookup blockdev [ 1446.321183][ T2993] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9055'. [ 1446.374660][ T2998] netlink: 'syz.8.9057': attribute type 40 has an invalid length. [ 1446.408702][ T2998] syz.8.9057: attempt to access beyond end of device [ 1446.408702][ T2998] nbd8: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1446.521741][ T3000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9058'. [ 1446.854118][ T3013] delete_channel: no stack [ 1446.866941][ T3013] delete_channel: no stack [ 1446.965608][ T3018] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9066'. [ 1447.284706][ T3031] /dev/rnullb0: Can't lookup blockdev [ 1447.320313][ T3030] /dev/rnullb0: Can't lookup blockdev [ 1447.479073][ T3039] /dev/rnullb0: Can't lookup blockdev [ 1447.487119][T14772] Bluetooth: hci0: command 0x0c1a tx timeout [ 1447.556064][ T3043] syzkaller1: entered promiscuous mode [ 1447.562625][ T3043] syzkaller1: entered allmulticast mode [ 1447.632322][ T30] audit: type=1804 audit(2000000104.100:10925): pid=3044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.9074" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1447.766959][T26473] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1447.874750][ T3050] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9076'. [ 1447.888363][T14772] Bluetooth: hci2: command 0x0c1a tx timeout [ 1447.929696][T26473] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1447.942382][T26473] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1447.956948][T26473] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1447.971974][T26473] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1447.987920][T26473] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1447.997333][T26473] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1448.008893][T26473] usb 3-1: config 0 descriptor?? [ 1448.427172][ T980] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 1448.439775][T26473] hid_parser_main: 33 callbacks suppressed [ 1448.439798][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.461375][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.473011][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.480792][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.490232][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.501162][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.511162][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.518713][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.526388][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.534637][T26473] plantronics 0003:047F:FFFF.00B7: unknown main item tag 0x0 [ 1448.550531][T26473] plantronics 0003:047F:FFFF.00B7: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1448.586798][ T980] usb 10-1: device descriptor read/64, error -71 [ 1448.742106][T25146] usb 3-1: USB disconnect, device number 96 [ 1448.827158][ T980] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 1448.962116][ T3062] /dev/rnullb0: Can't lookup blockdev [ 1448.976754][ T980] usb 10-1: device descriptor read/64, error -71 [ 1449.088141][ T980] usb usb10-port1: attempt power cycle [ 1449.436739][ T980] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 1449.457243][ T980] usb 10-1: device descriptor read/8, error -71 [ 1449.609649][T14427] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1449.706772][ T980] usb 10-1: new high-speed USB device number 41 using dummy_hcd [ 1449.727814][ T980] usb 10-1: device descriptor read/8, error -71 [ 1449.786764][T14427] usb 3-1: Using ep0 maxpacket: 16 [ 1449.793640][T14427] usb 3-1: config index 0 descriptor too short (expected 55805, got 86) [ 1449.802100][T14427] usb 3-1: config 0 has too many interfaces: 36, using maximum allowed: 32 [ 1449.812299][T14427] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.822926][T14427] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 36 [ 1449.834448][T14427] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1449.843649][T14427] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.847082][ T980] usb usb10-port1: unable to enumerate USB device [ 1449.851812][T14427] usb 3-1: Product: syz [ 1449.862374][T14427] usb 3-1: Manufacturer: syz [ 1449.867063][T14427] usb 3-1: SerialNumber: syz [ 1449.874560][T14427] usb 3-1: config 0 descriptor?? [ 1449.970110][ T3077] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9085'. [ 1450.069019][ T3080] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1450.075093][ T3080] /dev/rnullb0: Can't lookup blockdev [ 1450.086288][ T3080] veth1_macvtap: entered allmulticast mode [ 1450.104786][ T3073] /dev/rnullb0: Can't lookup blockdev [ 1450.127134][T14427] usb 3-1: USB disconnect, device number 97 [ 1450.383799][ T3089] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9089'. [ 1450.395856][ T3089] /dev/rnullb0: Can't lookup blockdev [ 1450.443021][ T3093] /dev/rnullb0: Can't lookup blockdev [ 1450.916762][T25146] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1451.066680][T25146] usb 3-1: Using ep0 maxpacket: 32 [ 1451.073601][T25146] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1451.085171][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1451.097629][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1451.107441][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1451.118781][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1451.132117][T25146] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1451.141381][T25146] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1451.149714][T25146] usb 3-1: Product: syz [ 1451.153909][T25146] usb 3-1: Manufacturer: syz [ 1451.158892][T25146] usb 3-1: SerialNumber: syz [ 1451.166395][T25146] usb 3-1: config 0 descriptor?? [ 1451.238880][ T3101] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9094'. [ 1451.583433][T25146] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 1451.594212][T25146] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 1451.656592][T14427] usb 10-1: new full-speed USB device number 42 using dummy_hcd [ 1451.802803][ T3099] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9093'. [ 1451.821664][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.834943][T14427] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1451.843922][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.854168][T14427] usb 10-1: not running at top speed; connect to a high speed hub [ 1451.862651][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.869668][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.878069][T14427] usb 10-1: config 1 has an invalid interface number: 121 but max is 0 [ 1451.886332][T14427] usb 10-1: config 1 has no interface number 0 [ 1451.892706][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.899547][T14427] usb 10-1: config 1 interface 121 has no altsetting 0 [ 1451.906691][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.913144][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.920981][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.927304][T14427] usb 10-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=5a.51 [ 1451.936658][T14427] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1451.944944][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.951174][T14427] usb 10-1: Product: syz [ 1451.955521][T14427] usb 10-1: Manufacturer: ,ꏊ婧엽䮑흠鳴숩ꔲ킄ᢩ辬졘ꚯ뫭㌏駔질⛸䫕ྃﱵ薶琇Ꮔ胬㍛᎝禂⮘紒栢퀁䩰ﱻ䮥飲ী쾘聨학즏᜹嬥㪑ഇ。耉棏 [ 1451.974435][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.981554][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1451.989310][T14427] usb 10-1: SerialNumber: syz [ 1451.994276][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1452.006573][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1452.013827][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1452.021578][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1452.030647][T25146] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1452.037818][T25146] input input129: Timeout waiting for response from device. [ 1452.055474][T25146] usb 3-1: USB disconnect, device number 98 [ 1452.205147][ T3109] /dev/rnullb0: Can't lookup blockdev [ 1452.212342][ T3109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1452.225576][ T3109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1452.259219][T14427] usb_ehset_test 10-1:1.121: probe with driver usb_ehset_test failed with error -32 [ 1452.283439][T14427] usb 10-1: USB disconnect, device number 42 [ 1452.366873][T14772] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1452.370702][ T2970] Bluetooth: hci0: command 0x0c1a tx timeout [ 1452.454568][ T3116] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1452.508847][ T3118] /dev/rnullb0: Can't lookup blockdev [ 1452.580657][ T3120] /dev/rnullb0: Can't lookup blockdev [ 1452.735457][ T3131] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1452.753535][ T3131] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1453.085519][ T3142] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9106'. [ 1453.104328][ T3142] /dev/rnullb0: Can't lookup blockdev [ 1453.744648][ T3152] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9109'. [ 1453.895913][ T3156] /dev/rnullb0: Can't lookup blockdev [ 1453.910955][ T3156] /dev/rnullb0: Can't lookup blockdev [ 1454.042085][ T3164] netlink: 'syz.9.9113': attribute type 1 has an invalid length. [ 1454.115521][ T30] audit: type=1804 audit(2000000110.580:10926): pid=3166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.9.9114" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1454.521043][T14427] usb 10-1: new high-speed USB device number 43 using dummy_hcd [ 1454.618623][ T9] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1454.686447][T14427] usb 10-1: Using ep0 maxpacket: 16 [ 1454.694010][T14427] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1454.705519][T14427] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1454.715505][T14427] usb 10-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1454.724783][T14427] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1454.735180][T14427] usb 10-1: config 0 descriptor?? [ 1454.776598][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1454.785720][ T9] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1454.795019][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.803080][ T9] usb 3-1: Product: syz [ 1454.807433][ T9] usb 3-1: Manufacturer: syz [ 1454.812036][ T9] usb 3-1: SerialNumber: syz [ 1454.819896][ T9] usb 3-1: config 0 descriptor?? [ 1455.028211][ T9] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1455.086646][ T2970] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1455.092980][T14772] Bluetooth: hci0: command 0x0c1a tx timeout [ 1455.147806][T14427] usbhid 10-1:0.0: can't add hid device: -71 [ 1455.159825][T14427] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1455.186931][T14427] usb 10-1: USB disconnect, device number 43 [ 1455.194509][ T3184] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9119'. [ 1455.230943][ T3189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.242087][ T3190] /dev/rnullb0: Can't lookup blockdev [ 1455.245162][ T3189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.445062][ T9] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1455.459707][ T9] usb 3-1: USB disconnect, device number 99 [ 1455.982200][ T3202] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9124'. [ 1456.000527][ T9] usb 10-1: new high-speed USB device number 44 using dummy_hcd [ 1456.046334][ T3204] /dev/rnullb0: Can't lookup blockdev [ 1456.169237][ T9] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1456.180557][ T9] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1456.191032][ T9] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1456.207315][ T9] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1456.216698][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.224874][ T9] usb 10-1: Product: syz [ 1456.229251][ T9] usb 10-1: Manufacturer: syz [ 1456.233951][ T9] usb 10-1: SerialNumber: syz [ 1456.243276][ T9] hub 10-1:1.0: bad descriptor, ignoring hub [ 1456.249456][ T9] hub 10-1:1.0: probe with driver hub failed with error -5 [ 1456.444973][ T9] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 44 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1456.756608][ T9] usb 10-1: USB disconnect, device number 44 [ 1456.771282][ T9] usblp0: removed [ 1457.106453][T14427] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1457.269459][T14427] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1457.285687][T14427] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1457.295709][T14427] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.305619][T14427] usb 3-1: Product: syz [ 1457.311628][T14427] usb 3-1: Manufacturer: syz [ 1457.321077][T14427] usb 3-1: SerialNumber: syz [ 1457.346911][ T3215] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9128'. [ 1457.776307][ T5941] usb 10-1: new high-speed USB device number 45 using dummy_hcd [ 1457.916308][ T5941] usb 10-1: device descriptor read/64, error -71 [ 1458.156301][ T5941] usb 10-1: new high-speed USB device number 46 using dummy_hcd [ 1458.296347][ T5941] usb 10-1: device descriptor read/64, error -71 [ 1458.347850][T14427] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1458.354311][T14427] cdc_ncm 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 1458.361907][T14427] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 1458.406903][ T5941] usb usb10-port1: attempt power cycle [ 1458.552319][ T3207] /dev/rnullb0: Can't lookup blockdev [ 1458.558838][T14427] cdc_ncm 3-1:1.0: setting tx_max = 56 [ 1458.574099][T14427] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1458.592776][T14427] usb 3-1: USB disconnect, device number 100 [ 1458.604185][T14427] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP) [ 1458.756220][ T5941] usb 10-1: new high-speed USB device number 47 using dummy_hcd [ 1458.780270][ T5941] usb 10-1: device descriptor read/8, error -71 [ 1459.036232][ T5941] usb 10-1: new high-speed USB device number 48 using dummy_hcd [ 1459.066895][ T5941] usb 10-1: device descriptor read/8, error -71 [ 1459.176583][ T5941] usb usb10-port1: unable to enumerate USB device [ 1459.231722][ T3228] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9133'. [ 1459.250587][ T3228] /dev/rnullb0: Can't lookup blockdev [ 1460.086654][ T3233] /dev/rnullb0: Can't lookup blockdev [ 1460.395362][ T3243] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9138'. [ 1460.577537][ T3251] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9141'. [ 1460.966092][T26473] usb 10-1: new high-speed USB device number 49 using dummy_hcd [ 1461.132525][T26473] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1461.145972][T26473] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1461.158904][T26473] usb 10-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1461.168631][T26473] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.179339][T26473] usb 10-1: Product: syz [ 1461.184095][T26473] usb 10-1: Manufacturer: syz [ 1461.189563][T26473] usb 10-1: SerialNumber: syz [ 1461.208057][T26473] usb 10-1: config 0 descriptor?? [ 1461.246345][ T2970] Bluetooth: hci0: command 0x0c1a tx timeout [ 1461.254176][T14772] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1461.421282][T26473] usb 10-1: USB disconnect, device number 49 [ 1461.754533][ T3272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9147'. [ 1462.041833][ T3275] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1462.065292][ T3275] /dev/rnullb0: Can't lookup blockdev [ 1462.684271][ T3292] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1462.906275][T14427] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1462.943343][ T3296] /dev/rnullb0: Can't lookup blockdev [ 1463.001271][ T3298] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9158'. [ 1463.066430][T14427] usb 3-1: Using ep0 maxpacket: 16 [ 1463.073549][T14427] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1463.101040][T14427] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1463.114307][T14427] usb 3-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1463.123969][T14427] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.134341][T14427] usb 3-1: config 0 descriptor?? [ 1463.297832][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.303996][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.322097][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.329667][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.344836][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.351572][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.358494][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.364448][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.375573][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.383815][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.383825][ T3312] /dev/rnullb0: Can't lookup blockdev [ 1463.395641][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.401618][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.407984][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.414246][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.420519][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.426598][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.432823][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.439961][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.446630][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.452618][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.458783][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.464726][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.479315][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.486135][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.493073][ T3314] /dev/rnullb0: Can't lookup blockdev [ 1463.496035][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.504603][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.515039][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.524245][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.532689][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.542073][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.549843][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.555684][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.565328][ T3310] /dev/rnullb0: Can't lookup blockdev [ 1463.572916][T14427] usbhid 3-1:0.0: can't add hid device: -71 [ 1463.596143][T14427] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1463.613302][T14427] usb 3-1: USB disconnect, device number 101 [ 1463.660866][ T3317] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9164'. [ 1463.686599][ T2970] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1463.698464][ T3317] /dev/rnullb0: Can't lookup blockdev [ 1463.734026][ T3321] netlink: 'syz.9.9166': attribute type 1 has an invalid length. [ 1463.758591][ T3321] /dev/rnullb0: Can't lookup blockdev [ 1464.009119][ T3329] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9169'. [ 1464.021931][ T3329] /dev/rnullb0: Can't lookup blockdev [ 1464.123527][ T3336] /dev/rnullb0: Can't lookup blockdev [ 1464.485652][ T3352] /dev/rnullb0: Can't lookup blockdev [ 1464.932409][ T9] usb 10-1: new high-speed USB device number 50 using dummy_hcd [ 1465.104289][ T9] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1465.130512][ T9] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1465.156045][ T9] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1465.162743][ T3378] /dev/rnullb0: Can't lookup blockdev [ 1465.180000][ T3379] /dev/rnullb0: Can't lookup blockdev [ 1465.191508][ T9] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1465.214285][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1465.232768][ T9] usb 10-1: Product: syz [ 1465.248870][ T9] usb 10-1: Manufacturer: syz [ 1465.258093][ T9] usb 10-1: SerialNumber: syz [ 1465.308753][ T3384] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9186'. [ 1465.372078][ T3387] /dev/rnullb0: Can't lookup blockdev [ 1465.472602][ T3393] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9189'. [ 1465.678182][ T3406] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9190'. [ 1465.692786][ T9] cdc_ncm 10-1:1.0: failed GET_NTB_PARAMETERS [ 1465.715025][ T9] cdc_ncm 10-1:1.0: bind() failure [ 1465.722417][ T3406] /dev/rnullb0: Can't lookup blockdev [ 1465.726585][ T3405] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1465.734546][T14772] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1465.734576][ T3405] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1465.742334][T14772] Bluetooth: hci0: command 0x0c1a tx timeout [ 1465.753958][ T3405] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1465.766239][ T9] cdc_ncm 10-1:1.1: CDC Union missing and no IAD found [ 1465.773716][ T3405] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1465.774914][ T9] cdc_ncm 10-1:1.1: bind() failure [ 1465.786486][ T3410] fuse: Bad value for 'fd' [ 1465.793162][ T3410] fuse: Bad value for 'fd' [ 1465.799799][ T3410] fuse: Bad value for 'fd' [ 1465.803795][ T3405] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1465.823989][ T9] usb 10-1: USB disconnect, device number 50 [ 1465.841320][ T3405] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1465.944477][ T3412] /dev/rnullb0: Can't lookup blockdev [ 1465.952037][ T3412] fuse: Bad value for 'user_id' [ 1465.963552][ T3412] fuse: Bad value for 'user_id' [ 1466.032868][ T3418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1466.053745][ T3418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1466.060822][ T3420] /dev/rnullb0: Can't lookup blockdev [ 1466.159852][ T3425] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9197'. [ 1466.542152][ T3441] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9201'. [ 1467.029308][ T30] audit: type=1326 audit(2000000123.501:10927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3442 comm="syz.2.9202" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdd25b8e929 code=0x0 [ 1467.052821][ T30] audit: type=1326 audit(2000000123.521:10928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3442 comm="syz.2.9202" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdd25b8e929 code=0x0 [ 1467.344314][ T3456] /dev/rnullb0: Can't lookup blockdev [ 1467.387971][ T3458] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1467.433366][ T3460] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9206'. [ 1467.435693][ T9] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1467.597677][ T9] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1467.608771][ T9] usb 3-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1467.625448][ T9] usb 3-1: config 2 interface 0 has no altsetting 0 [ 1467.634981][ T9] usb 3-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 1467.652256][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1467.661116][ T9] usb 3-1: Product: syz [ 1467.680186][ T9] usb 3-1: Manufacturer: syz [ 1467.684842][ T9] usb 3-1: SerialNumber: syz [ 1467.806104][T14772] Bluetooth: hci2: command 0x0c1a tx timeout [ 1467.812415][T14772] Bluetooth: hci4: command 0x0c1a tx timeout [ 1467.813031][T32107] Bluetooth: hci0: command 0x0c1a tx timeout [ 1467.818613][T14772] Bluetooth: hci5: command 0x0405 tx timeout [ 1467.824737][ T2970] Bluetooth: hci1: command 0x0c1a tx timeout [ 1468.116935][ T9] ims_pcu 3-1:2.0: Missing CDC union descriptor [ 1468.123384][ T9] ims_pcu 3-1:2.0: probe with driver ims_pcu failed with error -22 [ 1468.164009][ T9] usb 3-1: USB disconnect, device number 102 [ 1468.398908][ T3487] /dev/rnullb0: Can't lookup blockdev [ 1468.502198][ T3492] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9216'. [ 1468.624534][ T3497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1468.740926][ T3500] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9219'. [ 1468.752940][ T3500] /dev/rnullb0: Can't lookup blockdev [ 1469.149161][ T3511] /dev/rnullb0: Can't lookup blockdev [ 1469.149873][ T3509] overlayfs: missing 'lowerdir' [ 1469.273695][ T3517] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9225'. [ 1469.626886][ T3530] /dev/rnullb0: Can't lookup blockdev [ 1469.646277][ T3530] nfs4: Unknown parameter 'dont_measure' [ 1469.727027][T26473] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1469.751602][T14772] Bluetooth: hci4: unexpected event for opcode 0x0804 [ 1469.807539][ T3538] /dev/rnullb0: Can't lookup blockdev [ 1469.822816][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.830415][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.837423][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.844246][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.851685][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.859074][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.866589][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.875254][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.882689][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 1469.890113][T14772] Bluetooth: hci2: command 0x0c1a tx timeout [ 1469.897972][T26473] usb 3-1: Using ep0 maxpacket: 16 [ 1469.914158][T26473] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1469.970569][T26473] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1469.991034][T26473] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1470.011134][T26473] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1470.025197][T26473] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1470.047794][T26473] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1470.063155][T26473] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1470.083438][T26473] usb 3-1: Manufacturer: syz [ 1470.111469][T26473] usb 3-1: config 0 descriptor?? [ 1470.219517][ T3548] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9236'. [ 1470.455492][T26473] rc_core: IR keymap rc-hauppauge not found [ 1470.461544][T26473] Registered IR keymap rc-empty [ 1470.479099][ T3556] Invalid source name [ 1470.483116][ T3556] UBIFS error (pid: 3556): cannot open "/dev/rnullb0", error -22 [ 1470.483393][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.535571][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.569881][T26473] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1470.602376][T26473] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input130 [ 1470.616907][ T3558] netlink: 'syz.8.9241': attribute type 6 has an invalid length. [ 1470.643912][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.653784][ T3558] syzkaller1: entered promiscuous mode [ 1470.659501][ T3558] syzkaller1: entered allmulticast mode [ 1470.679907][ T3558] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9241'. [ 1470.685653][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.756781][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.786389][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.789490][ T3564] MTD: Couldn't look up '/dev/sg0': -15 [ 1470.823553][ T3564] /dev/sg0: Can't lookup blockdev [ 1470.825617][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.855535][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.885630][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.905547][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.922891][ T3526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1470.942506][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1470.952906][ T3526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1470.963204][ T3526] 9pnet_virtio: no channels available for device /dev/rnullb0 [ 1470.975647][T26473] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1471.028219][T26473] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1471.040821][T26473] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1471.075052][T26473] usb 3-1: USB disconnect, device number 103 [ 1471.149884][ T2970] Bluetooth: hci5: ACL packet for unknown connection handle 200 [ 1471.565231][ T3574] /dev/rnullb0: Can't lookup blockdev [ 1471.665246][ T3576] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9247'. [ 1471.887895][ T3583] evm: overlay not supported [ 1471.965892][ T2970] Bluetooth: hci2: command 0x0c1a tx timeout [ 1472.301473][ T36] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.384703][ T36] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.488404][ T36] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.567267][ T36] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.783008][ T36] bridge_slave_1: left allmulticast mode [ 1472.788907][ T36] bridge_slave_1: left promiscuous mode [ 1472.794678][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 1472.809651][ T36] bridge_slave_0: left allmulticast mode [ 1472.818818][ T36] bridge_slave_0: left promiscuous mode [ 1472.823248][T14772] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1472.824582][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 1472.842317][T14772] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1472.851999][T14772] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1472.860710][T14772] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1472.868839][T14772] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1473.349040][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1473.361210][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1473.373644][ T36] bond0 (unregistering): Released all slaves [ 1473.843326][ T36] hsr_slave_0: left promiscuous mode [ 1473.855554][ T36] hsr_slave_1: left promiscuous mode [ 1473.861936][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1473.884967][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1473.904921][ T3605] kAFS: No cell specified [ 1473.910683][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1473.919379][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1473.948082][ T36] veth1_macvtap: left promiscuous mode [ 1473.953679][ T36] veth0_macvtap: left promiscuous mode [ 1473.960305][ T36] veth1_vlan: left promiscuous mode [ 1473.970195][ T36] veth0_vlan: left promiscuous mode [ 1474.387841][ T3618] /dev/rnullb0: Can't lookup blockdev [ 1474.874363][ T36] team0 (unregistering): Port device team_slave_1 removed [ 1474.935799][T14772] Bluetooth: hci3: command tx timeout [ 1474.964764][ T36] team0 (unregistering): Port device team_slave_0 removed [ 1475.210893][T25146] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1475.389081][T25146] usb 3-1: Using ep0 maxpacket: 16 [ 1475.420223][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1475.433356][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1475.443244][T25146] usb 3-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1475.458736][T25146] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1475.476618][T25146] usb 3-1: config 0 descriptor?? [ 1475.626039][ T3591] chnl_net:caif_netlink_parms(): no params data found [ 1475.859288][ T3591] bridge0: port 1(bridge_slave_0) entered blocking state [ 1475.891010][ T3591] bridge0: port 1(bridge_slave_0) entered disabled state [ 1475.912487][ T3591] bridge_slave_0: entered allmulticast mode [ 1475.923104][T25146] usbhid 3-1:0.0: can't add hid device: -71 [ 1475.940572][T25146] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1475.960933][ T3591] bridge_slave_0: entered promiscuous mode [ 1475.978123][T25146] usb 3-1: USB disconnect, device number 104 [ 1475.989334][ T3591] bridge0: port 2(bridge_slave_1) entered blocking state [ 1476.008742][ T3591] bridge0: port 2(bridge_slave_1) entered disabled state [ 1476.026124][ T3591] bridge_slave_1: entered allmulticast mode [ 1476.037252][ T3591] bridge_slave_1: entered promiscuous mode [ 1476.110045][ T3591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1476.140468][ T3591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1476.196926][ T3591] team0: Port device team_slave_0 added [ 1476.206210][ T3591] team0: Port device team_slave_1 added [ 1476.250531][ T3591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1476.257807][ T3591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1476.284508][ T3591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1476.301773][ T3591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1476.309928][ T3591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1476.336785][ T3591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1476.416886][ T3591] hsr_slave_0: entered promiscuous mode [ 1476.423695][ T3591] hsr_slave_1: entered promiscuous mode [ 1476.431247][ T3591] debugfs: 'hsr0' already exists in 'hsr' [ 1476.462674][ T3591] Cannot create hsr debugfs directory [ 1476.785433][ T9] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1476.925864][ T9] usb 3-1: device descriptor read/64, error -71 [ 1477.006199][T14772] Bluetooth: hci3: command tx timeout [ 1477.185542][ T9] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1477.335745][ T9] usb 3-1: device descriptor read/64, error -71 [ 1477.430088][ T3662] syzkaller1: entered promiscuous mode [ 1477.449932][ T3662] syzkaller1: entered allmulticast mode [ 1477.457554][ T9] usb usb3-port1: attempt power cycle [ 1477.480270][ T3662] /dev/rnullb0: Can't lookup blockdev [ 1477.739925][ T3669] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1477.759633][ T3591] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1477.819209][ T3591] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1477.842554][ T9] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1477.849498][ T3591] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1477.863335][ T3591] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1477.895248][ T9] usb 3-1: device descriptor read/8, error -71 [ 1478.048366][ T3591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1478.094711][ T3591] 8021q: adding VLAN 0 to HW filter on device team0 [ 1478.122630][ T3568] bridge0: port 1(bridge_slave_0) entered blocking state [ 1478.129843][ T3568] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1478.139760][ T9] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1478.182400][ T3568] bridge0: port 2(bridge_slave_1) entered blocking state [ 1478.189623][ T3568] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1478.205820][ T9] usb 3-1: device descriptor read/8, error -71 [ 1478.325741][ T9] usb usb3-port1: unable to enumerate USB device [ 1478.673922][ T3591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1478.740743][ T3591] veth0_vlan: entered promiscuous mode [ 1478.757982][ T3591] veth1_vlan: entered promiscuous mode [ 1478.797688][ T3591] veth0_macvtap: entered promiscuous mode [ 1478.811402][ T3591] veth1_macvtap: entered promiscuous mode [ 1478.841515][ T3591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1478.863552][ T3591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1478.880492][ T3568] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1478.892194][ T3568] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1478.913696][ T3568] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1478.925651][ T3568] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1479.086665][T14772] Bluetooth: hci3: command tx timeout [ 1479.120020][ T3568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1479.144983][ T3568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1479.231925][ T3568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1479.241830][ T3716] /dev/rnullb0: Can't lookup blockdev [ 1479.249216][ T3568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1479.390882][ T3722] qrtr: Invalid version 48 [ 1479.402349][ T3722] /dev/rnullb0: Can't lookup blockdev [ 1479.434398][ T3725] /dev/rnullb0: Can't lookup blockdev [ 1479.529328][ T3728] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9273'. [ 1479.845248][ T5921] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1479.846429][ T3742] /dev/rnullb0: Can't lookup blockdev [ 1480.027418][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1480.065080][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1480.085233][ T5921] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1480.094399][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1480.112152][ T5921] usb 1-1: config 0 descriptor?? [ 1480.523736][ T5921] keytouch 0003:0926:3333.00B8: fixing up Keytouch IEC report descriptor [ 1480.559841][ T5921] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.00B8/input/input131 [ 1480.665393][ T9] usb 3-1: new full-speed USB device number 109 using dummy_hcd [ 1480.694295][ T5921] keytouch 0003:0926:3333.00B8: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 1480.761158][ T5921] usb 1-1: USB disconnect, device number 13 [ 1480.812125][ T3769] fido_id[3769]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 1480.858797][ T9] usb 3-1: config 0 has an invalid interface number: 161 but max is 0 [ 1480.867263][ T9] usb 3-1: config 0 has no interface number 0 [ 1480.894771][ T9] usb 3-1: New USB device found, idVendor=067b, idProduct=331a, bcdDevice=4a.31 [ 1480.920260][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1480.941596][ T9] usb 3-1: Product: syz [ 1480.949854][ T9] usb 3-1: Manufacturer: syz [ 1480.968792][ T9] usb 3-1: SerialNumber: syz [ 1480.989651][ T9] usb 3-1: config 0 descriptor?? [ 1481.156603][ T3780] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9284'. [ 1481.166880][T14772] Bluetooth: hci3: command tx timeout [ 1481.236912][ T3763] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1481.260314][ T3763] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.315776][ T3763] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1481.344250][ T3763] /dev/rnullb0: Can't lookup blockdev [ 1481.361458][ T9] pl2303 3-1:0.161: required endpoints missing [ 1481.414468][ T9] usb 3-1: USB disconnect, device number 109 [ 1481.458209][ T3789] /dev/rnullb0: Can't lookup blockdev [ 1481.715233][T26473] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1481.796981][ T3802] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1481.803129][ T3802] /dev/rnullb0: Can't lookup blockdev [ 1481.894869][T26473] usb 1-1: Using ep0 maxpacket: 32 [ 1481.912696][T26473] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1481.938368][T26473] usb 1-1: can't read configurations, error -61 [ 1482.007074][ T3811] binder: 3809:3811 ioctl c00c620f 200000000380 returned -22 [ 1482.085349][T26473] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1482.244897][T26473] usb 1-1: Using ep0 maxpacket: 32 [ 1482.260813][T26473] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1482.278276][ T3568] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1482.294836][T26473] usb 1-1: can't read configurations, error -61 [ 1482.310607][T26473] usb usb1-port1: attempt power cycle [ 1482.667469][T26473] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1482.698855][T26473] usb 1-1: Using ep0 maxpacket: 32 [ 1482.712000][T26473] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1482.722202][T26473] usb 1-1: can't read configurations, error -61 [ 1482.884977][T26473] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1482.925532][T26473] usb 1-1: Using ep0 maxpacket: 32 [ 1482.940403][T26473] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1482.952761][T26473] usb 1-1: can't read configurations, error -61 [ 1482.959997][T26473] usb usb1-port1: unable to enumerate USB device [ 1483.096283][ T3853] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9294'. [ 1483.135813][ T3854] /dev/rnullb0: Can't lookup blockdev [ 1483.207908][ T3854] pvfs2: Unknown parameter 'rootmode' [ 1483.247981][ T3860] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9295'. [ 1483.279595][ T3860] /dev/rnullb0: Can't lookup blockdev [ 1483.516696][ T3871] netlink: 'syz.4.9298': attribute type 2 has an invalid length. [ 1483.524463][ T3871] netlink: 164 bytes leftover after parsing attributes in process `syz.4.9298'. [ 1484.465085][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.471438][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.582466][ T3917] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9303'. [ 1484.592387][ T3915] /dev/rnullb0: Can't lookup blockdev [ 1484.758628][ T3924] /dev/rnullb0: Can't lookup blockdev [ 1484.849211][ T3927] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9305'. [ 1484.898120][ T3927] /dev/rnullb0: Can't lookup blockdev [ 1485.071799][ T3937] netlink: 32 bytes leftover after parsing attributes in process `syz.8.9307'. [ 1485.101067][T26473] libceph: connect (1)[c::]:6789 error -101 [ 1485.115543][T26473] libceph: mon0 (1)[c::]:6789 connect error [ 1485.136415][ T3938] ceph: No mds server is up or the cluster is laggy [ 1485.165334][ T3945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9309'. [ 1485.181572][ T3945] net_ratelimit: 23 callbacks suppressed [ 1485.181590][ T3945] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 1485.335232][ T3950] /dev/rnullb0: Can't lookup blockdev [ 1485.364839][T14427] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1485.477600][ T3954] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1485.527378][T14427] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1485.570369][T14427] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1485.584417][T14427] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1485.595144][T14427] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1485.629878][T14427] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1485.649754][T14427] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1485.665879][ T3963] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9313'. [ 1485.675933][T14427] usb 1-1: config 0 descriptor?? [ 1485.911797][ T3970] fuse: Unknown parameter 'grup_id00000000000000000000' [ 1486.056443][ T3982] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9316'. [ 1486.086576][ T3982] /dev/rnullb0: Can't lookup blockdev [ 1486.121590][T14427] hid_parser_main: 5 callbacks suppressed [ 1486.121613][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.160600][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.183166][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.193140][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.210550][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.219344][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.227114][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.234714][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.242590][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.250365][T14427] plantronics 0003:047F:FFFF.00B9: unknown main item tag 0x0 [ 1486.275268][T14427] plantronics 0003:047F:FFFF.00B9: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1486.497555][T14427] usb 1-1: USB disconnect, device number 18 [ 1486.586793][ T3997] /dev/rnullb0: Can't lookup blockdev [ 1486.925014][ T4013] /dev/rnullb0: Can't lookup blockdev [ 1486.950682][ T4016] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9325'. [ 1486.978994][ T4016] /dev/rnullb0: Can't lookup blockdev [ 1487.463541][ T4041] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1487.480932][ T30] audit: type=1804 audit(2000000143.952:10929): pid=4041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.9331" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1487.564619][T26473] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1487.660496][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.660496][ T4047] nbd2: rw=0, sector=64, nr_sectors = 1 limit=0 [ 1487.674337][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.674337][ T4047] nbd2: rw=0, sector=256, nr_sectors = 1 limit=0 [ 1487.688179][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 1487.698710][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.698710][ T4047] nbd2: rw=0, sector=512, nr_sectors = 1 limit=0 [ 1487.714806][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 1487.740318][ T4047] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 1487.755636][T26473] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1487.775857][ T4047] UDF-fs: Scanning with blocksize 512 failed [ 1487.779487][T26473] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1487.793718][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.793718][ T4047] nbd2: rw=0, sector=64, nr_sectors = 2 limit=0 [ 1487.804243][T26473] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1487.827731][T26473] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1487.830456][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.830456][ T4047] nbd2: rw=0, sector=512, nr_sectors = 2 limit=0 [ 1487.847351][T26473] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1487.869354][T26473] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.887680][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 1487.900229][T26473] usb 1-1: config 0 descriptor?? [ 1487.906837][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.906837][ T4047] nbd2: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 1487.921693][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 1487.938091][ T4047] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 1487.952544][ T4047] UDF-fs: Scanning with blocksize 1024 failed [ 1487.961397][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.961397][ T4047] nbd2: rw=0, sector=64, nr_sectors = 4 limit=0 [ 1487.984720][ T4047] syz.2.9332: attempt to access beyond end of device [ 1487.984720][ T4047] nbd2: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 1488.024523][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 1488.034188][ T4047] syz.2.9332: attempt to access beyond end of device [ 1488.034188][ T4047] nbd2: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 1488.050909][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 1488.064310][ T4047] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 1488.079278][ T4047] UDF-fs: Scanning with blocksize 2048 failed [ 1488.088247][ T4047] syz.2.9332: attempt to access beyond end of device [ 1488.088247][ T4047] nbd2: rw=0, sector=64, nr_sectors = 8 limit=0 [ 1488.110780][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 1488.122611][ T4047] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 1488.137360][ T4047] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 1488.146756][ T4047] UDF-fs: Scanning with blocksize 4096 failed [ 1488.153024][ T4047] UDF-fs: warning (device nbd2): udf_fill_super: No partition found (1) [ 1488.360072][T26473] plantronics 0003:047F:FFFF.00BA: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1488.552975][ T4069] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9334'. [ 1488.580752][ T4069] /dev/rnullb0: Can't lookup blockdev [ 1488.680597][T25146] usb 1-1: USB disconnect, device number 19 [ 1488.763133][ T4076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1488.793381][ T4076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1488.994741][T14427] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1489.164743][T14427] usb 3-1: device descriptor read/64, error -71 [ 1489.414771][T14427] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1489.458522][ T4104] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9337'. [ 1489.579791][T14427] usb 3-1: device descriptor read/64, error -71 [ 1489.694680][T14427] usb usb3-port1: attempt power cycle [ 1489.714782][T19811] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1489.864610][T19811] usb 1-1: Using ep0 maxpacket: 32 [ 1489.876394][T19811] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1489.892610][T19811] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1489.904244][T19811] usb 1-1: config 0 descriptor?? [ 1489.931133][T19811] as10x_usb: device has been detected [ 1489.943530][T19811] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1490.002425][T19811] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1490.060068][T14427] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1490.097989][T14427] usb 3-1: device descriptor read/8, error -71 [ 1490.121766][T19811] as10x_usb: error during firmware upload part1 [ 1490.134135][ T4104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1490.145992][ T4104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1490.162656][T19811] Registered device nBox DVB-T Dongle [ 1490.198109][T25146] usb 1-1: USB disconnect, device number 20 [ 1490.270954][T25146] Unregistered device nBox DVB-T Dongle [ 1490.289642][ T4128] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9338'. [ 1490.307506][T25146] as10x_usb: device has been disconnected [ 1490.376807][T14427] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1490.408795][T14427] usb 3-1: device descriptor read/8, error -71 [ 1490.534810][T14427] usb usb3-port1: unable to enumerate USB device [ 1491.015617][ T4154] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9343'. [ 1491.030501][ T4154] /dev/rnullb0: Can't lookup blockdev [ 1491.114643][T25146] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1491.288747][T25146] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1491.290588][ T30] audit: type=1804 audit(2000000147.762:10930): pid=4165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.9345" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1491.314313][T25146] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1491.355915][T25146] usb 1-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1491.365488][T25146] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1491.373592][T25146] usb 1-1: Product: syz [ 1491.380676][T25146] usb 1-1: Manufacturer: syz [ 1491.386585][T25146] usb 1-1: SerialNumber: syz [ 1491.414686][T25146] usb 1-1: config 0 descriptor?? [ 1491.977410][ T4188] /dev/rnullb0: Can't lookup blockdev [ 1491.990395][ T4188] netlink: 'syz.2.9349': attribute type 8 has an invalid length. [ 1492.198578][ T4196] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1492.341190][ T4203] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9352'. [ 1492.361209][ T4203] /dev/rnullb0: Can't lookup blockdev [ 1492.467444][ T4207] /dev/rnullb0: Can't lookup blockdev [ 1492.884245][T14427] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1493.058673][T14427] usb 3-1: config 0 has no interfaces? [ 1493.068409][T14427] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1493.077553][T14427] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1493.093691][T14427] usb 3-1: config 0 descriptor?? [ 1493.322622][ T4215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1493.347122][ T4215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1493.365624][ T4215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1493.381494][ T4215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1493.399671][T14427] usb 3-1: USB disconnect, device number 114 [ 1493.594340][ T4247] /dev/rnullb0: Can't lookup blockdev [ 1493.809878][ T4260] netlink: 3204 bytes leftover after parsing attributes in process `syz.8.9358'. [ 1493.826862][ T4259] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9358'. [ 1493.855350][T19811] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1493.890017][T25146] usb 1-1: USB disconnect, device number 21 [ 1494.027588][T19811] usb 3-1: no configurations [ 1494.032217][T19811] usb 3-1: can't read configurations, error -22 [ 1494.166254][T19811] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1494.324401][T25146] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1494.332706][T19811] usb 3-1: no configurations [ 1494.337857][T19811] usb 3-1: can't read configurations, error -22 [ 1494.348807][T19811] usb usb3-port1: attempt power cycle [ 1494.516533][T25146] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1494.544429][T25146] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1494.563096][T25146] usb 1-1: config 1 has no interface number 0 [ 1494.573493][T25146] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1494.590820][T25146] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 1494.600292][T25146] usb 1-1: config 1 interface 1 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1494.621313][T25146] usb 1-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1494.656403][T25146] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1494.668446][T25146] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.676915][T25146] usb 1-1: Product: syz [ 1494.681320][T25146] usb 1-1: Manufacturer: syz [ 1494.694744][T19811] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1494.704198][T25146] usb 1-1: SerialNumber: syz [ 1494.727890][T19811] usb 3-1: no configurations [ 1494.732800][T19811] usb 3-1: can't read configurations, error -22 [ 1494.819536][ T4289] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9361'. [ 1494.850323][ T4289] /dev/rnullb0: Can't lookup blockdev [ 1494.894762][T19811] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1494.925528][T19811] usb 3-1: no configurations [ 1494.930381][T19811] usb 3-1: can't read configurations, error -22 [ 1494.960365][T19811] usb usb3-port1: unable to enumerate USB device [ 1495.346287][ T4264] /dev/rnullb0: Can't lookup blockdev [ 1495.354432][T25146] cdc_ncm 1-1:1.1: failed GET_NTB_PARAMETERS [ 1495.360495][T25146] cdc_ncm 1-1:1.1: bind() failure [ 1495.416606][T25146] usb 1-1: USB disconnect, device number 22 [ 1495.515632][ T4308] /dev/rnullb0: Can't lookup blockdev [ 1495.673945][ T4316] /dev/rnullb0: Can't lookup blockdev [ 1496.043421][ T4335] program syz.2.9367 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1496.276141][ T4339] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9370'. [ 1496.283032][ T4342] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9371'. [ 1496.307349][ T4339] /dev/rnullb0: Can't lookup blockdev [ 1496.432247][ T4347] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 1496.561077][ T4355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9374'. [ 1496.841866][ T30] audit: type=1804 audit(2000000153.312:10931): pid=4365 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.9374" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1496.863274][ C0] vkms_vblank_simulate: vblank timer overrun [ 1497.104166][T19811] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1497.278429][T19811] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1497.296182][T19811] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1497.315075][ T4381] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9380'. [ 1497.332466][T19811] usb 3-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1497.343623][ T4381] /dev/rnullb0: Can't lookup blockdev [ 1497.362334][T19811] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.369717][ T4383] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9381'. [ 1497.385617][T19811] usb 3-1: Product: syz [ 1497.389851][T19811] usb 3-1: Manufacturer: syz [ 1497.396382][T19811] usb 3-1: SerialNumber: syz [ 1497.410870][T19811] usb 3-1: config 0 descriptor?? [ 1497.531781][ T4387] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1497.606414][ T4392] FAULT_INJECTION: forcing a failure. [ 1497.606414][ T4392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1497.641164][ T4392] CPU: 1 UID: 0 PID: 4392 Comm: syz.8.9383 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1497.641190][ T4392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1497.641200][ T4392] Call Trace: [ 1497.641207][ T4392] [ 1497.641216][ T4392] dump_stack_lvl+0x189/0x250 [ 1497.641251][ T4392] ? __pfx____ratelimit+0x10/0x10 [ 1497.641270][ T4392] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1497.641292][ T4392] ? __pfx__printk+0x10/0x10 [ 1497.641314][ T4392] ? __might_fault+0xb0/0x130 [ 1497.641347][ T4392] should_fail_ex+0x414/0x560 [ 1497.641377][ T4392] _copy_from_user+0x2d/0xb0 [ 1497.641402][ T4392] do_sys_poll+0x242/0x1070 [ 1497.641435][ T4392] ? __pfx_do_sys_poll+0x10/0x10 [ 1497.641510][ T4392] ? ktime_get_ts64+0xa2/0x3d0 [ 1497.641541][ T4392] ? seqcount_lockdep_reader_access+0x123/0x1c0 [ 1497.641589][ T4392] ? set_user_sigmask+0xc7/0x1b0 [ 1497.641611][ T4392] ? __pfx_set_user_sigmask+0x10/0x10 [ 1497.641633][ T4392] ? __fget_files+0x3a0/0x420 [ 1497.641656][ T4392] __se_sys_ppoll+0x1ff/0x260 [ 1497.641677][ T4392] ? __pfx___se_sys_ppoll+0x10/0x10 [ 1497.641693][ T4392] ? __pfx_ksys_write+0x10/0x10 [ 1497.641707][ T4392] ? rcu_is_watching+0x15/0xb0 [ 1497.641730][ T4392] ? do_syscall_64+0xbe/0x3b0 [ 1497.641745][ T4392] ? __x64_sys_ppoll+0x20/0xc0 [ 1497.641770][ T4392] do_syscall_64+0xfa/0x3b0 [ 1497.641786][ T4392] ? lockdep_hardirqs_on+0x9c/0x150 [ 1497.641801][ T4392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1497.641815][ T4392] ? clear_bhb_loop+0x60/0xb0 [ 1497.641832][ T4392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1497.641846][ T4392] RIP: 0033:0x7f15cb58e929 [ 1497.641861][ T4392] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1497.641874][ T4392] RSP: 002b:00007f15cc4d2038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 1497.641890][ T4392] RAX: ffffffffffffffda RBX: 00007f15cb7b5fa0 RCX: 00007f15cb58e929 [ 1497.641901][ T4392] RDX: 0000200000000400 RSI: 0000000000000001 RDI: 0000200000000180 [ 1497.641912][ T4392] RBP: 00007f15cc4d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1497.641921][ T4392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1497.641930][ T4392] R13: 0000000000000000 R14: 00007f15cb7b5fa0 R15: 00007ffe4ab2d078 [ 1497.641953][ T4392] [ 1498.136682][ T4405] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1498.247853][ T4408] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1498.278413][ T4408] /dev/rnullb0: Can't lookup blockdev [ 1498.409933][ T4417] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9390'. [ 1498.433147][ T4417] /dev/rnullb0: Can't lookup blockdev [ 1498.551584][ T4420] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9391'. [ 1498.725853][ T4428] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9393'. [ 1498.736047][ T4428] hsr_slave_0: left promiscuous mode [ 1498.742486][ T4428] hsr_slave_1: left promiscuous mode [ 1498.748294][ T4425] FAULT_INJECTION: forcing a failure. [ 1498.748294][ T4425] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1498.763663][ T4425] CPU: 0 UID: 0 PID: 4425 Comm: syz.8.9392 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1498.763687][ T4425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1498.763697][ T4425] Call Trace: [ 1498.763705][ T4425] [ 1498.763714][ T4425] dump_stack_lvl+0x189/0x250 [ 1498.763752][ T4425] ? __pfx____ratelimit+0x10/0x10 [ 1498.763772][ T4425] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1498.763799][ T4425] ? __pfx__printk+0x10/0x10 [ 1498.763833][ T4425] should_fail_ex+0x414/0x560 [ 1498.763862][ T4425] _copy_to_user+0x31/0xb0 [ 1498.763887][ T4425] put_timespec64+0xc0/0x120 [ 1498.763907][ T4425] ? __pfx_put_timespec64+0x10/0x10 [ 1498.763934][ T4425] poll_select_finish+0x47f/0x5e0 [ 1498.763955][ T4425] ? __pfx_poll_select_finish+0x10/0x10 [ 1498.763976][ T4425] ? set_user_sigmask+0xc7/0x1b0 [ 1498.763997][ T4425] ? __pfx_set_user_sigmask+0x10/0x10 [ 1498.764017][ T4425] ? __fget_files+0x3a0/0x420 [ 1498.764041][ T4425] __se_sys_ppoll+0x213/0x260 [ 1498.764062][ T4425] ? __pfx___se_sys_ppoll+0x10/0x10 [ 1498.764079][ T4425] ? __pfx_ksys_write+0x10/0x10 [ 1498.764093][ T4425] ? rcu_is_watching+0x15/0xb0 [ 1498.764119][ T4425] ? do_syscall_64+0xbe/0x3b0 [ 1498.764136][ T4425] ? __x64_sys_ppoll+0x20/0xc0 [ 1498.764155][ T4425] do_syscall_64+0xfa/0x3b0 [ 1498.764172][ T4425] ? lockdep_hardirqs_on+0x9c/0x150 [ 1498.764191][ T4425] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1498.764208][ T4425] ? clear_bhb_loop+0x60/0xb0 [ 1498.764230][ T4425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1498.764247][ T4425] RIP: 0033:0x7f15cb58e929 [ 1498.764264][ T4425] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1498.764279][ T4425] RSP: 002b:00007f15cc4d2038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 1498.764299][ T4425] RAX: ffffffffffffffda RBX: 00007f15cb7b5fa0 RCX: 00007f15cb58e929 [ 1498.764312][ T4425] RDX: 0000200000000400 RSI: 0000000000000001 RDI: 0000200000000180 [ 1498.764324][ T4425] RBP: 00007f15cc4d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1498.764336][ T4425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1498.764347][ T4425] R13: 0000000000000000 R14: 00007f15cb7b5fa0 R15: 00007ffe4ab2d078 [ 1498.764376][ T4425] [ 1498.986679][ C0] vkms_vblank_simulate: vblank timer overrun [ 1499.179367][ T4436] FAULT_INJECTION: forcing a failure. [ 1499.179367][ T4436] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1499.214738][ T4436] CPU: 1 UID: 0 PID: 4436 Comm: syz.8.9395 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1499.214764][ T4436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1499.214775][ T4436] Call Trace: [ 1499.214782][ T4436] [ 1499.214791][ T4436] dump_stack_lvl+0x189/0x250 [ 1499.214820][ T4436] ? __pfx____ratelimit+0x10/0x10 [ 1499.214840][ T4436] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1499.214862][ T4436] ? __pfx__printk+0x10/0x10 [ 1499.214886][ T4436] ? __might_fault+0xb0/0x130 [ 1499.214921][ T4436] should_fail_ex+0x414/0x560 [ 1499.214949][ T4436] _copy_from_user+0x2d/0xb0 [ 1499.214973][ T4436] do_sys_poll+0x242/0x1070 [ 1499.215007][ T4436] ? __pfx_do_sys_poll+0x10/0x10 [ 1499.215088][ T4436] ? rcu_read_lock_any_held+0xb3/0x120 [ 1499.215111][ T4436] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 1499.215135][ T4436] ? vfs_write+0x8d8/0xa90 [ 1499.215184][ T4436] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1499.215204][ T4436] ? set_user_sigmask+0xc7/0x1b0 [ 1499.215225][ T4436] ? __pfx_set_user_sigmask+0x10/0x10 [ 1499.215245][ T4436] ? __fget_files+0x3a0/0x420 [ 1499.215272][ T4436] __se_sys_ppoll+0x1ff/0x260 [ 1499.215293][ T4436] ? __pfx___se_sys_ppoll+0x10/0x10 [ 1499.215310][ T4436] ? __pfx_ksys_write+0x10/0x10 [ 1499.215324][ T4436] ? rcu_is_watching+0x15/0xb0 [ 1499.215355][ T4436] ? do_syscall_64+0xbe/0x3b0 [ 1499.215374][ T4436] ? __x64_sys_ppoll+0x20/0xc0 [ 1499.215402][ T4436] do_syscall_64+0xfa/0x3b0 [ 1499.215420][ T4436] ? lockdep_hardirqs_on+0x9c/0x150 [ 1499.215438][ T4436] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1499.215454][ T4436] ? clear_bhb_loop+0x60/0xb0 [ 1499.215475][ T4436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1499.215492][ T4436] RIP: 0033:0x7f15cb58e929 [ 1499.215508][ T4436] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1499.215522][ T4436] RSP: 002b:00007f15cc4d2038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 1499.215542][ T4436] RAX: ffffffffffffffda RBX: 00007f15cb7b5fa0 RCX: 00007f15cb58e929 [ 1499.215554][ T4436] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000180 [ 1499.215566][ T4436] RBP: 00007f15cc4d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1499.215577][ T4436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1499.215588][ T4436] R13: 0000000000000000 R14: 00007f15cb7b5fa0 R15: 00007ffe4ab2d078 [ 1499.215613][ T4436] [ 1499.559928][ T4443] netlink: 40 bytes leftover after parsing attributes in process `syz.8.9397'. [ 1499.637238][ T4447] /dev/rnullb0: Can't lookup blockdev [ 1499.730286][ T4451] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9399'. [ 1499.764329][ T4451] /dev/rnullb0: Can't lookup blockdev [ 1499.774018][T26473] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1499.850543][ T3598] usb 3-1: USB disconnect, device number 119 [ 1499.935747][T26473] usb 1-1: config 1 has an invalid descriptor of length 117, skipping remainder of the config [ 1499.956355][T26473] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1499.973799][T26473] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1500.009058][T26473] usb 1-1: Product: syz [ 1500.013272][T26473] usb 1-1: Manufacturer: syz [ 1500.024814][T26473] usb 1-1: SerialNumber: syz [ 1500.270419][ T4428] /dev/rnullb0: Can't lookup blockdev [ 1500.290162][T26473] usb 1-1: selecting invalid altsetting 1 [ 1500.314227][T26473] cdc_ncm 1-1:1.0: bind() failure [ 1500.345261][ T4473] FAULT_INJECTION: forcing a failure. [ 1500.345261][ T4473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1500.354489][T26473] usb 1-1: USB disconnect, device number 23 [ 1500.373989][ T4473] CPU: 1 UID: 0 PID: 4473 Comm: syz.2.9403 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1500.374014][ T4473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1500.374024][ T4473] Call Trace: [ 1500.374031][ T4473] [ 1500.374039][ T4473] dump_stack_lvl+0x189/0x250 [ 1500.374065][ T4473] ? __pfx____ratelimit+0x10/0x10 [ 1500.374085][ T4473] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1500.374131][ T4473] ? __pfx__printk+0x10/0x10 [ 1500.374164][ T4473] should_fail_ex+0x414/0x560 [ 1500.374192][ T4473] _copy_to_user+0x31/0xb0 [ 1500.374217][ T4473] simple_read_from_buffer+0xe1/0x170 [ 1500.374238][ T4473] proc_fail_nth_read+0x1df/0x250 [ 1500.374268][ T4473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1500.374289][ T4473] ? rw_verify_area+0x258/0x650 [ 1500.374311][ T4473] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1500.374331][ T4473] vfs_read+0x200/0x980 [ 1500.374360][ T4473] ? __pfx___mutex_lock+0x10/0x10 [ 1500.374378][ T4473] ? __pfx_vfs_read+0x10/0x10 [ 1500.374403][ T4473] ? __fget_files+0x2a/0x420 [ 1500.374424][ T4473] ? __fget_files+0x3a0/0x420 [ 1500.374440][ T4473] ? __fget_files+0x2a/0x420 [ 1500.374466][ T4473] ksys_read+0x145/0x250 [ 1500.374491][ T4473] ? __pfx_ksys_read+0x10/0x10 [ 1500.374512][ T4473] ? rcu_is_watching+0x15/0xb0 [ 1500.374537][ T4473] ? do_syscall_64+0xbe/0x3b0 [ 1500.374558][ T4473] do_syscall_64+0xfa/0x3b0 [ 1500.374576][ T4473] ? lockdep_hardirqs_on+0x9c/0x150 [ 1500.374593][ T4473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.374610][ T4473] ? clear_bhb_loop+0x60/0xb0 [ 1500.374631][ T4473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.374645][ T4473] RIP: 0033:0x7fdd25b8d33c [ 1500.374661][ T4473] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1500.374673][ T4473] RSP: 002b:00007fdd2691b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1500.374692][ T4473] RAX: ffffffffffffffda RBX: 00007fdd25db5fa0 RCX: 00007fdd25b8d33c [ 1500.374704][ T4473] RDX: 000000000000000f RSI: 00007fdd2691b0a0 RDI: 0000000000000004 [ 1500.374714][ T4473] RBP: 00007fdd2691b090 R08: 0000000000000000 R09: 0000000000000000 [ 1500.374724][ T4473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1500.374734][ T4473] R13: 0000000000000000 R14: 00007fdd25db5fa0 R15: 00007ffcb7212c68 [ 1500.374760][ T4473] [ 1500.925856][ T4491] FAULT_INJECTION: forcing a failure. [ 1500.925856][ T4491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1501.003801][ T4491] CPU: 0 UID: 0 PID: 4491 Comm: syz.2.9405 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1501.003827][ T4491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1501.003837][ T4491] Call Trace: [ 1501.003845][ T4491] [ 1501.003852][ T4491] dump_stack_lvl+0x189/0x250 [ 1501.003878][ T4491] ? __pfx____ratelimit+0x10/0x10 [ 1501.003897][ T4491] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1501.003920][ T4491] ? __pfx__printk+0x10/0x10 [ 1501.003951][ T4491] should_fail_ex+0x414/0x560 [ 1501.003980][ T4491] _copy_to_user+0x31/0xb0 [ 1501.004005][ T4491] simple_read_from_buffer+0xe1/0x170 [ 1501.004029][ T4491] proc_fail_nth_read+0x1df/0x250 [ 1501.004055][ T4491] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.004080][ T4491] ? rw_verify_area+0x258/0x650 [ 1501.004103][ T4491] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.004126][ T4491] vfs_read+0x200/0x980 [ 1501.004156][ T4491] ? __pfx___mutex_lock+0x10/0x10 [ 1501.004176][ T4491] ? __pfx_vfs_read+0x10/0x10 [ 1501.004202][ T4491] ? __fget_files+0x2a/0x420 [ 1501.004225][ T4491] ? __fget_files+0x3a0/0x420 [ 1501.004241][ T4491] ? __fget_files+0x2a/0x420 [ 1501.004266][ T4491] ksys_read+0x145/0x250 [ 1501.004292][ T4491] ? __pfx_ksys_read+0x10/0x10 [ 1501.004313][ T4491] ? rcu_is_watching+0x15/0xb0 [ 1501.004340][ T4491] ? do_syscall_64+0xbe/0x3b0 [ 1501.004364][ T4491] do_syscall_64+0xfa/0x3b0 [ 1501.004382][ T4491] ? lockdep_hardirqs_on+0x9c/0x150 [ 1501.004401][ T4491] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1501.004419][ T4491] ? clear_bhb_loop+0x60/0xb0 [ 1501.004447][ T4491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1501.004464][ T4491] RIP: 0033:0x7fdd25b8d33c [ 1501.004481][ T4491] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1501.004495][ T4491] RSP: 002b:00007fdd2691b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1501.004524][ T4491] RAX: ffffffffffffffda RBX: 00007fdd25db5fa0 RCX: 00007fdd25b8d33c [ 1501.004538][ T4491] RDX: 000000000000000f RSI: 00007fdd2691b0a0 RDI: 0000000000000004 [ 1501.004550][ T4491] RBP: 00007fdd2691b090 R08: 0000000000000000 R09: 0000000000000000 [ 1501.004561][ T4491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1501.004572][ T4491] R13: 0000000000000000 R14: 00007fdd25db5fa0 R15: 00007ffcb7212c68 [ 1501.004601][ T4491] [ 1501.244461][ C0] vkms_vblank_simulate: vblank timer overrun [ 1501.440453][T14772] Bluetooth: hci2: unexpected event 0x2f length: 509 > 260 [ 1501.541467][ T4507] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9408'. [ 1501.581116][ T4456] cgroup: fork rejected by pids controller in /syz8 [ 1501.611129][ T4507] /dev/rnullb0: Can't lookup blockdev [ 1501.894456][ T4529] loop6: detected capacity change from 0 to 7 [ 1501.953899][ T4529] Dev loop6: unable to read RDB block 7 [ 1501.971562][ T4529] loop6: unable to read partition table [ 1501.991701][ T4529] loop6: partition table beyond EOD, truncated [ 1502.014086][ T4529] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1502.413680][T19811] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 1502.614058][T22925] usb 3-1: new low-speed USB device number 120 using dummy_hcd [ 1502.783709][T22925] usb 3-1: Invalid ep0 maxpacket: 16 [ 1502.792730][ T4566] /dev/rnullb0: Can't lookup blockdev [ 1502.913713][T22925] usb 3-1: new low-speed USB device number 121 using dummy_hcd [ 1502.999481][ T4569] ./file0: Can't lookup blockdev [ 1503.055608][ T4573] /dev/rnullb0: Can't lookup blockdev [ 1503.066596][T22925] usb 3-1: Invalid ep0 maxpacket: 16 [ 1503.072589][ T4573] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9418'. [ 1503.081860][T22925] usb usb3-port1: attempt power cycle [ 1503.220853][ T4580] netlink: 64 bytes leftover after parsing attributes in process `syz.8.9421'. [ 1503.231176][ T4580] /dev/rnullb0: Can't lookup blockdev [ 1503.290944][ T4584] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9423'. [ 1503.389937][ T4587] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1503.424660][T22925] usb 3-1: new low-speed USB device number 122 using dummy_hcd [ 1503.445887][T22925] usb 3-1: Invalid ep0 maxpacket: 16 [ 1503.573765][T22925] usb 3-1: new low-speed USB device number 123 using dummy_hcd [ 1503.604600][T22925] usb 3-1: Invalid ep0 maxpacket: 16 [ 1503.610355][T22925] usb usb3-port1: unable to enumerate USB device [ 1503.623872][T19811] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1503.783635][T19811] usb 1-1: device descriptor read/64, error -71 [ 1503.898164][T19811] usb usb1-port1: attempt power cycle [ 1504.247939][T19811] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1504.274548][T19811] usb 1-1: device descriptor read/8, error -71 [ 1504.517128][T19811] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1504.546473][T19811] usb 1-1: device descriptor read/8, error -71 [ 1504.658285][T19811] usb usb1-port1: unable to enumerate USB device [ 1505.491830][ T4600] /dev/rnullb0: Can't lookup blockdev [ 1505.913640][T26474] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1506.073530][T26474] usb 3-1: Using ep0 maxpacket: 16 [ 1506.096364][T26474] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1506.115486][T26474] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1506.125820][T26474] usb 3-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1506.136931][T26474] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1506.164333][T26474] usb 3-1: config 0 descriptor?? [ 1506.242082][ T4616] netlink: 'syz.0.9432': attribute type 1 has an invalid length. [ 1506.252279][ T4616] netlink: 'syz.0.9432': attribute type 101 has an invalid length. [ 1506.260347][ T4616] netlink: 564 bytes leftover after parsing attributes in process `syz.0.9432'. [ 1506.550761][ T4626] /dev/rnullb0: Can't lookup blockdev [ 1506.579364][T26474] usbhid 3-1:0.0: can't add hid device: -71 [ 1506.588337][T26474] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1506.600053][T26474] usb 3-1: USB disconnect, device number 124 [ 1506.763221][ T4633] bio_check_eod: 2 callbacks suppressed [ 1506.763233][ T4633] syz.0.9437: attempt to access beyond end of device [ 1506.763233][ T4633] nbd0: rw=0, sector=2, nr_sectors = 2 limit=0 [ 1506.783163][ T4633] vxfs: unable to read disk superblock at 1 [ 1506.790161][ T4633] syz.0.9437: attempt to access beyond end of device [ 1506.790161][ T4633] nbd0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 1506.804369][ T4633] vxfs: unable to read disk superblock at 8 [ 1506.810295][ T4633] vxfs: can't find superblock. [ 1506.977722][ T4638] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1507.030501][ T4641] /dev/rnullb0: Can't lookup blockdev [ 1507.197280][ T4646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9442'. [ 1507.210951][ T4646] netlink: 739 bytes leftover after parsing attributes in process `syz.2.9442'. [ 1508.602249][ T4719] /dev/rnullb0: Can't lookup blockdev [ 1508.655286][ T4721] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9468'. [ 1508.872123][ T4731] /dev/rnullb0: Can't lookup blockdev [ 1508.943579][ T5941] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 1508.982071][ T4733] 9pnet: Could not find request transport: xen [ 1509.115300][ T5941] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1509.123416][ T5941] usb 3-1: config 0 has no interface number 0 [ 1509.131781][ T5941] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1509.141575][ T5941] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1509.149790][ T5941] usb 3-1: Product: syz [ 1509.154314][ T5941] usb 3-1: Manufacturer: syz [ 1509.158932][ T5941] usb 3-1: SerialNumber: syz [ 1509.166358][ T5941] usb 3-1: config 0 descriptor?? [ 1509.303332][T19811] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1509.400397][ T4724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9469'. [ 1509.411184][ T4724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9469'. [ 1509.466529][T19811] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1509.480933][T19811] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1509.491966][T19811] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1509.497952][ T5941] dvb_usb_ec168 3-1:0.1: probe with driver dvb_usb_ec168 failed with error -71 [ 1509.502059][T19811] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1509.528522][ T5941] usb 3-1: USB disconnect, device number 125 [ 1509.566244][T19811] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1509.576979][T19811] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1509.596035][T19811] usb 1-1: config 0 descriptor?? [ 1509.677803][ T4748] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9478'. [ 1509.766768][ T4751] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1509.811828][ T4740] netlink: 4268 bytes leftover after parsing attributes in process `syz.0.9475'. [ 1509.822605][ T4740] netlink: 4268 bytes leftover after parsing attributes in process `syz.0.9475'. [ 1509.845647][T19811] hid_parser_main: 20 callbacks suppressed [ 1509.845670][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.861968][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.870174][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.879759][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.887397][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.894888][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.902285][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.909973][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.917442][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.928685][T19811] plantronics 0003:047F:FFFF.00BB: unknown main item tag 0x0 [ 1509.942720][T19811] plantronics 0003:047F:FFFF.00BB: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1510.178397][T26474] usb 1-1: USB disconnect, device number 28 [ 1510.247702][ T4760] delete_channel: no stack [ 1510.252196][ T4760] delete_channel: no stack [ 1510.311111][ T4762] binder: 4761:4762 ioctl c00c620f 0 returned -14 [ 1510.369139][ T30] audit: type=1804 audit(2000000166.843:10932): pid=4764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.9484" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1510.589840][ T4775] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9487'. [ 1511.138737][ T4800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1511.150646][ T4800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1511.180898][ T4802] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1511.363238][ T5921] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 1511.503365][ T5921] usb 1-1: device descriptor read/64, error -71 [ 1511.763564][ T5921] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 1511.913413][ T5921] usb 1-1: device descriptor read/64, error -71 [ 1511.983318][T25146] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1512.034183][ T5921] usb usb1-port1: attempt power cycle [ 1512.166756][T25146] usb 3-1: Using ep0 maxpacket: 16 [ 1512.186323][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1512.198052][T25146] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1512.208934][T25146] usb 3-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1512.219496][T25146] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1512.242035][T25146] usb 3-1: config 0 descriptor?? [ 1512.328568][ T4843] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9496'. [ 1512.421787][ T5921] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 1512.454247][ T5921] usb 1-1: device descriptor read/8, error -71 [ 1512.517962][ T4850] /dev/rnullb0: Can't lookup blockdev [ 1512.665429][ T4823] netlink: 1068 bytes leftover after parsing attributes in process `syz.2.9495'. [ 1512.681809][T25146] usbhid 3-1:0.0: can't add hid device: -71 [ 1512.713791][ T5921] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 1512.722249][T25146] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1512.742587][T25146] usb 3-1: USB disconnect, device number 126 [ 1512.754821][ T5921] usb 1-1: device descriptor read/8, error -71 [ 1512.884305][ T5921] usb usb1-port1: unable to enumerate USB device [ 1512.950245][ T4871] /dev/rnullb0: Can't lookup blockdev [ 1513.246404][ T4883] netlink: 168 bytes leftover after parsing attributes in process `syz.4.9502'. [ 1513.425509][ T4892] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9505'. [ 1513.563745][ T4897] Invalid ELF header type: 2 != 1 [ 1513.573944][ T4897] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1513.580183][ T4897] /dev/rnullb0: Can't lookup blockdev [ 1513.919097][ T4915] /dev/rnullb0: Can't lookup blockdev [ 1513.928336][ T4916] /dev/rnullb0: Can't lookup blockdev [ 1514.263581][ T3598] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1514.338644][ T4931] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9513'. [ 1514.358527][ T4931] /dev/rnullb0: Can't lookup blockdev [ 1514.360946][ T4933] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9514'. [ 1514.427858][ T3598] usb 3-1: Using ep0 maxpacket: 16 [ 1514.436576][ T3598] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1514.450139][ T3598] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1514.460169][ T3598] usb 3-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1514.470587][ T3598] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1514.497590][ T3598] usb 3-1: config 0 descriptor?? [ 1514.772854][ T4947] /dev/rnullb0: Can't lookup blockdev [ 1514.933783][ T4920] netlink: 1068 bytes leftover after parsing attributes in process `syz.2.9511'. [ 1514.951799][ T3598] usbhid 3-1:0.0: can't add hid device: -71 [ 1514.961002][ T3598] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1514.972276][ T3598] usb 3-1: USB disconnect, device number 127 [ 1515.570195][ T4958] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9524'. [ 1515.632370][ T4961] wg2: entered promiscuous mode [ 1515.641706][ T4961] wg2: entered allmulticast mode [ 1515.662350][ T4961] /dev/rnullb0: Can't lookup blockdev [ 1515.947281][ T4969] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1516.082753][ T4983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9534'. [ 1516.401278][ T4997] afs: Unknown parameter 'P ' [ 1516.632560][ T5013] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1516.643722][ T5013] netlink: 'syz.0.9542': attribute type 2 has an invalid length. [ 1516.729906][ T5015] /dev/rnullb0: Can't lookup blockdev [ 1516.806864][ T5018] netlink: 1192 bytes leftover after parsing attributes in process `syz.8.9544'. [ 1516.818311][ T5018] /dev/rnullb0: Can't lookup blockdev [ 1516.999592][ T5027] /dev/rnullb0: Can't lookup blockdev [ 1517.069758][ T5029] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1517.076760][ T5029] /dev/rnullb0: Can't lookup blockdev [ 1517.208554][ T5036] overlay: Unknown parameter 'uid' [ 1517.221444][ T5036] ./cgroup: Can't lookup blockdev [ 1517.373080][T22925] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1517.534647][T22925] usb 1-1: Using ep0 maxpacket: 32 [ 1517.548679][T22925] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 1517.567424][T22925] usb 1-1: config 0 has no interface number 0 [ 1517.581092][T22925] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1517.595969][T22925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1517.607911][T22925] usb 1-1: Product: syz [ 1517.612662][T22925] usb 1-1: Manufacturer: syz [ 1517.618051][T22925] usb 1-1: SerialNumber: syz [ 1517.630884][T22925] usb 1-1: config 0 descriptor?? [ 1517.650323][T22925] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1517.824737][ T5051] __nla_validate_parse: 1 callbacks suppressed [ 1517.824756][ T5051] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9558'. [ 1517.851632][T22925] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1517.880477][T22925] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1518.040809][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - port change to invalid port: 5 [ 1518.339499][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1518.340084][T19811] usb 1-1: USB disconnect, device number 33 [ 1518.354528][ T5063] program syz.8.9561 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1518.380287][T19811] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1518.465967][T19811] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1518.489420][ T5067] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9562'. [ 1518.507444][T19811] quatech2 1-1:0.51: device disconnected [ 1518.627358][ T5067] x_tables: duplicate entry at hook 1 [ 1518.656539][ T5074] netlink: 'syz.2.9564': attribute type 29 has an invalid length. [ 1518.837864][ T5074] netlink: 'syz.2.9564': attribute type 12 has an invalid length. [ 1518.883047][ T5075] netlink: 'syz.2.9564': attribute type 29 has an invalid length. [ 1518.932994][ T5084] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9567'. [ 1519.289094][ T5095] tun0: tun_chr_ioctl cmd 1074025676 [ 1519.302722][ T5095] tun0: owner set to 0 [ 1519.317658][ T5095] tun0: tun_chr_ioctl cmd 2147767506 [ 1519.563763][ T5099] tmpfs: Bad value for 'mpol' [ 1519.972856][T22925] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1520.145611][T22925] usb 1-1: Using ep0 maxpacket: 16 [ 1520.162068][T22925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1520.192821][T22925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1520.213066][T22925] usb 1-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1520.222147][T22925] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1520.265060][T22925] usb 1-1: config 0 descriptor?? [ 1520.349319][ T5123] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9579'. [ 1520.433515][ T5126] syzkaller1: entered promiscuous mode [ 1520.444017][ T5126] syzkaller1: entered allmulticast mode [ 1520.459895][ T5128] cgroup: Bad value for 'name' [ 1520.658829][ T5131] dvmrp0: entered allmulticast mode [ 1520.675495][ T5109] netlink: 1068 bytes leftover after parsing attributes in process `syz.0.9576'. [ 1520.721834][T22925] usbhid 1-1:0.0: can't add hid device: -71 [ 1520.728379][T22925] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1520.733964][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.741469][T22925] usb 1-1: USB disconnect, device number 34 [ 1520.784454][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.800490][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.807980][ T5138] /dev/rnullb0: Can't lookup blockdev [ 1520.843188][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.849066][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.876589][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.882408][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.893294][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.900189][ T5140] netlink: 'syz.2.9586': attribute type 30 has an invalid length. [ 1520.933141][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.938818][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.953042][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.958866][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.979289][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1520.997923][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.013613][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.019264][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.025135][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.031018][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.036977][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.048748][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.054709][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.060582][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.072021][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.079432][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.099324][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.111083][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.117480][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.124059][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.129959][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.136843][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.143021][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.148883][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.156163][ T5136] /dev/rnullb0: Can't lookup blockdev [ 1521.233257][ T5922] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1521.341542][ T5150] /dev/rnullb0: Can't lookup blockdev [ 1521.409251][ T5922] usb 3-1: Using ep0 maxpacket: 32 [ 1521.416399][ T5922] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1521.433991][ T5922] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1521.445419][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1521.453987][ T5922] usb 3-1: Product: syz [ 1521.458165][ T5922] usb 3-1: Manufacturer: syz [ 1521.463418][ T5922] usb 3-1: SerialNumber: syz [ 1521.470783][ T5922] usb 3-1: config 0 descriptor?? [ 1521.477012][ T5145] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1521.488398][ T5922] hub 3-1:0.0: bad descriptor, ignoring hub [ 1521.498670][ T5922] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1521.523486][ T5156] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9590'. [ 1521.562829][T19811] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1521.736377][T19811] usb 1-1: Using ep0 maxpacket: 16 [ 1521.746819][T19811] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1521.764392][T19811] usb 1-1: config 0 has no interface number 0 [ 1521.770913][T19811] usb 1-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1521.783346][T19811] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1521.795123][T19811] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1521.807759][T26474] usb 3-1: USB disconnect, device number 2 [ 1521.824512][T19811] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1521.844147][T19811] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1521.857985][T19811] usb 1-1: Product: syz [ 1521.862190][T19811] usb 1-1: SerialNumber: syz [ 1521.878062][T19811] usb 1-1: config 0 descriptor?? [ 1521.885137][ T5153] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1521.896521][T19811] cm109 1-1:0.8: invalid payload size 1024, expected 4 [ 1521.920012][T19811] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input133 [ 1522.113796][ C0] cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71 [ 1522.162756][T26474] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1522.318774][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.326474][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.333886][T26474] usb 3-1: Using ep0 maxpacket: 32 [ 1522.339906][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.347071][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.354272][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.361403][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.368759][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.375832][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.382899][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.389924][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1522.402817][T19811] usb 1-1: USB disconnect, device number 35 [ 1522.402875][ C0] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1522.463932][T19811] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1522.481019][T26474] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1522.505676][T26474] usb 3-1: string descriptor 0 read error: -22 [ 1522.512093][T26474] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1522.534553][T26474] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1522.555052][T26474] usb 3-1: config 0 descriptor?? [ 1522.560947][ T5145] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1522.573772][T26474] hub 3-1:0.0: bad descriptor, ignoring hub [ 1522.579699][T26474] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1522.811531][ T5145] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1523.084212][T19811] usb 3-1: USB disconnect, device number 3 [ 1523.295268][T22925] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 1523.452612][T22925] usb 1-1: Using ep0 maxpacket: 16 [ 1523.460528][T22925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1523.472518][T22925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1523.482326][T22925] usb 1-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1523.520802][T22925] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1523.534618][T22925] usb 1-1: config 0 descriptor?? [ 1523.559667][ T5189] bpf: Bad value for 'gid' [ 1523.662870][ T5191] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9599'. [ 1523.959314][ T5182] netlink: 1068 bytes leftover after parsing attributes in process `syz.0.9597'. [ 1523.972151][T22925] usbhid 1-1:0.0: can't add hid device: -71 [ 1523.982107][T22925] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1523.995194][T22925] usb 1-1: USB disconnect, device number 36 [ 1524.657650][ T5217] vcan0: entered allmulticast mode [ 1524.667683][ T5217] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1524.677424][ T5218] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1524.688486][ T5217] syz.0.9607: attempt to access beyond end of device [ 1524.688486][ T5217] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1524.701412][ T5217] hpfs: hpfs_map_sector(): read error [ 1524.790936][ T5220] /dev/rnullb0: Can't lookup blockdev [ 1524.842722][ T5222] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9609'. [ 1525.068727][ T5232] netdevsim netdevsim2: Direct firmware load for  failed with error -2 [ 1525.082021][ T5232] netdevsim netdevsim2: Falling back to sysfs fallback for:  [ 1525.121021][ T5235] /dev/rnullb0: Can't lookup blockdev [ 1525.253760][ T5240] /dev/rnullb0: Can't lookup blockdev [ 1525.655296][T19811] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1525.812425][T19811] usb 1-1: Using ep0 maxpacket: 8 [ 1525.819509][T19811] usb 1-1: config index 0 descriptor too short (expected 6427, got 27) [ 1525.828420][T19811] usb 1-1: config 0 has an invalid interface number: 21 but max is 0 [ 1525.836746][T19811] usb 1-1: config 0 has no interface number 0 [ 1525.843344][T19811] usb 1-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1525.856196][T19811] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1525.871079][T19811] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1525.884588][T19811] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1525.894918][T19811] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 1525.903065][T19811] usb 1-1: Product: syz [ 1525.911594][T19811] usb 1-1: config 0 descriptor?? [ 1525.918116][ T5246] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1526.020193][ T5248] /dev/rnullb0: Can't lookup blockdev [ 1526.110083][ T5252] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9619'. [ 1526.150587][ T5254] syz.8.9620: attempt to access beyond end of device [ 1526.150587][ T5254] nbd8: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1526.163904][ T5254] hpfs: hpfs_map_sector(): read error [ 1526.234573][ T5256] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1526.410448][ T30] audit: type=1804 audit(2000000182.874:10933): pid=5260 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.9623" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1526.578566][T19811] usb 1-1: USB disconnect, device number 37 [ 1526.720757][ T5270] /dev/rnullb0: Can't lookup blockdev [ 1526.766786][ T5272] /dev/rnullb0: Can't lookup blockdev [ 1526.808654][ T5274] /dev/rnullb0: Can't lookup blockdev [ 1526.852186][ T5276] /dev/rnullb0: Can't lookup blockdev [ 1527.191175][ T5292] netlink: 'syz.0.9636': attribute type 1 has an invalid length. [ 1527.203153][ T5292] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1527.215466][ T5292] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1527.221396][ T5292] /dev/rnullb0: Can't lookup blockdev [ 1527.316516][ T5294] /dev/rnullb0: Can't lookup blockdev [ 1527.412427][ T5921] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1527.564372][ T5921] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1527.577181][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1527.593388][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1527.604863][ T5921] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1527.618230][ T5921] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1527.620355][ T5305] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 1527.627499][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1527.630251][ T5921] usb 3-1: config 0 descriptor?? [ 1527.652104][ T5305] overlayfs: fs on './bus' does not support file handles, falling back to index=off,nfs_export=off. [ 1527.671995][ T5305] overlayfs: conflicting lowerdir path [ 1527.792874][ T5314] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1528.042527][ T5922] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1528.077952][ T5921] hid_parser_main: 5 callbacks suppressed [ 1528.077975][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.091407][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.098852][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.106395][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.114409][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.122012][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.130032][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.138139][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.146613][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.154199][ T5921] plantronics 0003:047F:FFFF.00BC: unknown main item tag 0x0 [ 1528.167063][ T5921] plantronics 0003:047F:FFFF.00BC: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1528.225775][ T5922] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1528.239892][ T5922] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1528.252745][ T5922] usb 1-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1528.266657][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1528.279078][ T5922] usb 1-1: Product: syz [ 1528.284128][ T5922] usb 1-1: Manufacturer: syz [ 1528.288732][ T5922] usb 1-1: SerialNumber: syz [ 1528.295714][ T5922] usb 1-1: config 0 descriptor?? [ 1528.379844][ T5921] usb 3-1: USB disconnect, device number 4 [ 1529.049241][ T5322] netlink: 'syz.2.9644': attribute type 1 has an invalid length. [ 1529.058774][ T5322] syz.2.9644: attempt to access beyond end of device [ 1529.058774][ T5322] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1529.074358][ T5322] hpfs: hpfs_map_sector(): read error [ 1529.213747][ T5328] /dev/rnullb0: Can't lookup blockdev [ 1529.456272][ T5336] /dev/rnullb0: Can't lookup blockdev [ 1529.533012][ T5340] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1530.009565][ T5363] netlink: 140 bytes leftover after parsing attributes in process `syz.8.9659'. [ 1530.012465][ T5364] /dev/rnullb0: Can't lookup blockdev [ 1530.104326][ T5367] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9661'. [ 1530.574945][T26474] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1530.732179][T26474] usb 3-1: Using ep0 maxpacket: 8 [ 1530.738906][T26474] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1530.750085][T26474] usb 3-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 1530.759307][T26474] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1530.777870][T26474] usb 3-1: config 0 descriptor?? [ 1530.810944][ T5921] usb 1-1: USB disconnect, device number 38 [ 1530.861524][ T5381] /dev/rnullb0: Can't lookup blockdev [ 1530.870287][ T5381] /dev/rnullb0: Can't lookup blockdev [ 1531.190089][T26474] wacom 0003:056A:0003.00BD: unexpected long global item [ 1531.197692][T26474] wacom 0003:056A:0003.00BD: parse failed [ 1531.204289][T26474] wacom 0003:056A:0003.00BD: probe with driver wacom failed with error -22 [ 1531.223898][ T5921] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1531.388240][ T5921] usb 1-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 1531.398434][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.408414][ T5921] usb 1-1: Product: syz [ 1531.413713][ T5921] usb 1-1: Manufacturer: syz [ 1531.418472][ T5921] usb 1-1: SerialNumber: syz [ 1531.420957][T26474] usb 3-1: USB disconnect, device number 5 [ 1531.426692][ T5921] usb 1-1: config 0 descriptor?? [ 1531.449138][ T5921] hub 1-1:0.0: bad descriptor, ignoring hub [ 1531.472607][ T5921] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1531.489347][ T5921] f81232 1-1:0.0: f81534a converter detected [ 1531.655715][ T5383] /dev/rnullb0: Can't lookup blockdev [ 1531.662799][ T5921] f81534a ttyUSB0: f81232_set_register failed status: -71 [ 1531.669941][ T5921] f81534a ttyUSB0: probe with driver f81534a failed with error -5 [ 1531.713735][ T5921] usb 1-1: USB disconnect, device number 39 [ 1531.722638][ T5921] f81232 1-1:0.0: device disconnected [ 1532.142148][T26474] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1532.220609][ T5400] kernel read not supported for file /file1 (pid: 5400 comm: syz.0.9672) [ 1532.230471][ T30] audit: type=1800 audit(2000000188.694:10934): pid=5400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.9672" name="file1" dev="mqueue" ino=210428 res=0 errno=0 [ 1532.294209][T26474] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1532.309858][T26474] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1532.315279][ T5402] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1532.323102][T26474] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1532.330405][ T5402] /dev/rnullb0: Can't lookup blockdev [ 1532.336666][T26474] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1532.353695][T26474] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1532.368452][T26474] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1532.378374][T26474] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1532.386973][T26474] usb 3-1: Product: syz [ 1532.391287][T26474] usb 3-1: Manufacturer: syz [ 1532.406568][T26474] cdc_wdm 3-1:1.0: skipping garbage [ 1532.412319][T26474] cdc_wdm 3-1:1.0: skipping garbage [ 1532.424046][T26474] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 1532.429980][T26474] cdc_wdm 3-1:1.0: Unknown control protocol [ 1532.501085][ T5407] ./file0: Can't lookup blockdev [ 1532.541778][ T5411] /dev/rnullb0: Can't lookup blockdev [ 1533.165252][ T3598] usb 3-1: USB disconnect, device number 6 [ 1533.340036][ T30] audit: type=1804 audit(2000000189.804:10935): pid=5420 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.9678" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1533.501486][ T5425] /dev/rnullb0: Can't lookup blockdev [ 1533.521659][ T5426] tipc: Can't bind to reserved service type 2 [ 1533.676031][ T5436] /dev/rnullb0: Can't lookup blockdev [ 1533.877518][ T5454] nftables ruleset with unbound set [ 1534.022101][ T3598] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1534.059186][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9691'. [ 1534.076983][ T5466] /dev/rnullb0: Can't lookup blockdev [ 1534.094604][ T5468] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9691'. [ 1534.196252][ T3598] usb 1-1: Using ep0 maxpacket: 16 [ 1534.216565][ T5476] /dev/rnullb0: Can't lookup blockdev [ 1534.218130][ T3598] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1534.239541][ T3598] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1534.249783][ T3598] usb 1-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1534.259372][ T3598] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.270420][ T3598] usb 1-1: config 0 descriptor?? [ 1534.295964][ T5479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.305178][ T5479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1534.329023][ T5479] /dev/rnullb0: Can't lookup blockdev [ 1534.336406][ T5480] /dev/rnullb0: Can't lookup blockdev [ 1534.364691][ T5482] cgroup: subsys name conflicts with all [ 1534.366636][ T5483] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1534.380250][ T5482] /dev/rnullb0: Can't lookup blockdev [ 1534.671964][T19811] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1534.689025][ T3598] usbhid 1-1:0.0: can't add hid device: -71 [ 1534.700148][ T3598] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1534.713173][ T3598] usb 1-1: USB disconnect, device number 40 [ 1534.823792][T19811] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1534.836818][T19811] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1534.848018][T19811] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1534.857944][T19811] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1534.870861][T19811] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1534.880020][T19811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.891699][T19811] usb 3-1: config 0 descriptor?? [ 1535.109958][ T5486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1535.118830][ T5486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1535.335241][T19811] hid_parser_main: 5 callbacks suppressed [ 1535.335265][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.349265][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.358338][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.366008][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.373763][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.381173][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.388682][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.396144][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.403599][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.411000][T19811] plantronics 0003:047F:FFFF.00BE: unknown main item tag 0x0 [ 1535.424472][T19811] plantronics 0003:047F:FFFF.00BE: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1535.640809][T22925] usb 3-1: USB disconnect, device number 7 [ 1536.199039][ T5497] /dev/rnullb0: Can't lookup blockdev [ 1536.262336][ T5499] /dev/rnullb0: Can't lookup blockdev [ 1536.522138][T22925] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 1536.692028][T22925] usb 3-1: Invalid ep0 maxpacket: 64 [ 1536.702044][ T5507] /dev/rnullb0: Can't lookup blockdev [ 1536.821950][T22925] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 1536.981827][T22925] usb 3-1: Invalid ep0 maxpacket: 64 [ 1536.990645][T22925] usb usb3-port1: attempt power cycle [ 1537.317428][ T5523] syz.4.9707: attempt to access beyond end of device [ 1537.317428][ T5523] loop4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 1537.333373][T22925] usb 3-1: new low-speed USB device number 10 using dummy_hcd [ 1537.341161][ T5523] XFS (loop4): SB validate failed with error -5. [ 1537.377532][T22925] usb 3-1: Invalid ep0 maxpacket: 64 [ 1537.441602][ T5530] netlink: 'syz.4.9708': attribute type 4 has an invalid length. [ 1537.451380][ T5530] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9708'. [ 1537.473493][ T5530] : renamed from bond0 (while UP) [ 1537.501901][T26474] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 1537.521918][T22925] usb 3-1: new low-speed USB device number 11 using dummy_hcd [ 1537.554066][T22925] usb 3-1: Invalid ep0 maxpacket: 64 [ 1537.559655][T22925] usb usb3-port1: unable to enumerate USB device [ 1537.651761][T26474] usb 1-1: Using ep0 maxpacket: 16 [ 1537.658741][T26474] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1537.670712][T26474] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1537.681313][T26474] usb 1-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1537.690573][T26474] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1537.701481][T26474] usb 1-1: config 0 descriptor?? [ 1538.127160][T26474] usbhid 1-1:0.0: can't add hid device: -71 [ 1538.136296][T26474] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1538.147488][T26474] usb 1-1: USB disconnect, device number 41 [ 1538.911819][ T5921] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 1539.064731][ T5921] usb 1-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 1539.077831][ T5921] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1539.087011][ T5921] usb 1-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.40 [ 1539.096346][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.104751][ T5921] usb 1-1: Product: Ы [ 1539.108974][ T5921] usb 1-1: Manufacturer: 㐁 [ 1539.116174][ T5921] usb 1-1: SerialNumber: syz [ 1539.353851][ T5921] usbhid 1-1:1.0: can't add hid device: -71 [ 1539.360118][ T5921] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 1539.373756][ T5921] usb 1-1: USB disconnect, device number 42 [ 1539.909633][ T5538] /dev/rnullb0: Can't lookup blockdev [ 1540.271798][ T980] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 1540.431692][ T980] usb 1-1: Using ep0 maxpacket: 16 [ 1540.438983][ T980] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1540.452381][ T980] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1540.466620][ T980] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1540.476176][ T980] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1540.484562][ T980] usb 1-1: Product: syz [ 1540.488819][ T980] usb 1-1: Manufacturer: syz [ 1540.500582][ T980] usb 1-1: SerialNumber: syz [ 1540.508403][ T980] usb 1-1: config 0 descriptor?? [ 1540.524605][ T980] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1540.537232][ T980] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 1540.581617][ T5921] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1540.735793][ T5921] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1540.746992][ T5921] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1540.760213][ T5921] usb 3-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1540.779985][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1540.790094][ T5921] usb 3-1: Product: syz [ 1540.799553][ T5921] usb 3-1: Manufacturer: syz [ 1540.804532][ T5921] usb 3-1: SerialNumber: syz [ 1540.813225][ T5921] usb 3-1: config 0 descriptor?? [ 1540.869994][ T5555] /dev/rnullb0: Can't lookup blockdev [ 1540.882072][ T980] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 1540.898312][ T980] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 1540.906053][ T980] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 1540.913185][ T980] em28xx 1-1:0.0: No AC97 audio processor [ 1540.934498][ T980] usb 1-1: USB disconnect, device number 43 [ 1540.941234][ T980] em28xx 1-1:0.0: Disconnecting em28xx [ 1540.951221][ T5560] /dev/rnullb0: Can't lookup blockdev [ 1540.965054][ T980] em28xx 1-1:0.0: Freeing device [ 1541.090933][ T30] audit: type=1800 audit(2000000197.555:10936): pid=5565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9716" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1541.189222][ T5567] /dev/rnullb0: Can't lookup blockdev [ 1541.471549][ T980] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1541.624067][ T980] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.634689][ T980] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1541.647325][ T980] usb 1-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1541.658869][ T980] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.667706][ T980] usb 1-1: Product: syz [ 1541.672114][ T980] usb 1-1: Manufacturer: syz [ 1541.678850][ T980] usb 1-1: SerialNumber: syz [ 1541.685520][ T980] usb 1-1: config 0 descriptor?? [ 1542.969060][ T5573] syz.8.9723: attempt to access beyond end of device [ 1542.969060][ T5573] nbd8: rw=0, sector=2, nr_sectors = 1 limit=0 [ 1542.982220][ T5573] hfs: can't find a HFS filesystem on dev nbd8 [ 1543.043890][ T5575] MTD: Couldn't look up '/dev/rnullb0': -15 [ 1543.129313][ T5579] /dev/rnullb0: Can't lookup blockdev [ 1543.336611][T26474] usb 3-1: USB disconnect, device number 12 [ 1543.380826][ T5581] /dev/rnullb0: Can't lookup blockdev [ 1543.397237][ T30] audit: type=1804 audit(2000000199.865:10937): pid=5584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.9728" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=5869 res=1 errno=0 [ 1543.603789][ T5586] sctp: [Deprecated]: syz.4.9729 (pid 5586) Use of int in max_burst socket option. [ 1543.603789][ T5586] Use struct sctp_assoc_value instead [ 1543.660469][ T5589] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1543.670844][ C0] Oops: divide error: 0000 [#1] SMP KASAN PTI [ 1543.676903][ C0] CPU: 0 UID: 0 PID: 5589 Comm: syz.4.9730 Not tainted 6.16.0-rc5-next-20250708-syzkaller #0 PREEMPT(full) [ 1543.688331][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1543.698368][ C0] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 [ 1543.704436][ C0] Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 [ 1543.724031][ C0] RSP: 0018:ffffc90000007bd8 EFLAGS: 00010046 [ 1543.730085][ C0] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888061deaa80 [ 1543.738040][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888058ac9000 [ 1543.745995][ C0] RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff [ 1543.753950][ C0] R10: dffffc0000000000 R11: ffffffff88f05730 R12: dffffc0000000000 [ 1543.761903][ C0] R13: ffff888061deaa38 R14: 0000000000000000 R15: ffff888061deaa00 [ 1543.769858][ C0] FS: 00007f71af7576c0(0000) GS:ffff88812579f000(0000) knlGS:0000000000000000 [ 1543.778768][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1543.785330][ C0] CR2: 0000200000000040 CR3: 000000007cfe2000 CR4: 00000000003526f0 [ 1543.793287][ C0] DR0: 0000000000000000 DR1: 0000000000000097 DR2: 0000000000000000 [ 1543.801240][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1543.809198][ C0] Call Trace: [ 1543.812461][ C0] [ 1543.815297][ C0] ? __pfx_das16m1_ai_munge+0x10/0x10 [ 1543.820657][ C0] comedi_buf_write_samples+0x369/0x5a0 [ 1543.826188][ C0] das16m1_handler+0x213/0x4b0 [ 1543.830939][ C0] das16m1_interrupt+0xaf/0x180 [ 1543.835772][ C0] ? __pfx_das16m1_interrupt+0x10/0x10 [ 1543.841220][ C0] __handle_irq_event_percpu+0x289/0x980 [ 1543.846842][ C0] ? __pfx___handle_irq_event_percpu+0x10/0x10 [ 1543.852985][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 1543.858172][ C0] handle_irq_event+0x8b/0x1e0 [ 1543.862919][ C0] ? handle_edge_irq+0x25d/0x9c0 [ 1543.867840][ C0] handle_edge_irq+0x267/0x9c0 [ 1543.872592][ C0] __common_interrupt+0x140/0x250 [ 1543.877598][ C0] common_interrupt+0xb6/0xe0 [ 1543.882265][ C0] [ 1543.885183][ C0] [ 1543.888100][ C0] asm_common_interrupt+0x26/0x40 [ 1543.893108][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 [ 1543.899592][ C0] Code: 74 05 e8 db 8d 45 f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c3 93 0e f6 65 8b 05 0c 0e 66 07 85 c0 74 40 48 c7 04 24 0e 36 [ 1543.919181][ C0] RSP: 0018:ffffc9000dbbf9a0 EFLAGS: 00000206 [ 1543.925235][ C0] RAX: 63c60062042d2600 RBX: 0000000000000a02 RCX: 63c60062042d2600 [ 1543.933193][ C0] RDX: 0000000000000006 RSI: ffffffff8dc84f85 RDI: 0000000000000001 [ 1543.941149][ C0] RBP: ffffc9000dbbfa30 R08: ffffffff8fe47637 R09: 1ffffffff1fc8ec6 [ 1543.949103][ C0] R10: dffffc0000000000 R11: fffffbfff1fc8ec7 R12: dffffc0000000000 [ 1543.957054][ C0] R13: dffffc0000000000 R14: ffffffff9a27b600 R15: 1ffff92001b77f34 [ 1543.965017][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1543.971335][ C0] serial8250_config_port+0x1451/0x5370 [ 1543.976874][ C0] ? __release_region+0x2d6/0x360 [ 1543.981880][ C0] ? kfree+0x18e/0x440 [ 1543.985936][ C0] ? __pfx_serial8250_config_port+0x10/0x10 [ 1543.991815][ C0] ? __release_region+0x2d6/0x360 [ 1543.996824][ C0] ? __pfx___release_region+0x10/0x10 [ 1544.002177][ C0] univ8250_config_port+0x3d7/0x9a0 [ 1544.007365][ C0] ? __pfx_univ8250_release_port+0x10/0x10 [ 1544.013157][ C0] ? serial8250_release_std_resource+0x135/0x2e0 [ 1544.019469][ C0] uart_ioctl+0x14ce/0x19c0 [ 1544.023958][ C0] ? do_futex+0x333/0x420 [ 1544.028275][ C0] ? __pfx_uart_ioctl+0x10/0x10 [ 1544.033112][ C0] ? __se_sys_futex+0x36f/0x400 [ 1544.037955][ C0] tty_ioctl+0x926/0xde0 [ 1544.042179][ C0] ? __pfx_tty_ioctl+0x10/0x10 [ 1544.046924][ C0] __se_sys_ioctl+0xf9/0x170 [ 1544.051502][ C0] do_syscall_64+0xfa/0x3b0 [ 1544.055997][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1544.061177][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.067222][ C0] ? clear_bhb_loop+0x60/0xb0 [ 1544.071881][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.077753][ C0] RIP: 0033:0x7f71ae98e929 [ 1544.082150][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1544.101738][ C0] RSP: 002b:00007f71af757038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1544.110132][ C0] RAX: ffffffffffffffda RBX: 00007f71aebb5fa0 RCX: 00007f71ae98e929 [ 1544.118096][ C0] RDX: 00007cb7562f2d67 RSI: 0000000000005453 RDI: 0000000000000009 [ 1544.126050][ C0] RBP: 00007f71aea10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1544.134009][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1544.141965][ C0] R13: 0000000000000000 R14: 00007f71aebb5fa0 R15: 00007ffcf09684c8 [ 1544.149921][ C0] [ 1544.152930][ C0] Modules linked in: [ 1544.156811][ C0] ---[ end trace 0000000000000000 ]--- [ 1544.162243][ C0] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 [ 1544.168299][ C0] Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 [ 1544.187882][ C0] RSP: 0018:ffffc90000007bd8 EFLAGS: 00010046 [ 1544.193933][ C0] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888061deaa80 [ 1544.201887][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888058ac9000 [ 1544.209841][ C0] RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff [ 1544.217792][ C0] R10: dffffc0000000000 R11: ffffffff88f05730 R12: dffffc0000000000 [ 1544.225743][ C0] R13: ffff888061deaa38 R14: 0000000000000000 R15: ffff888061deaa00 [ 1544.233701][ C0] FS: 00007f71af7576c0(0000) GS:ffff88812579f000(0000) knlGS:0000000000000000 [ 1544.242617][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1544.249181][ C0] CR2: 0000200000000040 CR3: 000000007cfe2000 CR4: 00000000003526f0 [ 1544.257134][ C0] DR0: 0000000000000000 DR1: 0000000000000097 DR2: 0000000000000000 [ 1544.265085][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1544.273042][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 1544.280347][ C0] Kernel Offset: disabled [ 1544.284648][ C0] Rebooting in 86400 seconds..