last executing test programs: 3m20.063752648s ago: executing program 1 (id=380): recvmmsg(0xffffffffffffffff, 0x0, 0xfffffffffffffdba, 0x161, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000004f4b000000000000000000180100002020702000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fdffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, 0x0, 0x0, 0xbe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb3, @void, @value}, 0x94) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=@newsa={0x168, 0x10, 0x713, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x42}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x3c}, {@in=@multicast1, 0x0, 0x32}, @in6=@remote, {0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x10000000000000}, {}, {0x3}, 0xffffffff, 0x0, 0x0, 0x1}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @lifetime_val={0x24, 0x9, {0xb, 0x7ffffffb, 0xfffffffffffffffe}}, @replay_val={0x10, 0xa, {0x70bd25, 0x70bd26}}]}, 0x168}}, 0x1) openat$tun(0xffffff9c, &(0x7f0000000040), 0x2000, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000001e000100000000000009000000000000d9fcd99d07a7d59acf09c471eb645948d9ac000000009472bdb6d05206846bef9ba087e6ebbd4340b717d097312289058d8438fd48e6e958b9b166dadcda71e5c20babd72cf431f06a00000000", @ANYRES32=0x0, @ANYBLOB="0000000008000f0001000000"], 0x24}}, 0x0) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) pipe(&(0x7f0000000100)) syz_io_uring_setup(0xf7e, &(0x7f0000000300), &(0x7f0000000280), 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000040)={0x2a, 0x1}, 0xc) r4 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r3, &(0x7f0000000ac0), 0x0, 0x2, 0x0) connect$qrtr(r4, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) 3m18.447061371s ago: executing program 1 (id=382): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="30000000030801010000000000000000070000060500030011000000140004800800024000"], 0x30}}, 0x0) 3m17.784204526s ago: executing program 1 (id=385): openat$audio(0xffffffffffffff9c, &(0x7f0000002040), 0x0, 0x0) r0 = openat$vcsa(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x15) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000070000006a0a00ff01010000260000000019e1b6950000000000000018100000", @ANYRES32, @ANYBLOB="100000000000002505000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0xa, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xc) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_open_dev$vbi(&(0x7f0000000100), 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r3, 0x47f6, 0x0, 0x5, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x114, &(0x7f0000000000), 0x0, 0x4) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x971, 0x0, 'queue1\x00'}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000100)=0x3) r7 = getpid() process_vm_readv(r7, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r8, 0x8903, &(0x7f0000000180)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0x408c5333, &(0x7f0000000280)) mbind(&(0x7f00006ef000/0x1000)=nil, 0x1000, 0x6000000, 0x0, 0xd, 0x2) 3m17.49704999s ago: executing program 1 (id=387): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000400)=0xa4, 0x4) syz_emit_ethernet(0x6c, &(0x7f0000000300)={@multicast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x36, 0x3a, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[], @dest_unreach={0x1, 0xc8ff9f55e8dc000f, 0x0, 0x0, '\x00', {0x0, 0x6, "00b235", 0x0, 0x3a, 0x0, @dev={0xfe, 0x80, '\x00', 0x1d}, @remote, [], "caa7c1b7f4c3"}}}}}}}, 0x0) 3m17.264481092s ago: executing program 1 (id=390): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x28, 0x9, 0x8, 0xfffff034}, {0x50, 0x0, 0x40, 0xfffffa4b}, {0x6, 0x0, 0x6c, 0xfffffffe}]}, 0x8) syz_emit_ethernet(0x86, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x50, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x14, 0x2, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @window={0x3, 0x3}, @generic={0x22, 0x8, "da64345379e8"}, @sack={0x5, 0xe, [0xa, 0x10, 0x6]}, @timestamp={0x8, 0xa, 0x80}, @md5sig={0x13, 0x12, "27406263e43d5959a166a23bd1116edc"}]}}}}}}}}, 0x0) 3m17.066785384s ago: executing program 1 (id=391): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0xc048aec8, &(0x7f0000000700)={0x0, 0x0, @ioapic={0x10000, 0x3, 0x1, 0x7, 0x0, [{0x6, 0x80}, {0xe7, 0x0, 0xfb, '\x00', 0x7f}, {0x0, 0x9, 0xc, '\x00', 0x92}, {0x2, 0xc6, 0xe, '\x00', 0xfa}, {0x0, 0x3, 0x7, '\x00', 0x9}, {0x5, 0x8, 0x6, '\x00', 0x1}, {0x16, 0x83, 0x6, '\x00', 0xcd}, {0x2, 0x4, 0x2, '\x00', 0x48}, {0x9, 0x3, 0x1a, '\x00', 0x7}, {0x5, 0x8, 0xdb, '\x00', 0x1}, {0x0, 0x7, 0x7, '\x00', 0x75}, {0x8, 0x0, 0xb, '\x00', 0xf}, {0x2, 0x0, 0x9, '\x00', 0xc3}, {0x9, 0x9, 0x6, '\x00', 0x85}, {0xfa, 0x81, 0x44, '\x00', 0x8}, {0x9, 0x9, 0x2, '\x00', 0x1}, {0x5c, 0xc2, 0x40, '\x00', 0x8}, {0x4a, 0x6, 0x8, '\x00', 0x6}, {0x8, 0x3, 0x2, '\x00', 0x14}, {0x6, 0x4, 0x80, '\x00', 0x46}, {0x7, 0x4, 0xf1, '\x00', 0x8}, {0x6, 0xf9, 0xf, '\x00', 0x10}, {0x8, 0x8, 0x81, '\x00', 0x3}, {0x0, 0x7f, 0x7, '\x00', 0x2}]}}) mmap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000001, 0x12, r4, 0xd9854000) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0xd3, 0x3a, 0x1000, 0x83a, 0x7ff, 0xf84, 0x3ff}, 0x1c) 3m1.862760608s ago: executing program 32 (id=391): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0xc048aec8, &(0x7f0000000700)={0x0, 0x0, @ioapic={0x10000, 0x3, 0x1, 0x7, 0x0, [{0x6, 0x80}, {0xe7, 0x0, 0xfb, '\x00', 0x7f}, {0x0, 0x9, 0xc, '\x00', 0x92}, {0x2, 0xc6, 0xe, '\x00', 0xfa}, {0x0, 0x3, 0x7, '\x00', 0x9}, {0x5, 0x8, 0x6, '\x00', 0x1}, {0x16, 0x83, 0x6, '\x00', 0xcd}, {0x2, 0x4, 0x2, '\x00', 0x48}, {0x9, 0x3, 0x1a, '\x00', 0x7}, {0x5, 0x8, 0xdb, '\x00', 0x1}, {0x0, 0x7, 0x7, '\x00', 0x75}, {0x8, 0x0, 0xb, '\x00', 0xf}, {0x2, 0x0, 0x9, '\x00', 0xc3}, {0x9, 0x9, 0x6, '\x00', 0x85}, {0xfa, 0x81, 0x44, '\x00', 0x8}, {0x9, 0x9, 0x2, '\x00', 0x1}, {0x5c, 0xc2, 0x40, '\x00', 0x8}, {0x4a, 0x6, 0x8, '\x00', 0x6}, {0x8, 0x3, 0x2, '\x00', 0x14}, {0x6, 0x4, 0x80, '\x00', 0x46}, {0x7, 0x4, 0xf1, '\x00', 0x8}, {0x6, 0xf9, 0xf, '\x00', 0x10}, {0x8, 0x8, 0x81, '\x00', 0x3}, {0x0, 0x7f, 0x7, '\x00', 0x2}]}}) mmap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000001, 0x12, r4, 0xd9854000) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0xd3, 0x3a, 0x1000, 0x83a, 0x7ff, 0xf84, 0x3ff}, 0x1c) 10.814697873s ago: executing program 5 (id=1160): r0 = socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xb) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/3, 0x0, 0x3}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="05"], 0x4) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c51000/0x2000)=nil) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r4}) syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) write$UHID_INPUT(r6, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = timerfd_create(0x0, 0x0) timerfd_settime(r8, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) readv(r8, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/33, 0x21}], 0x1) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000140), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001f040000000000003f000000000000005504000001ed0a0025000000170000000f030000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c8216feb1a69005bbe781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 9.956463644s ago: executing program 5 (id=1162): r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRES32=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) socket$alg(0x26, 0x5, 0x0) socket(0x15, 0xa, 0x3) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0xd7) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getuid() sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r6 = socket$kcm(0x2, 0x3, 0x2) r7 = syz_io_uring_setup(0x2b06, &(0x7f0000000040), &(0x7f0000ffd000), &(0x7f0000ffe000)) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000000380)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0x90) io_uring_register$IORING_REGISTER_FILES(r7, 0x14, &(0x7f00000003c0), 0x2) r8 = syz_io_uring_setup(0x1ec3, &(0x7f0000000080)={0x0, 0x6a5f, 0x8, 0x1, 0x386, 0x0, r7}, &(0x7f0000000000), &(0x7f0000000140)) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000180)=@md0, r5, &(0x7f0000000240)) io_uring_register$IORING_UNREGISTER_RING_FDS(r8, 0x15, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, 0x0}], 0x1) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'bond0\x00', &(0x7f0000000440)=@ethtool_perm_addr={0x20, 0x12b, "26467019b6a97a3f8a4c776f7fc790906594a3a9bacdfcb03c36563aadd73e6e9b4213eb98900fa633ab376284e51a681438fa9485e897ec1f807df164dcca79732b7a781b56467e7c1c2b039b5de80b179aeca64c9378be5e86cc96d3b2030806349fc4ffdc14cbb4b21fefb6ea7d4001aa42f768b4c7e0b813e2885016b9354a1f5e617f3f8326ce4c9d0f42fbbe5f9c8971a74dbf3dc76a38a63848139acdfa979affe464ca62aad2504b96fbe30287173487841447affe91f8f027c7f20261be9105379996e141115ca601847c4b3767f73ba69223b6e11d9ef7aca5b0573134b0301b9fd6a271714befcdad7c2637ad3b36d647d8062c39c31f8912803b7a42ea9fa11d6b3b47302d309fdfd0e58d7bbec64a5f0281cbf6ec998800"/299}}) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r9, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3b0, 0x0, 0x10c, 0x1f0, 0x2d0, 0x2d0, 0x2d0, 0x7fffffe, 0x0, {[{{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xbc, 0xe4, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 7.142706197s ago: executing program 3 (id=1172): r0 = socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xb) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/3, 0x0, 0x3}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="05"], 0x4) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c51000/0x2000)=nil) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r4}) syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r5) r6 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = timerfd_create(0x0, 0x0) timerfd_settime(r7, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) readv(r7, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/33, 0x21}], 0x1) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000140), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001f040000000000003f000000000000005504000001ed0a0025000000170000000f030000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c8216feb1a69005bbe781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 6.948297229s ago: executing program 3 (id=1173): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @broadcast}, 0x10) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000240)=0x7) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000300)=0x57) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)) read$dsp(r1, &(0x7f0000000a80)=""/70, 0x46) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r3, 0x1, 0x5, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x24}, 0x1c) listen(r0, 0x0) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x4d8, 0xf372, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0xa, 0x56, {0x56, 0x9, "001c0000004dc2396935f3a7492c149b1d079fe8e7d9a354f0f1a3458343b820cbc64e8e9975696f77242215693cbe64abfe8485dbe73976202b7d6b20713ad10733c244d1f7540d23c29670a628b1f848000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 6.64271525s ago: executing program 5 (id=1174): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) r1 = openat$dlm_control(0xffffff9c, &(0x7f0000000200), 0x0, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000240)={0x0, 0x200, 0xa, [0x40, 0x7, 0x8, 0xb75, 0x6, 0x4, 0x6, 0x1, 0x8, 0x8]}, &(0x7f0000000280)=0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYBLOB="07000307000000000600259a184d1e560ffbaef9f5b0f3f2ada34be8d77c4b4d3e8ba7edbe2ef7c37e71ecc082e07c1d6fb1ac904e9561b0e0126479ab747b6ee7ad4e400ade2a52f418b2ada2e92365b0099d6c9b5073892bcf3f27325b5ad420b87b4ad5269264f9c6ed8b68ce5ec424622484a9f477c7f18d552c58b45360c5d4c77f07f7bb0a0f964bf369419349d7f5d950e0f61d01e46499e9af487c483f0ba19d"], 0xe) r3 = landlock_create_ruleset(&(0x7f0000000000)={0x250c, 0x1, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0x1) creat(&(0x7f0000000140)='./file0\x00', 0x5a) ioctl$int_in(r0, 0x5452, &(0x7f00000001c0)=0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000b40)=0xe) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x0, 0x0, 0x80, 'syz0\x00', 0x8}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 6.567265337s ago: executing program 5 (id=1175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_clone(0x42090000, 0x0, 0xfffffeae, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x1, 0xf, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ptrace$setsig(0x4203, r4, 0x44, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r6, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x10000}) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x8) r7 = openat$vim2m(0xffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_RESET_DIRTY_RINGS(r6, 0xaec7) waitid(0x1, 0x0, &(0x7f0000000180), 0x8, &(0x7f0000000040)) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000014, 0x0, 0x0) socket(0x10, 0x800, 0x6) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a010400000000000000000200000034000480340001800e000100696d6d6564696174650000001c0002800800014000000000100002800c00028008000180ffffffff0900010073797a30000000000900020073797a320000000014000000110000000000000000000700000a0000"], 0x88}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14}}, 0x54}}, 0x0) 6.341474278s ago: executing program 0 (id=1176): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000102505a1a440000102030109025c0002010050060904000001020d0000052406000105240003000d240f0101000000ce0107000006241a000430090581"], 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x8) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) statx(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x2000, 0x1, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4178c40ba0d0010"], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) 5.539241445s ago: executing program 2 (id=1180): r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r5 = dup2(r2, r3) read$FUSE(r5, &(0x7f0000000c00)={0x2020}, 0x2020) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x24477f, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000480)={0x7, &(0x7f0000000140)=[{0x1, 0xa0, 0xca, 0xffffffc0}, {0x80, 0x1, 0xd9, 0x6}, {0x6, 0xfd, 0x5, 0x18eb3ab2}, {0x0, 0x1}, {0x7, 0x6, 0x8e, 0x7ff}, {0x3, 0x80, 0x9, 0x400}, {0x1, 0x8, 0x2, 0x7}]}) r6 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x75, 0x40082) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="980000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c0002800500010000000200000001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400"], 0x98}}, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r6, 0x80045518, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000008d000/0x4000)=nil, 0x4000, &(0x7f00000001c0)='\x00') r8 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r8, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000840)=@nat={'nat\x00', 0x670, 0x5, 0x35c, 0xa4, 0x16c, 0xfeffffff, 0x0, 0xa4, 0x2c8, 0x2c8, 0xffffffff, 0x2c8, 0x2c8, 0x5, 0x0, {[{{@ip={@broadcast, @local, 0x0, 0x0, '\x00', 'geneve0\x00'}, 0x0, 0x70, 0xa4}, @SNAT0={0x34, 'SNAT\x00', 0x0, {0x1, {0x0, @multicast1, @remote, @gre_key}}}}, {{@ip={@private, @broadcast, 0x0, 0x0, 'pimreg0\x00', 'syzkaller0\x00'}, 0x0, 0xa4, 0xc8, 0x0, {0x0, 0x7}, [@common=@unspec=@devgroup={{0x34}, {0x1}}]}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0x210}}, {{@uncond, 0x0, 0x70, 0xa4}, @SNAT0={0x34, 'SNAT\x00', 0x0, {0x1, {0x0, @loopback, @local, @gre_key, @gre_key}}}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@common=@ttl={{0x24}}]}, @common=@inet=@TCPMSS={0x24}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3b8) 5.185699473s ago: executing program 3 (id=1181): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=@newtfilter={0x60, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x34, 0x2, [@TCA_BPF_ACT={0x30, 0x1, [@m_bpf={0x2c, 0xa, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r3}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) syz_usb_connect(0x6, 0x5f, &(0x7f0000000000)=ANY=[], 0x0) 4.511801313s ago: executing program 3 (id=1182): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000020bd28940000000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x11, 0xa, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000500000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e34ff65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd086004c4a56c6cce6e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f7477137f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480efd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047acd083d3cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e430a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed1823cb7dde8212a8531bd9691dd4cc6a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b051f47db7aa110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c0000000000000000000a000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3938e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea875583e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba46cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a1cc4df1112105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5ccb9f10f615c87c441dc50a244bc138a1cae9868c3079bafe69769000000000000000000e99b63029d219cd3545a8426b56554a9f265d3557eefb3602894507c256cb8ee9ebadfecb6afeb84ba757bfa8d00a5af0dd6aa1e8144ef8ef04410d52204c335408941b8eccc5c734cc6a05247142ed647f89bcb5c043acfb382b9cc918bc3cdc368983157851cdf678800aa7eb2a6cbc12c7ae23bc88b8f10223ab2a093429f3f6965bc5af0114cf6f246e891e20ecaad7059866506c3000000000c3230e901e885b7a4a36bdfdb5ce7a2e5807a0f4c1d461d1243fccf51b875b49490cd7d044e7a1e1a4c013fae1f070a8a37ab90da2efc6c875b3aab34b75a252072691fc97bef0fed8ee597ab83bb53f89c36bc2ee3ad54904542f66dc94132df75fc9944882d6f2e13b7057e0000000000000000000000000000000000001b726c0ccd24000000000000cfd2f4d005578b9ed06e1c41ef3b411066739de953d39b968caaca1507928d68c8f052"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r4, &(0x7f0000000040)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x2}, 0x80, &(0x7f0000000140)=[{&(0x7f00000006c0)="62043c00590200000001ad2f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a710292ea0c3f97b7cbff701684b13c5593262534a7af9eab48f2ca2d74d9a4de33", 0xda}, {&(0x7f0000000c00)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a804dd2a44ce42557b2e32e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161297c7e56a3e83e91b379c179017f8b4657d1b22eca6bca33036d33e1a684059c53cea91ca6637ac780ab2bcfc22a666cd4e5876f11e9aee4724b7cb59731c97e70ebd7f7483994eb07de2f3c6a9448c3206cff6d290b433f331c2399e99ee3bdecf5689eddc3e549966c1106a933bbc47b65ca6e9d7efbee6e3b1dbe87313111e85336d6890002db17751b6044f964dc90ea466f90856112be7f0a54b39a3f66cc4c39544300093158af39cdde429f50d8c750", 0x114}, {&(0x7f0000000a40)="0a985d7879f1bbff16c7d66e33657e452299fd0ef8c2afda588eb05891b7da030e01452a7986bea19b59c98dc2996c0ea09604d00ea48336d0c813d83025aca8623a5915ddddce2c11c5e374f2e0f387d2398fe0b899ff60dc7a73addcf253cf32aafbe2b9f90799e7fc583bdd9b564697ba988080270bdceb4714219a2d4c229fffb0d86fb286e3553a8b3ac02badc66ada5fceabe5f63c79da96e641a45901128063d6e1e31b11bcfbc3e70bd3c8c6c0be9f653f977f16", 0xfff0}, {&(0x7f0000000840)="6f4720baeb54", 0x6}], 0x4}, 0x0) r5 = syz_io_uring_setup(0x917, &(0x7f0000000300)={0x0, 0x400, 0x1, 0x1000001, 0xf7fffffc}, &(0x7f0000000180)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x28, 0x2007, @fd, 0x0, 0x0, 0x0, 0xd, 0x0, {0x0, r8}}) io_uring_enter(r5, 0x47f6, 0x0, 0x0, 0x0, 0x0) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x14, r9, 0x1}, 0x14}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd8d001a00000000000002001000fe0000062000002008001e80"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) syz_usb_control_io(r0, &(0x7f0000001580)={0x2c, &(0x7f0000000000)={0x0, 0x0, 0x7, {0x7, 0xe, "12273a0500"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 4.118494019s ago: executing program 2 (id=1183): r0 = socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xb) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/3, 0x0, 0x3}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="05"], 0x4) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c51000/0x2000)=nil) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r4}) syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = timerfd_create(0x0, 0x0) timerfd_settime(r6, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) readv(r6, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/33, 0x21}], 0x1) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000140), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001f040000000000003f000000000000005504000001ed0a0025000000170000000f030000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c8216feb1a69005bbe781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 3.921357309s ago: executing program 2 (id=1184): creat(0x0, 0xd931d3864d39dcca) syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="121100000100d820a61b0100880800020301090212000100000700000000000000e4f900eadf25140123fadb990d8e3fea8278be07a2daa67658e7995b3a1b7c59758b6bf6a3770970dde7d1d19f594d95a7083342ffdb39c24538d9557dd50d335d7183fcc8e87611b214c7bfb943d6294e348770e8016a96caa5c1b8209af939085f3426cadbfbad930e2a832453c87386c47770150bda6aad8f7514e6cc31d2e29f1d25bd53defb4b30f5b5448ecda8d4bb8b6b4d24708c170b70110cd27f7449937968c827b06a507572c729039954b7a2c7afa00738c664d1b25e070d16c61a3dd4d06146a2fa32e9185c74c09c1085c041514ad309a61b1c8a35108ce0e62c0ac3294e6ed767ac86299dfefe0977ce2cd74499ef5b0e4bfcc0c00b505937959b138ea2a6685e3f"], 0x0) inotify_init1(0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000001cc0)='netpci0\x00', 0x10) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getuid() syz_usb_connect(0x0, 0x5f, 0x0, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000040)=0xe) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r3, &(0x7f0000000040)={'#! ', './file0', [{0x20, '/dev/mixer\x00'}]}, 0x17) syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000003c0), 0x7ff, 0x101001) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105511, &(0x7f00000000c0)={{0xc, 0x4, 0x0, 0x3}, 0x0, [0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x403, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x6, 0x100000000, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x0, 0x8000, 0x0, 0x81, 0x4, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x10000, 0x0, 0x3, 0xffffffffffffffff, 0x8000, 0x100000001, 0xfffffffd, 0x0, 0x0, 0x0, 0x6, 0x9, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x801, 0x1, 0x0, 0x4, 0x0, 0x1, 0x8000000, 0x9, 0x0, 0x0, 0x2, 0x20001, 0x0, 0x0, 0x7, 0x80, 0x0, 0x0, 0x8000000000000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x6, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfff, 0x0, 0x0, 0x4, 0x1, 0x0, 0x4, 0x0, 0x0, 0x10]}) r5 = memfd_secret(0x0) ftruncate(r5, 0x4) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9, 0x13, r5, 0x0) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, &(0x7f0000000080)=0x272) 3.396592408s ago: executing program 5 (id=1185): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022400010000000009040000010300000009210000002022050009058103100000fd00e10acbae4cee2f272d0e8ca73cfd82abb025ee6aeb1586d6db0e286f3daa7dd9f3"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000000)={0x0, 'bridge_slave_1\x00', {0x1}, 0x1ef}) 3.126199354s ago: executing program 4 (id=1186): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000040)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x356, 0x3a, '\xf1', 0x3a, '', 0x3a, './file0', 0x3a, [0x43, 0x50]}, 0x2a) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000240)={0xffffffffffffffff, 0x3, 0x3, 0x2, 0x5}) socket$inet_sctp(0x2, 0x5, 0x84) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000005c0)) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000100)={0x2, 0x6, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={{0x14, 0x10, 0x4, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x68, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_USERDATA={0x52, 0x6, "6e916998212717e20a82c7b689cd8bdd3615b244cc0528c6e914224288e46f1ab7d5ae9b91f67fbb233d78a96b97ab27d2b26e7a84e35fadc98bace1109250adeba3fb7ae8697e0d2cf0fd336578"}]}, @NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x30, 0x3, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x20, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LIMIT_FLAGS={0x8}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011"], 0x7c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) ioctl$vim2m_VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000280)=@mmap={0x2, 0x1, 0x4, 0x10, 0x0, {0x0}, {0x0, 0x0, 0x4, 0x4, 0x0, 0x1, "37bb54f0"}}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0c00000000000000070000000080000000000000", @ANYRES32, @ANYBLOB="84000000000000000400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x4, 0x2a, &(0x7f0000000440)=ANY=[@ANYRES32=r8, @ANYRESOCT=r5, @ANYRES32=r8, @ANYBLOB, @ANYRES64=r7, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40440c1}, 0x20008040) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) bpf$MAP_CREATE(0x0, 0x0, 0x50) r9 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x4, 0x804, 0x7, 0xf, 0x120000, 0xff, 0x0, 0x1ff, 0x3, 0x2, 0x0, 0xe31e, 0x7, 0x5dea], 0x8000000, 0x141200}) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6}) openat$sw_sync(0xffffff9c, 0x0, 0x200, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 2.971747651s ago: executing program 4 (id=1187): r0 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000440), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r0, r1, r0}, &(0x7f0000000280)=""/190, 0xbe, &(0x7f00000003c0)={&(0x7f0000000240)={'streebog512-generic\x00'}}) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r2, 0x400, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101000, 0x59) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r4, 0x0, 0x3, 0x4}) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 2.85209467s ago: executing program 0 (id=1188): r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x1) writev(r0, &(0x7f0000000780)=[{&(0x7f0000000040)='\a', 0xfc19}, {0x0, 0x2}], 0x2) unshare(0x2c020400) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = dup(r2) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, 0x0, 0x24000000) r4 = eventfd2(0x819d, 0x801) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000000)={{r4}, 0x38, 0x1089, 0x7}) close(r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r5) syz_emit_ethernet(0x82, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa008100000086dd6000000000483a00fe8000000000000000000000000000bbff02000000000000000000000000000102009078000005006050835900000000fc0100000000100000000000000000007e0200000000000000000000000000003a0100000000000007080000000000008000000000000000"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010080000900010073797a300000000060000000030a010100000000000000000100000008000b400000000014000480080002400000000008000140000000000900010073797a300000000008000a40000000021c0008"], 0xa8}}, 0x0) 2.258318783s ago: executing program 0 (id=1189): r0 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) socket$igmp(0x2, 0x3, 0x2) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e24, 0x8000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}, 0x1c) listen(r1, 0x50) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e60, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8), 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$alg(r5, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000001c0)=ANY=[@ANYBLOB="12015001020000402505a1a440000102030109025c0002010070000904000001020d0000052406000105240000000d240f01fdfffffffdff08000006241a000010090581034000000000090401"], 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000040), 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) r6 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xb423, 0x0, 0x5, 0x1000}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x3, r5, 0x0, 0x0, 0x0, 0x80800}) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4810000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4004000) io_uring_enter(r6, 0x3516, 0x3e44, 0x8, 0x0, 0x0) listen(r2, 0x50) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r9, 0xffffffffffffffff, 0x0) 2.067937407s ago: executing program 4 (id=1190): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x400, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000800)=[{{0x0, 0x80101, &(0x7f0000000580)=[{&(0x7f0000000200)="e310885d", 0x4}], 0x1}}], 0x1, 0x4001c00) 2.004064683s ago: executing program 4 (id=1191): openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = socket(0xa, 0x3, 0x3a) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r3) recvmmsg(r3, &(0x7f0000003a00)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000001280)=""/4119, 0x1017}, {&(0x7f00000000c0)=""/178, 0xb2}, {&(0x7f0000000580)=""/129, 0x81}, {&(0x7f00000022c0)=""/4081, 0xff1}, {&(0x7f0000000240)=""/141, 0x8d}, {&(0x7f0000000380)=""/165, 0xa5}, {&(0x7f00000001c0)=""/53, 0x35}], 0x7}, 0x6}, {{0x0, 0x0, 0x0}, 0x5}], 0x5, 0x40008062, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f00000000c0)={0x8, 0x1, 0xffffff01, 0x9}, 0x10) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0xffff, 0x10000, @mcast1}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x200020, 0x0, 0x0, 0x1000, 0x400]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r2, 0x29, 0xcc, 0x0, 0x0) syz_io_uring_setup(0x10f, &(0x7f00000003c0)={0x0, 0x0, 0x400, 0x0, 0x33f}, &(0x7f0000000500)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x13}) io_uring_enter(0xffffffffffffffff, 0x2def, 0x4000, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xa4}}, 0x20000040) 1.150282031s ago: executing program 3 (id=1192): openat$ppp(0xffffff9c, &(0x7f0000002fc0), 0x121000, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000780)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f00000000c0)={0xc, {0x8000, 0x5, 0x7, 0x3}}) r1 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x149282, 0x10) write$cgroup_int(r4, &(0x7f0000000180)=0x902, 0x12) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_LINK_TIMEOUT={0xf, 0x70, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x1, {0x0, r5}}) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x4, 0x6, 0x0, 0x0, 0x10, 0x0, {0xfffe, r5}}) io_uring_enter(r1, 0x48e9, 0x0, 0x2, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000040), 0xfff, 0x420800) r6 = syz_usbip_server_init(0x1) syz_usb_connect(0x6, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000994bd740f60d5600b5a0000000010902"], 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, &(0x7f0000000300)=0x2, 0x1ff, 0x0) r7 = syz_io_uring_setup(0x5135, &(0x7f0000000100)={0x0, 0x0, 0x13580}, &(0x7f00000002c0)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000180)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x28, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40000162}) io_uring_enter(r7, 0x6256, 0x0, 0x0, 0x0, 0x0) write$usbip_server(r6, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000300000001"], 0x35) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 794.596581ms ago: executing program 2 (id=1193): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = eventfd(0xffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f018581c0bc0065666765f36f0f33f0100a660f3a0cb9000000752066b9800000c00f3a32c632c6004000a50f01d70f0901", 0x32}], 0x1, 0x54, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x8000000000000000, 0x100000001, 0x800000000, 0x3e, 0x0, 0x0, 0x2004cc, 0x5, 0x0, 0x0, 0xfffffffdfffffffc, 0xfffffffffffffffc, 0x0, 0x9, 0x4000000000000004, 0x767], 0xeeef0000, 0xc0086}) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x4, 0x100) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x11c2a, 0x20000, 0x4}, &(0x7f0000000080), &(0x7f00000001c0)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004000000060018"], 0x4c}}, 0x0) syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xa2df, 0x10100, 0x0, 0x327, 0x0, r5}, &(0x7f0000000080), &(0x7f00000001c0)) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r5, 0xc0a45320, &(0x7f00000002c0)={{0xf}, 'port1\x00', 0x1, 0x0, 0x1, 0x10, 0x71cf05cc, 0x5, 0xb, 0x0, 0x6, 0xf1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000040)={0x1, r0}) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r8 = geteuid() mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='ft=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r8, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2000, 0x800, 0x0) read$FUSE(r7, &(0x7f0000008340)={0x2020}, 0x2020) syz_fuse_handle_req(r7, &(0x7f0000004300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c252074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba4850439ec125b708ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca365892a2b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x130, 0x0, 0x9, {0xfffff7ffffffffff, 0x7, 0x0, '\x00', {0x91ef, 0x1, 0xae2, 0x802, 0xee01, 0x0, 0x2000, '\x00', 0x2, 0x8, 0xb4e7, 0x7, {0x8003, 0x8}, {0x4000000000006, 0x3}, {0x8, 0x7}, {0xe, 0x8}, 0x8000, 0xa, 0x8, 0x6}}}}) syz_open_dev$vim2m(&(0x7f0000000200), 0x81, 0x2) socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_setup(0x26d4, &(0x7f0000000080)={0x0, 0xd831, 0x10100, 0x0, 0x2}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r9, r10, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_setup(0x3d1a, &(0x7f0000000400)={0x0, 0x27ec, 0x800, 0x2, 0xfffffffb}, &(0x7f0000000100), &(0x7f0000000080)) 663.58755ms ago: executing program 4 (id=1194): r0 = socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xb) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/3, 0x0, 0x3}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="05"], 0x4) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c51000/0x2000)=nil) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0xc20022, r4}) syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = timerfd_create(0x0, 0x0) timerfd_settime(r6, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) readv(r6, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/33, 0x21}], 0x1) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000140), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001f040000000000003f000000000000005504000001ed0a0025000000170000000f030000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c8216feb1a69005bbe781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 621.817138ms ago: executing program 0 (id=1195): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x10) 403.0257ms ago: executing program 2 (id=1196): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000200)=0x12) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14, 0x80000) recvmmsg(r1, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000100)=""/70, 0x46}, {&(0x7f0000000240)=""/234, 0xea}, {&(0x7f0000000180)=""/32, 0x20}, {&(0x7f0000000340)=""/160, 0xa0}, {&(0x7f0000000400)=""/213, 0xd5}, {&(0x7f0000000500)=""/121, 0x79}, {&(0x7f0000000580)=""/92, 0x5c}, {&(0x7f0000000600)=""/95, 0x5f}, {&(0x7f0000000680)=""/229, 0xe5}], 0x9, &(0x7f0000000800)=""/4096, 0x1000}, 0xfffffff0}, {{&(0x7f0000001800)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000001880)=""/109, 0x6d}, {&(0x7f0000001900)=""/229, 0xe5}, {&(0x7f0000001a00)=""/4096, 0x1000}], 0x3, &(0x7f0000002a00)=""/12, 0xc}, 0xc302}, {{&(0x7f0000002a40)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000002e00)=[{&(0x7f0000002ac0)=""/128, 0x80}, {&(0x7f0000002b40)=""/21, 0x15}, {&(0x7f0000002b80)=""/39, 0x27}, {&(0x7f0000002bc0)=""/106, 0x6a}, {&(0x7f0000002c40)=""/175, 0xaf}, {&(0x7f0000002d00)=""/219, 0xdb}], 0x6, &(0x7f0000002e40)=""/80, 0x50}, 0xfffff78c}, {{&(0x7f0000002ec0)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000003480)=[{&(0x7f0000002f40)=""/202, 0xca}, {&(0x7f0000003040)=""/84, 0x54}, {&(0x7f00000030c0)=""/112, 0x70}, {&(0x7f0000003140)=""/89, 0x59}, {&(0x7f00000031c0)=""/189, 0xbd}, {&(0x7f0000003280)=""/167, 0xa7}, {&(0x7f0000003340)}, {&(0x7f0000003380)=""/203, 0xcb}], 0x8}, 0x4}], 0x4, 0x40000002, &(0x7f0000003540)) ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f0000000000)=0x1) 402.335099ms ago: executing program 4 (id=1197): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000b00)={0x60, 0x16}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0xfffd, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x28, 0x9, 0x8, 0xfffff034}, {0x50, 0x0, 0x40, 0xfffffa4b}, {0x6, 0x0, 0x6c, 0xfffffffe}]}, 0x8) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRESHEX=r1, @ANYRES16=r0, @ANYRES32=r1, @ANYRES8=r1], 0x1c}}, 0x4000000) recvmmsg$unix(r2, &(0x7f0000000640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x89901) syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RREADLINK(r4, &(0x7f0000000140)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000000c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) umount2(&(0x7f00000001c0)='./file0\x00', 0x8) ioctl$EVIOCSFF(0xffffffffffffffff, 0x402c4580, &(0x7f0000000000)={0x51, 0x7, 0x101, {0x101, 0xd88}, {0x2ce3, 0x1}, @const={0x0, {0x1800, 0x3, 0x2, 0x1}}}) 338.670215ms ago: executing program 0 (id=1198): ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, 0x0) read$dsp(0xffffffffffffffff, &(0x7f0000000340)=""/100, 0x64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0xfe00, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) 298.163413ms ago: executing program 2 (id=1199): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000040)={0x3ff, 0xf7af, 0x8020, 0x8, 0x0, "4cb8b210acdc716f64cf76062d59a56f2584c4"}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000240)={0xa, 0x80000001, 0xfffffff0, 0xbe, 0xd, "2f76ec5ff4981dc329b62e115bfef7b021c363"}) r1 = socket$inet6(0xa, 0x0, 0x3a) sendmmsg$inet6(r1, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000002c0)}}], 0x1, 0x4000084) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYRESDEC=r1, @ANYRES8], 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)="cd51", 0x2}], 0x1}}], 0x1, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = dup(0xffffffffffffffff) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r4, &(0x7f00000000c0)="c5", 0x1, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x1, @dev={0xfe, 0x80, '\x00', 0x13}, 0x13}, 0x1c) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000380)={r6, 0x5, 0x30}, 0xc) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40383d0c, 0x0) r7 = fsopen(&(0x7f00000001c0)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f00000000c0)='test_dummy_encryption', &(0x7f0000000180)='v2to_da_alloc', 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r3, 0x5201) syz_usb_control_io(r2, &(0x7f0000000b00)={0x18, &(0x7f0000000040)=ANY=[@ANYRES8=r3], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$tcp_congestion(r9, &(0x7f0000000000)='dctcp\x00', 0x6) r10 = syz_io_uring_setup(0x6f4d, &(0x7f0000000140)={0x0, 0x1870, 0x0, 0x0, 0x15}, &(0x7f00000003c0)=0x0, &(0x7f00000004c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x10c, &(0x7f0000000400)=0xfffffffc, 0x0, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000f0f000000000100000e00"}}}]}, 0x48}}, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000003e00040026bd7000fef7df250a000000"], 0x14}, 0x1, 0x0, 0x0, 0xc090}, 0x4001) syz_io_uring_submit(r11, r12, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x5, r8, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r10, 0x47f5, 0x0, 0x0, 0x0, 0x0) 199.810546ms ago: executing program 0 (id=1200): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r2, 0x110, 0x3, 0x0, 0x10) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000140), 0x0) add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000000)={'syz', 0x3}, &(0x7f0000000240)="7a5d11dba25ccb2dde2f82a419fe7ea41b4424adda4e8c3be797cf6910d54400a9aff2b55d33ad438a4f258f64a45a6783e20a8ffdc2a7e562fc1596aaeea7e5e9d309daaabd4573fe5605c2644bcdfa0aa19b6bad3aafc9ee43af2ec449e88891b5eef99e622795495035828dfeedb2f29b", 0xff51, 0xfffffffffffffffd) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$sequencer(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="0293"], 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) 22.596358ms ago: executing program 5 (id=1201): prctl$PR_SET_FP_MODE(0x2d, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000000b0000000a00000009"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x8000, r0}, 0x38) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x8000}, 0x38) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0), 0x0, 0x1) write$cgroup_int(r1, &(0x7f00000024c0)=0x1, 0x12) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) close(0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000001800dd8d000000000000000002000000ff0000060000000008000700ac1414bb08001e006907000008000700ac1e010108000b00ffffffff0800", @ANYRES8=r3], 0x60}}, 0x44000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r4, @ANYBLOB="010000020c00fbdbdf25010000000800020000000000050005000000000008000300010000004800018005000200200000000600010002000000080006000a000000080003"], 0x84}}, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, r4, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4005) 0s ago: executing program 3 (id=1202): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x11e, 0x1, 0x0, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffff9c, &(0x7f00000000c0), 0x408002) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0, 0x401}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0xfffffffd, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80800) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x27) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x4, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x46) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f00000004c0)=@gcm_128={{0x303}, "000037d7009400", "9f0000000000ffff00", "32ec00", "000400"}, 0x28) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x90) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r7, 0x4138ae84, &(0x7f0000000100)={{0x0, 0x0, 0x7, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x9, 0x10}, {0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8f}, {0xeeef0000, 0x5000, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0x4fff, 0xf7f53000, 0x9, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xd}, {0x0, 0x0, 0xe, 0xfe, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf6}, {0x0, 0x0, 0x0, 0xfc, 0x0, 0x1, 0x0, 0xa, 0x26}, {0x80a0000}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x8080000, 0x50, 0xa, 0xf801, 0x0, [0x0, 0x0, 0x1]}) kernel console output (not intermixed with test programs): id OSS volume 'cۉ< S٪3nF /Pf' [ 319.743479][ T8738] ALSA: mixer_oss: invalid OSS volume '9 hĨy^7]' [ 319.753462][ T8738] ALSA: mixer_oss: invalid OSS volume '?6<g$/uXAd>=V' [ 319.765666][ T8738] ALSA: mixer_oss: invalid OSS volume '+ͿnU<$^EKʘr+' [ 319.794892][ T8751] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 320.033374][ T8751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.075080][ T8751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.106912][ T8751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.177764][ T8751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.200008][ T30] audit: type=1326 audit(1746800661.793:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.224371][ T5891] usbhid 6-1:0.0: can't add hid device: -71 [ 320.243912][ T5891] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 320.290211][ T5891] usb 6-1: USB disconnect, device number 29 [ 320.297850][ T30] audit: type=1326 audit(1746800661.793:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.348346][ T30] audit: type=1326 audit(1746800661.793:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.395092][ T30] audit: type=1326 audit(1746800661.793:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.531133][ T30] audit: type=1326 audit(1746800661.793:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.908161][ T30] audit: type=1326 audit(1746800661.793:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.962710][ T30] audit: type=1326 audit(1746800661.793:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 320.993042][ T30] audit: type=1326 audit(1746800661.793:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8750 comm="syz.5.830" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x7ffc0000 [ 321.016776][ T8776] xt_TCPMSS: Only works on TCP SYN packets [ 321.562188][ T10] usb 4-1: string descriptor 0 read error: -71 [ 321.581119][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 321.591078][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.609818][ T10] usb 4-1: can't set config #1, error -71 [ 321.618783][ T10] usb 4-1: USB disconnect, device number 46 [ 322.151839][ T5912] usb 3-1: USB disconnect, device number 55 [ 322.251798][ T10] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 322.506290][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 322.534871][ T10] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 322.570160][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.598962][ T10] usb 5-1: Product: syz [ 322.598989][ T10] usb 5-1: Manufacturer: syz [ 322.599006][ T10] usb 5-1: SerialNumber: syz [ 322.614710][ T10] usb 5-1: config 0 descriptor?? [ 322.821550][ T10] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 323.302872][ T5890] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 323.486680][ T5890] usb 6-1: Using ep0 maxpacket: 32 [ 323.511593][ T5890] usb 6-1: config index 0 descriptor too short (expected 164, got 36) [ 323.534881][ T5890] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.584865][ T8837] input: syz0 as /devices/virtual/input/input22 [ 323.592568][ T8837] input: failed to attach handler leds to device input22, error: -6 [ 323.604992][ T5890] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.693325][ T5890] usb 6-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 323.722004][ T5890] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.760781][ T5890] usb 6-1: config 0 descriptor?? [ 324.182206][ T5890] logitech 0003:046D:C29C.0011: unknown main item tag 0x0 [ 324.192391][ T8844] netlink: 8 bytes leftover after parsing attributes in process `syz.0.847'. [ 324.195712][ T5890] logitech 0003:046D:C29C.0011: unknown main item tag 0x0 [ 324.219650][ T8844] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 324.231383][ T8844] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 324.398982][ T8832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.423498][ T5890] logitech 0003:046D:C29C.0011: unknown main item tag 0x0 [ 324.436043][ T5890] logitech 0003:046D:C29C.0011: unknown main item tag 0x0 [ 324.451034][ T8800] netlink: 'syz.4.839': attribute type 1 has an invalid length. [ 324.458375][ T5890] logitech 0003:046D:C29C.0011: unknown main item tag 0x0 [ 324.461856][ T8832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.478024][ T5890] logitech 0003:046D:C29C.0011: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.5-1/input0 [ 324.505224][ T10] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 324.552941][ T10] usb 5-1: USB disconnect, device number 53 [ 324.657931][ T5890] logitech 0003:046D:C29C.0011: no inputs found [ 324.861529][ T5890] usb 6-1: USB disconnect, device number 30 [ 325.028879][ T8855] netlink: 16 bytes leftover after parsing attributes in process `syz.3.848'. [ 325.603949][ T8861] FAULT_INJECTION: forcing a failure. [ 325.603949][ T8861] name failslab, interval 1, probability 0, space 0, times 0 [ 325.756116][ T8861] CPU: 0 UID: 0 PID: 8861 Comm: syz.4.851 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 325.756147][ T8861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 325.756160][ T8861] Call Trace: [ 325.756169][ T8861] [ 325.756177][ T8861] dump_stack_lvl+0x189/0x250 [ 325.756210][ T8861] ? __pfx_dump_stack_lvl+0x10/0x10 [ 325.756243][ T8861] ? __pfx__printk+0x10/0x10 [ 325.756262][ T8861] ? __pfx___might_resched+0x10/0x10 [ 325.756278][ T8861] ? fs_reclaim_acquire+0x7d/0x100 [ 325.756308][ T8861] should_fail_ex+0x414/0x560 [ 325.756330][ T8861] should_failslab+0xa8/0x100 [ 325.756353][ T8861] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 325.756375][ T8861] ? rtnl_prop_list_size+0x1ba/0x1e0 [ 325.756399][ T8861] ? __alloc_skb+0x112/0x2d0 [ 325.756422][ T8861] __alloc_skb+0x112/0x2d0 [ 325.756445][ T8861] rtmsg_ifinfo_build_skb+0x84/0x260 [ 325.756479][ T8861] rtmsg_ifinfo+0x8c/0x1a0 [ 325.756509][ T8861] netif_state_change+0x29e/0x3a0 [ 325.756530][ T8861] ? __pfx_netif_state_change+0x10/0x10 [ 325.756552][ T8861] ? netif_change_flags+0xe8/0x1a0 [ 325.756576][ T8861] do_setlink+0x2eb6/0x40d0 [ 325.756611][ T8861] ? __pfx_do_setlink+0x10/0x10 [ 325.756634][ T8861] ? __lock_acquire+0xaac/0xd20 [ 325.756663][ T8861] ? __mutex_trylock_common+0x153/0x260 [ 325.756683][ T8861] ? __pfx___mutex_trylock_common+0x10/0x10 [ 325.756704][ T8861] ? rcu_is_watching+0x15/0xb0 [ 325.756730][ T8861] ? trace_contention_end+0x39/0x120 [ 325.756747][ T8861] ? __mutex_lock+0x330/0xe80 [ 325.756765][ T8861] ? trace_irq_disable+0x37/0x110 [ 325.756784][ T8861] ? preempt_schedule_irq+0xde/0x150 [ 325.756801][ T8861] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 325.756823][ T8861] ? rtnl_newlink+0x8db/0x1c70 [ 325.756843][ T8861] ? __pfx___mutex_lock+0x10/0x10 [ 325.756873][ T8861] ? rtnl_newlink+0x5e7/0x1c70 [ 325.756896][ T8861] rtnl_newlink+0x149f/0x1c70 [ 325.756912][ T8861] ? finish_task_switch+0x18b/0x950 [ 325.756945][ T8861] ? __pfx_rtnl_newlink+0x10/0x10 [ 325.756961][ T8861] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.756996][ T8861] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 325.757015][ T8861] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.757034][ T8861] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 325.757051][ T8861] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 325.757079][ T8861] ? rcu_preempt_deferred_qs_irqrestore+0x851/0xc40 [ 325.757101][ T8861] ? __pfx___schedule+0x10/0x10 [ 325.757129][ T8861] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 325.757153][ T8861] ? rcu_is_watching+0x15/0xb0 [ 325.757181][ T8861] ? rcu_is_watching+0x15/0xb0 [ 325.757207][ T8861] ? rcu_read_unlock_special+0x3fe/0x4c0 [ 325.757237][ T8861] ? irqentry_exit+0x74/0x90 [ 325.757275][ T8861] ? __pfx_rtnl_newlink+0x10/0x10 [ 325.757292][ T8861] rtnetlink_rcv_msg+0x7cc/0xb70 [ 325.757313][ T8861] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 325.757330][ T8861] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 325.757363][ T8861] netlink_rcv_skb+0x219/0x490 [ 325.757383][ T8861] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 325.757402][ T8861] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 325.757438][ T8861] ? netlink_deliver_tap+0x2e/0x1b0 [ 325.757464][ T8861] netlink_unicast+0x758/0x8d0 [ 325.757490][ T8861] netlink_sendmsg+0x805/0xb30 [ 325.757517][ T8861] ? __pfx_netlink_sendmsg+0x10/0x10 [ 325.757538][ T8861] ? __import_iovec+0x5d4/0x7f0 [ 325.757560][ T8861] ? aa_sock_msg_perm+0x94/0x160 [ 325.757579][ T8861] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 325.757597][ T8861] ? __pfx_netlink_sendmsg+0x10/0x10 [ 325.757616][ T8861] __sock_sendmsg+0x219/0x270 [ 325.757635][ T8861] ____sys_sendmsg+0x505/0x830 [ 325.757662][ T8861] ? __pfx_____sys_sendmsg+0x10/0x10 [ 325.757700][ T8861] ___sys_sendmsg+0x21f/0x2a0 [ 325.757724][ T8861] ? __pfx____sys_sendmsg+0x10/0x10 [ 325.757779][ T8861] ? __fget_files+0x2a/0x420 [ 325.757800][ T8861] ? __fget_files+0x3a0/0x420 [ 325.757832][ T8861] __sys_sendmsg+0x164/0x220 [ 325.757855][ T8861] ? __pfx___sys_sendmsg+0x10/0x10 [ 325.757891][ T8861] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 325.757912][ T8861] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.757934][ T8861] __do_fast_syscall_32+0xb4/0x110 [ 325.757957][ T8861] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.757979][ T8861] do_fast_syscall_32+0x34/0x80 [ 325.758001][ T8861] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 325.758021][ T8861] RIP: 0023:0xf7f24539 [ 325.758038][ T8861] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 325.758053][ T8861] RSP: 002b:00000000f504655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 325.758071][ T8861] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 325.758083][ T8861] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 325.758093][ T8861] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 325.758108][ T8861] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 325.758117][ T8861] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 325.758142][ T8861] [ 326.253519][ C0] vkms_vblank_simulate: vblank timer overrun [ 326.793315][ T8873] netlink: 1264 bytes leftover after parsing attributes in process `syz.4.857'. [ 327.336349][ T10] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 327.424253][ T8900] FAULT_INJECTION: forcing a failure. [ 327.424253][ T8900] name failslab, interval 1, probability 0, space 0, times 0 [ 327.459582][ T8900] CPU: 1 UID: 0 PID: 8900 Comm: syz.2.862 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 327.459611][ T8900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 327.459624][ T8900] Call Trace: [ 327.459632][ T8900] [ 327.459642][ T8900] dump_stack_lvl+0x189/0x250 [ 327.459677][ T8900] ? __pfx_dump_stack_lvl+0x10/0x10 [ 327.459706][ T8900] ? __pfx__printk+0x10/0x10 [ 327.459731][ T8900] ? __pfx___might_resched+0x10/0x10 [ 327.459755][ T8900] should_fail_ex+0x414/0x560 [ 327.459795][ T8900] should_failslab+0xa8/0x100 [ 327.459823][ T8900] __kmalloc_noprof+0xcb/0x4f0 [ 327.459844][ T8900] ? sock_kmalloc+0xd6/0x160 [ 327.459870][ T8900] sock_kmalloc+0xd6/0x160 [ 327.459893][ T8900] hash_recvmsg+0x1c8/0x750 [ 327.459914][ T8900] ? __pfx_hash_recvmsg+0x10/0x10 [ 327.459929][ T8900] sock_recvmsg+0x229/0x270 [ 327.459947][ T8900] ____sys_recvmsg+0x1c9/0x460 [ 327.459974][ T8900] ? __pfx_____sys_recvmsg+0x10/0x10 [ 327.459993][ T8900] ? get_compat_msghdr+0x37e/0x4a0 [ 327.460020][ T8900] ? __lock_acquire+0xaac/0xd20 [ 327.460050][ T8900] ___sys_recvmsg+0x1b5/0x510 [ 327.460074][ T8900] ? __pfx____sys_recvmsg+0x10/0x10 [ 327.460115][ T8900] ? __fget_files+0x3a0/0x420 [ 327.460148][ T8900] do_recvmmsg+0x36a/0x760 [ 327.460176][ T8900] ? __pfx_do_recvmmsg+0x10/0x10 [ 327.460208][ T8900] ? __pfx_vfs_write+0x10/0x10 [ 327.460242][ T8900] __sys_recvmmsg+0x19d/0x280 [ 327.460265][ T8900] ? __pfx___sys_recvmmsg+0x10/0x10 [ 327.460284][ T8900] ? ksys_write+0x1f0/0x250 [ 327.460309][ T8900] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 327.460332][ T8900] __do_fast_syscall_32+0xb4/0x110 [ 327.460353][ T8900] ? lockdep_hardirqs_on+0x9c/0x150 [ 327.460374][ T8900] do_fast_syscall_32+0x34/0x80 [ 327.460393][ T8900] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 327.460413][ T8900] RIP: 0023:0xf710e539 [ 327.460426][ T8900] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 327.460440][ T8900] RSP: 002b:00000000f50bc55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 327.460457][ T8900] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080003700 [ 327.460468][ T8900] RDX: 000000000000063e RSI: 0000000000000000 RDI: 0000000000000000 [ 327.460477][ T8900] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 327.460485][ T8900] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 327.460495][ T8900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 327.460517][ T8900] [ 327.488185][ T10] usb 6-1: config 1 interface 0 has no altsetting 0 [ 327.821884][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice= 0.40 [ 327.836045][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.863427][ T10] usb 6-1: Product: syz [ 327.868076][ T10] usb 6-1: Manufacturer: syz [ 327.876303][ T10] usb 6-1: SerialNumber: syz [ 328.065418][ T8905] netlink: 4 bytes leftover after parsing attributes in process `syz.0.866'. [ 328.119590][ T10] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input23 [ 328.156228][ T5190] bcm5974 6-1:1.0: could not read from device [ 328.164356][ T8907] netlink: 4 bytes leftover after parsing attributes in process `syz.4.865'. [ 328.175180][ T5190] bcm5974 6-1:1.0: could not read from device [ 328.205144][ T10] usb 6-1: USB disconnect, device number 31 [ 328.289950][ T5848] udevd[5848]: Error opening device "/dev/input/event4": No such file or directory [ 328.330384][ T5848] udevd[5848]: Unable to EVIOCGABS device "/dev/input/event4" [ 328.355398][ T5848] udevd[5848]: Unable to EVIOCGABS device "/dev/input/event4" [ 328.385788][ T5848] udevd[5848]: Unable to EVIOCGABS device "/dev/input/event4" [ 328.425055][ T5848] udevd[5848]: Unable to EVIOCGABS device "/dev/input/event4" [ 329.787281][ T5912] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 329.913530][ T8932] 8021q: adding VLAN 0 to HW filter on device bond1 [ 329.930392][ T8932] bridge0: port 3(bond1) entered blocking state [ 329.941446][ T8932] bridge0: port 3(bond1) entered disabled state [ 329.956074][ T8932] bond1: entered allmulticast mode [ 329.975198][ T8932] bond1: entered promiscuous mode [ 329.983130][ T8932] bridge0: port 3(bond1) entered blocking state [ 329.989593][ T8932] bridge0: port 3(bond1) entered forwarding state [ 330.119804][ T5912] usb 4-1: Using ep0 maxpacket: 16 [ 330.136112][ T5912] usb 4-1: config 8 has an invalid interface number: 39 but max is 0 [ 330.158907][ T5912] usb 4-1: config 8 has no interface number 0 [ 330.203283][ T5912] usb 4-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 330.228438][ T53] bridge0: port 3(bond1) entered disabled state [ 330.304548][ T5912] usb 4-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 330.440613][ T5912] usb 4-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 330.640275][ T5912] usb 4-1: config 8 interface 39 has no altsetting 0 [ 330.684675][ T5912] usb 4-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 330.737568][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.746405][ T5912] usb 4-1: Product: syz [ 330.750699][ T5912] usb 4-1: Manufacturer: syz [ 330.755676][ T5912] usb 4-1: SerialNumber: syz [ 331.265160][ T30] audit: type=1326 audit(1746800672.833:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 331.396034][ T30] audit: type=1326 audit(1746800672.833:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 331.458990][ T30] audit: type=1326 audit(1746800672.833:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 331.480829][ C0] vkms_vblank_simulate: vblank timer overrun [ 331.488994][ T5890] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 331.605181][ T8943] ALSA: mixer_oss: invalid OSS volume 'T' [ 331.625570][ T8943] ALSA: mixer_oss: invalid OSS volume '6h$<`&-H8eb%ϓQ' [ 331.640898][ T30] audit: type=1326 audit(1746800672.833:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 331.662741][ C0] vkms_vblank_simulate: vblank timer overrun [ 331.733003][ T5890] usb 3-1: Using ep0 maxpacket: 16 [ 331.767942][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.786125][ T30] audit: type=1326 audit(1746800672.833:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 331.818586][ T5890] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 331.873637][ T8946] netlink: 4 bytes leftover after parsing attributes in process `syz.5.877'. [ 331.891606][ T5890] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 331.927387][ T30] audit: type=1326 audit(1746800672.833:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 331.936488][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 332.000335][ T30] audit: type=1326 audit(1746800672.833:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 332.072868][ T5890] usb 3-1: config 0 descriptor?? [ 332.104382][ T5890] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 332.188939][ T30] audit: type=1326 audit(1746800672.833:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 332.283529][ T30] audit: type=1326 audit(1746800672.833:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 332.364821][ T30] audit: type=1326 audit(1746800672.833:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8923 comm="syz.3.872" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fc5558 code=0x7ffc0000 [ 332.595376][ T5912] ipheth 4-1:8.39: ipheth_get_macaddr: usb_control_msg: -71 [ 332.647005][ T5912] ipheth 4-1:8.39: probe with driver ipheth failed with error -71 [ 332.706706][ T5912] usb 4-1: USB disconnect, device number 47 [ 332.784780][ T8951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.875'. [ 332.942999][ T8954] netlink: zone id is out of range [ 332.948581][ T8954] netlink: zone id is out of range [ 332.953918][ T8954] netlink: zone id is out of range [ 332.960043][ T8954] netlink: zone id is out of range [ 332.965174][ T8954] netlink: zone id is out of range [ 332.985999][ T8954] netlink: zone id is out of range [ 333.009151][ T8954] netlink: zone id is out of range [ 333.018345][ T8954] netlink: zone id is out of range [ 333.025008][ T8954] netlink: zone id is out of range [ 333.031674][ T8954] netlink: zone id is out of range [ 333.704793][ T8963] netlink: 40 bytes leftover after parsing attributes in process `syz.5.881'. [ 334.499335][ T5836] usb 3-1: USB disconnect, device number 56 [ 334.636872][ T5912] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 334.861930][ T5912] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 334.941199][ T5912] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 334.975008][ T5912] usb 6-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 334.985979][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.017528][ T5912] usb 6-1: Product: syz [ 335.030143][ T5912] usb 6-1: Manufacturer: syz [ 335.048561][ T5912] usb 6-1: SerialNumber: syz [ 335.121022][ T5912] usb 6-1: config 0 descriptor?? [ 335.157009][ T5912] usb 6-1: Found UVC 0.00 device syz (18ec:3288) [ 335.176831][ T5912] usb 6-1: No valid video chain found. [ 335.318810][ T8977] fuse: Unknown parameter 'fd300000000000000000006' [ 335.344485][ T8967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.345143][ T8977] netlink: 68 bytes leftover after parsing attributes in process `syz.3.887'. [ 335.369790][ T8967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.422819][ T8967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.452955][ T8967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.469048][ T8979] gretap0: entered promiscuous mode [ 335.478442][ T8979] macsec1: entered promiscuous mode [ 335.514482][ T8979] gretap0: left promiscuous mode [ 335.564481][ T8989] xt_TCPMSS: Only works on TCP SYN packets [ 335.598862][ T1207] usb 6-1: USB disconnect, device number 32 [ 335.646343][ T5890] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 335.661411][ T8990] FAULT_INJECTION: forcing a failure. [ 335.661411][ T8990] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 335.707091][ T8990] CPU: 1 UID: 0 PID: 8990 Comm: syz.0.886 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 335.707122][ T8990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 335.707134][ T8990] Call Trace: [ 335.707143][ T8990] [ 335.707151][ T8990] dump_stack_lvl+0x189/0x250 [ 335.707182][ T8990] ? __lock_acquire+0xaac/0xd20 [ 335.707217][ T8990] ? __pfx_dump_stack_lvl+0x10/0x10 [ 335.707245][ T8990] ? __pfx__printk+0x10/0x10 [ 335.707264][ T8990] ? __might_fault+0xb0/0x130 [ 335.707300][ T8990] should_fail_ex+0x414/0x560 [ 335.707332][ T8990] _copy_from_user+0x2d/0xb0 [ 335.707359][ T8990] get_compat_msghdr+0xad/0x4a0 [ 335.707388][ T8990] ? __pfx_get_compat_msghdr+0x10/0x10 [ 335.707414][ T8990] ? rcu_is_watching+0x15/0xb0 [ 335.707441][ T8990] ? ___sys_sendmsg+0x22f/0x2a0 [ 335.707473][ T8990] ___sys_sendmsg+0x193/0x2a0 [ 335.707501][ T8990] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.707526][ T8990] ? do_user_addr_fault+0xbc1/0x1390 [ 335.707589][ T8990] __sys_sendmmsg+0x28e/0x430 [ 335.707621][ T8990] ? __pfx___sys_sendmmsg+0x10/0x10 [ 335.707654][ T8990] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 335.707695][ T8990] ? ksys_write+0x1f0/0x250 [ 335.707727][ T8990] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 335.707754][ T8990] __do_fast_syscall_32+0xb4/0x110 [ 335.707779][ T8990] ? lockdep_hardirqs_on+0x9c/0x150 [ 335.707805][ T8990] do_fast_syscall_32+0x34/0x80 [ 335.707829][ T8990] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.707852][ T8990] RIP: 0023:0xf7f48539 [ 335.707868][ T8990] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 335.707885][ T8990] RSP: 002b:00000000f504555c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 335.707906][ T8990] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080005240 [ 335.707919][ T8990] RDX: 0000000004000095 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.707930][ T8990] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.707941][ T8990] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 335.707952][ T8990] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.707979][ T8990] [ 335.934633][ C1] vkms_vblank_simulate: vblank timer overrun [ 336.033910][ T5890] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 336.046531][ T5890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 336.059206][ T8994] netlink: 28 bytes leftover after parsing attributes in process `syz.0.892'. [ 336.158269][ T5890] usb 4-1: config 0 descriptor?? [ 336.214542][ T8996] netlink: 8 bytes leftover after parsing attributes in process `syz.4.891'. [ 336.238937][ T8996] netlink: 312 bytes leftover after parsing attributes in process `syz.4.891'. [ 336.306932][ T5836] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 336.374919][ T8996] netlink: 'syz.4.891': attribute type 1 has an invalid length. [ 336.408523][ T5890] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 336.437891][ T5890] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 336.457345][ T5890] [drm:udl_init] *ERROR* Selecting channel failed [ 336.476159][ T5836] usb 1-1: Using ep0 maxpacket: 8 [ 336.498846][ T5890] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 336.509205][ T5836] usb 1-1: unable to get BOS descriptor or descriptor too short [ 336.518801][ T5890] [drm] Initialized udl on minor 2 [ 336.529915][ T5890] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 336.542897][ T5836] usb 1-1: config index 0 descriptor too short (expected 7260, got 92) [ 336.543871][ T5890] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 336.567715][ T1207] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 336.581158][ T5890] usb 4-1: USB disconnect, device number 48 [ 336.590019][ T1207] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 336.606588][ T5836] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1535, setting to 1024 [ 336.658044][ T5836] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 336.668818][ T5836] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 336.683215][ T5836] usb 1-1: language id specifier not provided by device, defaulting to English [ 336.700339][ T5836] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 336.710417][ T5836] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.718737][ T5836] usb 1-1: Product: syz [ 336.723379][ T5836] usb 1-1: Manufacturer: 屛뗝⏱钆睚É띔矚鰾娔셢莕ῗൡ蘥뜴㤊䤎眑鬤陃ꦂ缳Ἅ㝡䇌뮣踛磬曣㜛⍑ [ 336.741495][ T5836] usb 1-1: SerialNumber: syz [ 336.746569][ T24] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 336.896385][ T24] usb 6-1: device descriptor read/64, error -71 [ 336.992013][ T8994] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 337.035869][ T8994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.071304][ T8994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.183340][ T5836] cdc_ncm 1-1:1.0: bind() failure [ 337.222237][ T5836] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 337.230613][ T24] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 337.250083][ T5836] cdc_ncm 1-1:1.1: bind() failure [ 337.265831][ T5836] usb 1-1: USB disconnect, device number 50 [ 337.376896][ T24] usb 6-1: device descriptor read/64, error -71 [ 337.506540][ T24] usb usb6-port1: attempt power cycle [ 337.846315][ T24] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 337.920471][ T9019] syzkaller1: entered promiscuous mode [ 337.926519][ T9019] syzkaller1: entered allmulticast mode [ 337.945262][ T24] usb 6-1: device descriptor read/8, error -71 [ 338.207219][ T24] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 338.236662][ T5836] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 338.295739][ T24] usb 6-1: device descriptor read/8, error -71 [ 338.416424][ T5836] usb 1-1: Using ep0 maxpacket: 8 [ 338.428203][ T24] usb usb6-port1: unable to enumerate USB device [ 338.434821][ T5836] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 338.446376][ T5836] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.537336][ T5836] usb 1-1: config 0 descriptor?? [ 338.786199][ T10] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 338.948764][ T10] usb 4-1: config 220 has too many interfaces: 184, using maximum allowed: 32 [ 338.963830][ T10] usb 4-1: config 220 has 1 interface, different from the descriptor's value: 184 [ 338.993865][ T10] usb 4-1: config 220 has no interface number 0 [ 339.025276][ T10] usb 4-1: too many endpoints for config 220 interface 139 altsetting 1: 110, using maximum allowed: 30 [ 339.059706][ T10] usb 4-1: config 220 interface 139 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 110 [ 339.107923][ T10] usb 4-1: config 220 interface 139 has no altsetting 0 [ 339.114965][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=8008, bcdDevice=e1.85 [ 339.160593][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.418971][ T10] usb 4-1: string descriptor 0 read error: -71 [ 339.467859][ T10] gspca_main: sn9c2028-2.14.0 probing 0c45:8008 [ 339.495877][ T10] gspca_sn9c2028: read1 error -71 [ 339.539987][ T10] gspca_sn9c2028: read1 error -71 [ 339.561287][ T10] gspca_sn9c2028: read1 error -71 [ 339.568345][ T30] kauditd_printk_skb: 81 callbacks suppressed [ 339.568363][ T30] audit: type=1326 audit(1746800681.163:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9018 comm="syz.0.899" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f48539 code=0x7ffc0000 [ 339.591301][ T10] sn9c2028 4-1:220.139: probe with driver sn9c2028 failed with error -71 [ 339.596305][ C1] vkms_vblank_simulate: vblank timer overrun [ 339.646617][ T30] audit: type=1326 audit(1746800681.233:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9018 comm="syz.0.899" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f48539 code=0x7ffc0000 [ 339.753099][ T5836] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 339.767393][ T5836] asix 1-1:0.0: probe with driver asix failed with error -32 [ 339.775371][ T10] usb 4-1: USB disconnect, device number 49 [ 339.817706][ T5836] usb 1-1: USB disconnect, device number 51 [ 339.835075][ T9029] FAULT_INJECTION: forcing a failure. [ 339.835075][ T9029] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 339.870822][ T9029] CPU: 1 UID: 0 PID: 9029 Comm: syz.4.902 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 339.870854][ T9029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 339.870866][ T9029] Call Trace: [ 339.870875][ T9029] [ 339.870883][ T9029] dump_stack_lvl+0x189/0x250 [ 339.870916][ T9029] ? __lock_acquire+0xaac/0xd20 [ 339.870947][ T9029] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.870975][ T9029] ? __pfx__printk+0x10/0x10 [ 339.870996][ T9029] ? __might_fault+0xb0/0x130 [ 339.871034][ T9029] should_fail_ex+0x414/0x560 [ 339.871059][ T9029] _copy_from_user+0x2d/0xb0 [ 339.871087][ T9029] kvm_arch_vcpu_ioctl+0x4ae/0x2a10 [ 339.871113][ T9029] ? kvm_arch_vcpu_ioctl+0x46e/0x2a10 [ 339.871135][ T9029] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 339.871169][ T9029] ? __lock_acquire+0xaac/0xd20 [ 339.871209][ T9029] ? __lock_acquire+0xaac/0xd20 [ 339.871255][ T9029] ? is_bpf_text_address+0x26/0x2b0 [ 339.871289][ T9029] ? is_bpf_text_address+0x292/0x2b0 [ 339.871314][ T9029] ? is_bpf_text_address+0x26/0x2b0 [ 339.871344][ T9029] ? kernel_text_address+0xa5/0xe0 [ 339.871371][ T9029] ? __kernel_text_address+0xd/0x40 [ 339.871395][ T9029] ? unwind_get_return_address+0x4d/0x90 [ 339.871418][ T9029] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 339.871440][ T9029] ? arch_stack_walk+0xfc/0x150 [ 339.871488][ T9029] ? __lock_acquire+0xaac/0xd20 [ 339.871522][ T9029] ? __mutex_trylock_common+0x153/0x260 [ 339.871545][ T9029] ? __pfx___mutex_trylock_common+0x10/0x10 [ 339.871564][ T9029] ? do_vfs_ioctl+0xf36/0x1eb0 [ 339.871588][ T9029] ? rcu_is_watching+0x15/0xb0 [ 339.871617][ T9029] ? trace_contention_end+0x39/0x120 [ 339.871638][ T9029] ? __mutex_lock+0x330/0xe80 [ 339.871673][ T9029] ? kvm_vcpu_ioctl+0x22c/0xe90 [ 339.871703][ T9029] ? __pfx___mutex_lock+0x10/0x10 [ 339.871741][ T9029] ? kasan_quarantine_put+0xdd/0x220 [ 339.871775][ T9029] kvm_vcpu_ioctl+0x74b/0xe90 [ 339.871809][ T9029] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 339.871836][ T9029] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 339.871912][ T9029] kvm_vcpu_compat_ioctl+0x203/0x390 [ 339.871944][ T9029] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 339.871973][ T9029] ? __fget_files+0x3a0/0x420 [ 339.871997][ T9029] ? __fget_files+0x2a/0x420 [ 339.872026][ T9029] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 339.872055][ T9029] __ia32_compat_sys_ioctl+0x551/0x840 [ 339.872080][ T9029] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 339.872101][ T9029] ? __fget_files+0x3a0/0x420 [ 339.872134][ T9029] ? fput+0xa0/0xd0 [ 339.872163][ T9029] ? ksys_write+0x1f0/0x250 [ 339.872193][ T9029] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 339.872219][ T9029] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.872244][ T9029] __do_fast_syscall_32+0xb4/0x110 [ 339.872269][ T9029] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.872296][ T9029] do_fast_syscall_32+0x34/0x80 [ 339.872321][ T9029] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 339.872343][ T9029] RIP: 0023:0xf7f24539 [ 339.872359][ T9029] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 339.872375][ T9029] RSP: 002b:00000000f504655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 339.872395][ T9029] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004008ae89 [ 339.872409][ T9029] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 339.872422][ T9029] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 339.872434][ T9029] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 339.872446][ T9029] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 339.872478][ T9029] [ 340.697803][ T9045] netlink: 136 bytes leftover after parsing attributes in process `syz.2.908'. [ 340.723415][ T9045] net_ratelimit: 207 callbacks suppressed [ 340.723435][ T9045] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 340.757664][ T9051] netlink: 4 bytes leftover after parsing attributes in process `syz.4.910'. [ 340.771995][ T9051] netlink: 4 bytes leftover after parsing attributes in process `syz.4.910'. [ 341.006288][ T5836] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 341.177770][ T5836] usb 1-1: config 0 has an invalid descriptor of length 155, skipping remainder of the config [ 341.207336][ T5836] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 341.224423][ T5836] usb 1-1: New USB device found, idVendor=04f2, idProduct=0418, bcdDevice= 0.00 [ 341.243966][ T5836] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.266788][ T5836] usb 1-1: config 0 descriptor?? [ 341.276401][ T1207] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 341.284211][ T9063] 8021q: VLANs not supported on sit0 [ 341.472399][ T1207] usb 4-1: Using ep0 maxpacket: 32 [ 341.501175][ T1207] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 341.517063][ T1207] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 341.543801][ T1207] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 341.557359][ T9068] netlink: 8 bytes leftover after parsing attributes in process `syz.0.911'. [ 341.621731][ T1207] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid wMaxPacketSize 0 [ 341.638785][ T1207] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 341.719914][ T1207] usb 4-1: config 0 interface 0 has no altsetting 0 [ 341.746124][ T1207] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 341.760136][ T1207] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 341.798091][ T1207] usb 4-1: Product: syz [ 341.809591][ T1207] usb 4-1: Manufacturer: syz [ 341.834263][ T1207] usb 4-1: SerialNumber: syz [ 341.927238][ T1207] usb 4-1: config 0 descriptor?? [ 341.943463][ T1207] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 342.018126][ T1207] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 342.168397][ T9058] ldusb 4-1:0.0: Couldn't submit interrupt_in_urb -90 [ 342.182302][ T1207] usb 4-1: USB disconnect, device number 50 [ 342.190834][ T1207] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 342.907092][ T9087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.923'. [ 343.036653][ T5890] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 343.206077][ T5890] usb 5-1: Using ep0 maxpacket: 16 [ 343.228267][ T5890] usb 5-1: unable to get BOS descriptor or descriptor too short [ 343.241884][ T5890] usb 5-1: config 9 has an invalid interface number: 212 but max is 0 [ 343.261179][ T5890] usb 5-1: config 9 has no interface number 0 [ 343.268192][ T5890] usb 5-1: config 9 interface 212 has no altsetting 0 [ 343.278153][ T5890] usb 5-1: New USB device found, idVendor=05ac, idProduct=0252, bcdDevice=f3.5f [ 343.289088][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.298207][ T5890] usb 5-1: Product: syz [ 343.313795][ T5890] usb 5-1: Manufacturer: syz [ 343.333215][ T5890] usb 5-1: SerialNumber: syz [ 343.580039][ T5890] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:9.212/input/input25 [ 343.596315][ T9104] netlink: 4 bytes leftover after parsing attributes in process `syz.2.931'. [ 343.618397][ T9104] netlink: 4 bytes leftover after parsing attributes in process `syz.2.931'. [ 343.625213][ T5890] usb 5-1: USB disconnect, device number 54 [ 343.628052][ T5190] bcm5974 5-1:9.212: could not read from device [ 343.650237][ T5190] bcm5974 5-1:9.212: could not read from device [ 343.789789][ T10] usb 1-1: USB disconnect, device number 52 [ 343.893017][ T9116] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (65) [ 343.902169][ T9115] Cannot find add_set index 0 as target [ 344.151214][ T9124] TCP: TCP_TX_DELAY enabled [ 344.159288][ T9124] SET target dimension over the limit! [ 344.173579][ T9127] netlink: 8 bytes leftover after parsing attributes in process `syz.4.939'. [ 344.184402][ T9127] netlink: 4 bytes leftover after parsing attributes in process `syz.4.939'. [ 344.193542][ T9127] netlink: 'syz.4.939': attribute type 12 has an invalid length. [ 344.396651][ T10] usb 3-1: new low-speed USB device number 57 using dummy_hcd [ 344.567757][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 344.798319][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 344.829450][ T10] usb 3-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 344.888017][ T5145] Bluetooth: hci5: command 0x0406 tx timeout [ 344.913913][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.934225][ T10] usb 3-1: config 0 descriptor?? [ 345.064852][ T9145] FAULT_INJECTION: forcing a failure. [ 345.064852][ T9145] name failslab, interval 1, probability 0, space 0, times 0 [ 345.126141][ T9145] CPU: 1 UID: 0 PID: 9145 Comm: syz.5.943 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 345.126171][ T9145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 345.126184][ T9145] Call Trace: [ 345.126192][ T9145] [ 345.126200][ T9145] dump_stack_lvl+0x189/0x250 [ 345.126236][ T9145] ? __pfx_dump_stack_lvl+0x10/0x10 [ 345.126272][ T9145] ? __pfx__printk+0x10/0x10 [ 345.126296][ T9145] ? __pfx___might_resched+0x10/0x10 [ 345.126312][ T9145] ? fs_reclaim_acquire+0x7d/0x100 [ 345.126346][ T9145] should_fail_ex+0x414/0x560 [ 345.126370][ T9145] should_failslab+0xa8/0x100 [ 345.126398][ T9145] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 345.126422][ T9145] ? __alloc_skb+0x112/0x2d0 [ 345.126450][ T9145] __alloc_skb+0x112/0x2d0 [ 345.126481][ T9145] inet_ifmcaddr_notify+0x7e/0x150 [ 345.126509][ T9145] __ip_mc_dec_group+0x40b/0x690 [ 345.126554][ T9145] inetdev_event+0x2a7/0x15b0 [ 345.126587][ T9145] ? __pfx_inetdev_event+0x10/0x10 [ 345.126622][ T9145] notifier_call_chain+0x1b3/0x3e0 [ 345.126652][ T9145] __dev_notify_flags+0x18d/0x2e0 [ 345.126680][ T9145] ? __pfx___dev_notify_flags+0x10/0x10 [ 345.126702][ T9145] ? __dev_change_flags+0x4cc/0x6d0 [ 345.126732][ T9145] ? __pfx___dev_change_flags+0x10/0x10 [ 345.126767][ T9145] netif_change_flags+0xe8/0x1a0 [ 345.126794][ T9145] do_setlink+0xcb9/0x40d0 [ 345.126832][ T9145] ? __pfx_do_setlink+0x10/0x10 [ 345.126854][ T9145] ? do_raw_spin_lock+0x121/0x290 [ 345.126887][ T9145] ? lockdep_hardirqs_on+0x9c/0x150 [ 345.126911][ T9145] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 345.126932][ T9145] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 345.126958][ T9145] ? rcu_is_watching+0x15/0xb0 [ 345.126991][ T9145] ? __mutex_lock+0xa6d/0xe80 [ 345.127016][ T9145] ? __mutex_lock+0x51b/0xe80 [ 345.127044][ T9145] ? rtnl_newlink+0x8db/0x1c70 [ 345.127068][ T9145] ? __pfx___mutex_lock+0x10/0x10 [ 345.127101][ T9145] ? ns_capable+0x8a/0xf0 [ 345.127121][ T9145] ? rtnl_link_get_net_capable+0x16a/0x350 [ 345.127150][ T9145] rtnl_newlink+0x160b/0x1c70 [ 345.127169][ T9145] ? kasan_save_track+0x3e/0x80 [ 345.127204][ T9145] ? __pfx_rtnl_newlink+0x10/0x10 [ 345.127256][ T9145] ? kasan_quarantine_put+0xdd/0x220 [ 345.127285][ T9145] ? lockdep_hardirqs_on+0x9c/0x150 [ 345.127315][ T9145] ? nlmon_xmit+0xb0/0x100 [ 345.127340][ T9145] ? kmem_cache_free+0x192/0x3f0 [ 345.127372][ T9145] ? __local_bh_enable_ip+0x12d/0x1c0 [ 345.127404][ T9145] ? lockdep_hardirqs_on+0x9c/0x150 [ 345.127428][ T9145] ? __local_bh_enable_ip+0x12d/0x1c0 [ 345.127458][ T9145] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 345.127497][ T9145] ? aa_get_newest_label+0xf7/0x5d0 [ 345.127522][ T9145] ? __lock_acquire+0xaac/0xd20 [ 345.127575][ T9145] ? __pfx_rtnl_newlink+0x10/0x10 [ 345.127595][ T9145] rtnetlink_rcv_msg+0x7cc/0xb70 [ 345.127621][ T9145] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 345.127641][ T9145] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 345.127666][ T9145] ? ref_tracker_free+0x63a/0x7d0 [ 345.127686][ T9145] ? __copy_skb_header+0xa7/0x550 [ 345.127723][ T9145] netlink_rcv_skb+0x219/0x490 [ 345.127746][ T9145] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 345.127769][ T9145] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 345.127812][ T9145] ? netlink_deliver_tap+0x2e/0x1b0 [ 345.127835][ T9145] ? netlink_deliver_tap+0x2e/0x1b0 [ 345.127863][ T9145] netlink_unicast+0x758/0x8d0 [ 345.127905][ T9145] netlink_sendmsg+0x805/0xb30 [ 345.127937][ T9145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 345.127962][ T9145] ? __import_iovec+0x5d4/0x7f0 [ 345.127986][ T9145] ? aa_sock_msg_perm+0x94/0x160 [ 345.128008][ T9145] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 345.128030][ T9145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 345.128052][ T9145] __sock_sendmsg+0x219/0x270 [ 345.128075][ T9145] ____sys_sendmsg+0x505/0x830 [ 345.128106][ T9145] ? __pfx_____sys_sendmsg+0x10/0x10 [ 345.128149][ T9145] ___sys_sendmsg+0x21f/0x2a0 [ 345.128195][ T9145] ? __pfx____sys_sendmsg+0x10/0x10 [ 345.128270][ T9145] ? __fget_files+0x2a/0x420 [ 345.128297][ T9145] ? __fget_files+0x3a0/0x420 [ 345.128334][ T9145] __sys_sendmsg+0x164/0x220 [ 345.128362][ T9145] ? __pfx___sys_sendmsg+0x10/0x10 [ 345.128405][ T9145] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 345.128432][ T9145] ? lockdep_hardirqs_on+0x9c/0x150 [ 345.128457][ T9145] __do_fast_syscall_32+0xb4/0x110 [ 345.128483][ T9145] ? lockdep_hardirqs_on+0x9c/0x150 [ 345.128509][ T9145] do_fast_syscall_32+0x34/0x80 [ 345.128534][ T9145] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 345.128558][ T9145] RIP: 0023:0xf7fe8539 [ 345.128575][ T9145] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 345.128591][ T9145] RSP: 002b:00000000f510655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 345.128612][ T9145] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000040 [ 345.128625][ T9145] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 345.128637][ T9145] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 345.128647][ T9145] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 345.128658][ T9145] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 345.128687][ T9145] [ 345.639033][ C1] vkms_vblank_simulate: vblank timer overrun [ 345.761152][ T9147] netlink: 8 bytes leftover after parsing attributes in process `syz.3.944'. [ 345.773968][ T30] audit: type=1326 audit(1746800687.353:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.807139][ T9147] bridge_slave_1: left allmulticast mode [ 345.838196][ T9147] bridge_slave_1: left promiscuous mode [ 345.864325][ T30] audit: type=1326 audit(1746800687.353:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.886346][ T30] audit: type=1326 audit(1746800687.353:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.886536][ T5890] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 345.908306][ T30] audit: type=1326 audit(1746800687.353:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908361][ T30] audit: type=1326 audit(1746800687.353:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908405][ T30] audit: type=1326 audit(1746800687.353:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=361 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908450][ T30] audit: type=1326 audit(1746800687.353:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908493][ T30] audit: type=1326 audit(1746800687.353:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=364 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908545][ T30] audit: type=1326 audit(1746800687.353:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.908591][ T30] audit: type=1326 audit(1746800687.353:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9146 comm="syz.3.944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fc5539 code=0x7ffc0000 [ 345.949410][ T9147] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.028174][ C1] vkms_vblank_simulate: vblank timer overrun [ 346.283968][ T10] usb 3-1: string descriptor 0 read error: -71 [ 346.308349][ T10] qmi_wwan 3-1:0.0: probe with driver qmi_wwan failed with error -22 [ 346.363865][ T10] usb 3-1: USB disconnect, device number 57 [ 346.378889][ T5890] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 346.391609][ T5890] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 346.418952][ T5890] usb 5-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 346.435867][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.465223][ T5890] usb 5-1: config 0 descriptor?? [ 346.976628][ T10] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 347.004301][ T5890] lenovo 0003:17EF:60EE.0012: unknown main item tag 0x0 [ 347.022914][ T5890] lenovo 0003:17EF:60EE.0012: item fetching failed at offset 3/7 [ 347.033745][ T5890] lenovo 0003:17EF:60EE.0012: hid_parse failed [ 347.040874][ T5890] lenovo 0003:17EF:60EE.0012: probe with driver lenovo failed with error -22 [ 347.170471][ T10] usb 3-1: config 0 has no interfaces? [ 347.237961][ T10] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 347.258584][ T975] usb 1-1: new full-speed USB device number 53 using dummy_hcd [ 347.295361][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.340988][ T5890] usb 5-1: USB disconnect, device number 55 [ 347.366427][ T10] usb 3-1: Product: syz [ 347.382799][ T10] usb 3-1: Manufacturer: syz [ 347.397556][ T10] usb 3-1: SerialNumber: syz [ 347.425709][ T10] usb 3-1: config 0 descriptor?? [ 347.481508][ T975] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 347.504240][ T975] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 347.551493][ T975] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 347.563232][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.579172][ T975] usb 1-1: Product: syz [ 347.592637][ T975] usb 1-1: Manufacturer: syz [ 347.603792][ T975] usb 1-1: SerialNumber: syz [ 347.636775][ T975] usb 1-1: selecting invalid altsetting 1 [ 347.965400][ T975] cdc_ncm 1-1:1.0: bind() failure [ 348.045511][ T975] usb 1-1: USB disconnect, device number 53 [ 348.349576][ T9193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.958'. [ 349.254133][ T9204] netlink: 24 bytes leftover after parsing attributes in process `syz.0.960'. [ 349.267564][ T975] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 349.377433][ T9204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.960'. [ 349.448285][ T975] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 349.464066][ T975] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 349.475677][ T9207] FAULT_INJECTION: forcing a failure. [ 349.475677][ T9207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 349.496386][ T975] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 349.507002][ T9207] CPU: 1 UID: 0 PID: 9207 Comm: syz.4.961 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 349.507024][ T9207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 349.507033][ T9207] Call Trace: [ 349.507039][ T9207] [ 349.507045][ T9207] dump_stack_lvl+0x189/0x250 [ 349.507070][ T9207] ? __lock_acquire+0xaac/0xd20 [ 349.507093][ T9207] ? __pfx_dump_stack_lvl+0x10/0x10 [ 349.507113][ T9207] ? __pfx__printk+0x10/0x10 [ 349.507126][ T9207] ? __might_fault+0xb0/0x130 [ 349.507153][ T9207] should_fail_ex+0x414/0x560 [ 349.507170][ T9207] _copy_from_user+0x2d/0xb0 [ 349.507191][ T9207] get_compat_msghdr+0xad/0x4a0 [ 349.507213][ T9207] ? __pfx_get_compat_msghdr+0x10/0x10 [ 349.507239][ T9207] ___sys_sendmsg+0x193/0x2a0 [ 349.507260][ T9207] ? __pfx____sys_sendmsg+0x10/0x10 [ 349.507303][ T9207] ? __fget_files+0x2a/0x420 [ 349.507321][ T9207] ? __fget_files+0x3a0/0x420 [ 349.507346][ T9207] __sys_sendmsg+0x164/0x220 [ 349.507365][ T9207] ? __pfx___sys_sendmsg+0x10/0x10 [ 349.507394][ T9207] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 349.507412][ T9207] ? lockdep_hardirqs_on+0x9c/0x150 [ 349.507430][ T9207] __do_fast_syscall_32+0xb4/0x110 [ 349.507448][ T9207] ? lockdep_hardirqs_on+0x9c/0x150 [ 349.507467][ T9207] do_fast_syscall_32+0x34/0x80 [ 349.507484][ T9207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 349.507501][ T9207] RIP: 0023:0xf7f24539 [ 349.507514][ T9207] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 349.507526][ T9207] RSP: 002b:00000000f504655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 349.507541][ T9207] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080006040 [ 349.507551][ T9207] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 349.507564][ T9207] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 349.507572][ T9207] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 349.507580][ T9207] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 349.507600][ T9207] [ 349.510084][ T975] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.764065][ T975] usb 6-1: config 0 descriptor?? [ 350.116069][ T24] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 350.194866][ T9217] xt_CT: No such helper "syz0" [ 350.272021][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 350.285836][ T24] usb 5-1: not running at top speed; connect to a high speed hub [ 350.296548][ T24] usb 5-1: config 4 has an invalid interface number: 147 but max is 0 [ 350.309909][ T24] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 350.323956][ T24] usb 5-1: config 4 has no interface number 0 [ 350.334325][ T24] usb 5-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 350.343983][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.352953][ T24] usb 5-1: Product: syz [ 350.361924][ T24] usb 5-1: Manufacturer: syz [ 350.366946][ T24] usb 5-1: SerialNumber: syz [ 350.392972][ T975] usb 6-1: language id specifier not provided by device, defaulting to English [ 350.702390][ T975] uclogic 0003:256C:006D.0013: failed retrieving Huion firmware version: -71 [ 350.719467][ T24] usb 5-1: USB disconnect, device number 56 [ 350.740143][ T975] uclogic 0003:256C:006D.0013: failed probing parameters: -71 [ 350.752963][ T975] uclogic 0003:256C:006D.0013: probe with driver uclogic failed with error -71 [ 350.773044][ T975] usb 6-1: USB disconnect, device number 37 [ 350.793549][ T5926] usb 3-1: USB disconnect, device number 58 [ 351.722851][ T9238] netlink: 4 bytes leftover after parsing attributes in process `syz.5.968'. [ 351.931260][ T9238] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 351.977749][ T975] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 352.148053][ T975] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 352.165735][ T975] usb 5-1: config 0 has no interface number 0 [ 352.189371][ T975] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 352.208872][ T975] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.225914][ T975] usb 5-1: Product: syz [ 352.238614][ T975] usb 5-1: Manufacturer: syz [ 352.255391][ T9246] netlink: 'syz.5.971': attribute type 7 has an invalid length. [ 352.258180][ T975] usb 5-1: SerialNumber: syz [ 352.303536][ T9246] netlink: 8 bytes leftover after parsing attributes in process `syz.5.971'. [ 352.330540][ T975] usb 5-1: config 0 descriptor?? [ 352.385072][ T9249] only policy match revision 0 supported [ 352.385091][ T9249] unable to load match [ 352.536316][ T5890] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 352.945148][ T5890] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 352.980211][ T5890] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 353.042273][ T5890] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 353.075022][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.103588][ T5890] usb 4-1: Product: syz [ 353.118032][ T5890] usb 4-1: Manufacturer: syz [ 353.133278][ T5890] usb 4-1: SerialNumber: syz [ 353.358285][ T5890] usb 4-1: selecting invalid altsetting 1 [ 353.430316][ T9256] @: renamed from bond_slave_0 (while UP) [ 353.563101][ T9255] netlink: 28 bytes leftover after parsing attributes in process `syz.5.973'. [ 353.588054][ T5890] cdc_ncm 4-1:1.0: bind() failure [ 353.635508][ T5890] usb 4-1: USB disconnect, device number 51 [ 354.346414][ T5890] usb 6-1: new full-speed USB device number 38 using dummy_hcd [ 354.356146][ T5836] usb 3-1: new full-speed USB device number 59 using dummy_hcd [ 354.496493][ T5836] usb 3-1: device descriptor read/64, error -71 [ 354.551729][ T5890] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 354.575553][ T5890] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.606011][ T5890] usb 6-1: Product: syz [ 354.610241][ T5890] usb 6-1: Manufacturer: syz [ 354.636019][ T5890] usb 6-1: SerialNumber: syz [ 354.688817][ T5890] usb 6-1: config 0 descriptor?? [ 354.689502][ T975] usb 5-1: Found UVC 0.08 device syz (046d:0823) [ 354.716836][ T9271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.977'. [ 354.739295][ T5836] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 354.787495][ T975] uvcvideo 5-1:0.64: Entity type for entity Output 3 was not initialized! [ 354.837026][ T975] usb 5-1: Failed to create links for entity 3 [ 354.863699][ T975] usb 5-1: Failed to register entities (-22). [ 354.904190][ T975] usb 5-1: USB disconnect, device number 57 [ 354.922691][ T5890] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 354.946107][ T5836] usb 3-1: device descriptor read/64, error -71 [ 355.063606][ T5836] usb usb3-port1: attempt power cycle [ 355.416049][ T5836] usb 3-1: new full-speed USB device number 61 using dummy_hcd [ 355.453079][ T5836] usb 3-1: device descriptor read/8, error -71 [ 355.497946][ T975] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 355.696155][ T5836] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 355.723777][ T975] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 355.732656][ T975] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 355.743161][ T975] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 355.813733][ T5836] usb 3-1: device descriptor read/8, error -71 [ 355.823055][ T975] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 355.846084][ T975] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 355.936101][ T975] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 355.945691][ T5836] usb usb3-port1: unable to enumerate USB device [ 355.963591][ T975] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 356.088913][ T975] usb 5-1: Product: syz [ 356.093268][ T975] usb 5-1: Manufacturer: syz [ 356.109918][ T975] cdc_wdm 5-1:1.0: skipping garbage [ 356.116346][ T975] cdc_wdm 5-1:1.0: skipping garbage [ 356.124056][ T975] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 356.290568][ T975] cdc_wdm 5-1:1.0: Unknown control protocol [ 357.009071][ T9279] netlink: 4 bytes leftover after parsing attributes in process `syz.4.981'. [ 357.126368][ T10] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 357.399226][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 357.423269][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 357.449389][ T5890] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 357.480408][ T5890] usb 6-1: USB disconnect, device number 38 [ 357.489709][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 357.576154][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 357.643323][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=c53f, bcdDevice= 0.00 [ 357.667106][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.734270][ T10] usb 3-1: config 0 descriptor?? [ 358.023443][ T9279] team0 (unregistering): Port device team_slave_0 removed [ 358.071197][ T9279] team0 (unregistering): Port device team_slave_1 removed [ 358.272910][ T10] logitech-djreceiver 0003:046D:C53F.0014: hidraw0: USB HID v0.00 Device [HID 046d:c53f] on usb-dummy_hcd.2-1/input0 [ 358.422104][ T10] usb 3-1: USB disconnect, device number 63 [ 358.551975][ T9297] fido_id[9297]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 358.585626][ T24] usb 5-1: USB disconnect, device number 58 [ 358.972611][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 358.972631][ T30] audit: type=1326 audit(1746800700.563:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9306 comm="syz.4.988" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f24539 code=0x0 [ 359.000588][ C0] vkms_vblank_simulate: vblank timer overrun [ 359.090094][ T30] audit: type=1326 audit(1746800700.593:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9307 comm="syz.5.989" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fe8539 code=0x0 [ 359.182541][ T9316] netlink: 4 bytes leftover after parsing attributes in process `syz.4.992'. [ 359.266108][ T24] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 359.420431][ T24] usb 1-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 359.489396][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.510192][ T24] usb 1-1: Product: syz [ 359.514430][ T24] usb 1-1: Manufacturer: syz [ 359.534942][ T24] usb 1-1: SerialNumber: syz [ 359.552325][ T24] usb 1-1: config 0 descriptor?? [ 359.612025][ T9322] program syz.3.994 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 359.752763][ T9325] vxcan1: entered promiscuous mode [ 359.772217][ T24] int51x1 1-1:0.0: probe with driver int51x1 failed with error -22 [ 359.895867][ T9331] netlink: 16 bytes leftover after parsing attributes in process `syz.4.998'. [ 359.986386][ T24] usb 1-1: USB disconnect, device number 54 [ 360.187468][ T5836] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 360.336007][ T10] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 360.386229][ T5836] usb 6-1: device descriptor read/64, error -71 [ 360.476190][ T10] usb 4-1: device descriptor read/64, error -71 [ 360.691116][ T5836] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 360.717318][ T10] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 360.911950][ T5836] usb 6-1: device descriptor read/64, error -71 [ 360.913372][ T10] usb 4-1: device descriptor read/64, error -71 [ 361.065259][ T10] usb usb4-port1: attempt power cycle [ 361.233513][ T9347] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1001'. [ 361.266677][ T5836] usb usb6-port1: attempt power cycle [ 361.496438][ T10] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 361.538695][ T10] usb 4-1: device descriptor read/8, error -71 [ 361.616044][ T5836] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 361.656596][ T5836] usb 6-1: device descriptor read/8, error -71 [ 361.796078][ T10] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 361.906315][ T10] usb 4-1: device descriptor read/8, error -71 [ 361.956156][ T5836] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 362.009474][ T5836] usb 6-1: device descriptor read/8, error -71 [ 362.066005][ T5912] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 362.068700][ T10] usb usb4-port1: unable to enumerate USB device [ 362.131486][ T5836] usb usb6-port1: unable to enumerate USB device [ 362.300910][ T5912] usb 3-1: config 0 has no interfaces? [ 362.430325][ T5912] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 362.439808][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.516149][ T5912] usb 3-1: Product: syz [ 362.528279][ T5912] usb 3-1: Manufacturer: syz [ 362.532908][ T5912] usb 3-1: SerialNumber: syz [ 362.555837][ T5912] usb 3-1: config 0 descriptor?? [ 362.882569][ T9363] program syz.2.1003 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 362.896202][ T9363] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 362.978703][ T9370] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1008'. [ 363.396218][ T5912] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 363.576525][ T5912] usb 6-1: unable to get BOS descriptor or descriptor too short [ 363.600392][ T5912] usb 6-1: config 13 has an invalid interface number: 50 but max is 3 [ 363.610780][ T5912] usb 6-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 363.621407][ T5912] usb 6-1: config 13 has 1 interface, different from the descriptor's value: 4 [ 363.671409][ T5912] usb 6-1: config 13 has no interface number 0 [ 363.719634][ T5912] usb 6-1: config 13 interface 50 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 363.837545][ T5912] usb 6-1: config 13 interface 50 has no altsetting 0 [ 363.855297][ T5912] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=a9.e8 [ 363.865434][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.881753][ T5912] usb 6-1: Product: syz [ 363.899635][ T5912] usb 6-1: Manufacturer: syz [ 363.935989][ T5912] usb 6-1: SerialNumber: syz [ 364.007748][ T9388] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1014'. [ 364.056275][ T5836] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 364.230262][ T5912] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 364.250361][ T5836] usb 5-1: config 0 has an invalid interface number: 56 but max is 0 [ 364.259779][ T5836] usb 5-1: config 0 has no interface number 0 [ 364.286858][ T3501] usb 6-1: Failed to submit usb control message: -71 [ 364.300465][ T3501] usb 6-1: unable to send the bmi data to the device: -71 [ 364.316385][ T5836] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 364.334096][ T3501] usb 6-1: unable to get target info from device [ 364.343454][ T3501] usb 6-1: could not get target info (-71) [ 364.356230][ T3501] usb 6-1: could not probe fw (-71) [ 364.362205][ T5912] usb 6-1: USB disconnect, device number 43 [ 364.373015][ T5836] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.506403][ T5836] usb 5-1: Product: syz [ 364.530174][ T5836] usb 5-1: Manufacturer: syz [ 364.563138][ T5836] usb 5-1: SerialNumber: syz [ 364.599207][ T5836] usb 5-1: config 0 descriptor?? [ 364.706350][ T5836] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 364.740354][ T5836] pctv452e: pctv452e_power_ctrl: 1 [ 364.740354][ T5836] [ 364.769957][ T5836] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 364.769957][ T5836] [ 364.846061][ T5836] dvb-usb: bulk message failed: -22 (5/0) [ 364.903973][ T5836] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 364.905816][ T9386] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1012'. [ 364.938678][ T5836] dvb-usb: Technotrend TT Connect S2-3600 error while loading driver (-19) [ 365.071440][ T5926] usb 3-1: USB disconnect, device number 64 [ 365.097111][ T9386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.114585][ T9386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.319136][ T9408] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1020'. [ 366.585469][ T5890] usb 5-1: USB disconnect, device number 59 [ 366.838113][ T9424] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1023'. [ 366.859679][ T9420] [U] [ 366.874025][ T9420] [U] [ 366.897618][ T9420] [U] [ 366.900518][ T9420] [U] U [ 366.903321][ T9420] [U] [ 366.906057][ T9420] [U] [ 366.950809][ T9420] [U] [ 366.953625][ T9420] [U] [ 367.021929][ T9420] [U] D+W?ެ#ե]قIQ+1=Y{8LQAI~Z9MQ !D$6@BOJ FVڭݙ [ 367.080527][ T9420] [U] N/~BVKSY[$WJH.P0ŨV^IQPXS1T/~E]U7CH[@[ѳ_83ҘժF;Z WȯSN݀S<M5?}ѯI$5; [ 367.095183][ T9420] [U] [ 367.170206][ T9420] [U] [ 367.175260][ T9420] [U] M!] =| [ 367.311192][ T9420] [U] RB+ ^.˵TA+ZK MԨ‘VMɦ [ 367.334913][ T9420] [U] [ 367.337682][ T9420] [U] [ 367.351121][ T9420] [U] [ 367.384927][ T9432] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1026'. [ 367.385101][ T9419] [U] [ 367.790377][ T9432] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1026'. [ 368.366119][ T5912] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 368.516038][ T5912] usb 1-1: Using ep0 maxpacket: 8 [ 368.523252][ T5912] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 368.526092][ T5926] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 368.557306][ T5912] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.571243][ T5912] usb 1-1: config 0 descriptor?? [ 368.726784][ T5926] usb 4-1: Using ep0 maxpacket: 8 [ 368.755416][ T5926] usb 4-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 368.770798][ T5926] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 368.780070][ T5926] usb 4-1: config 1 has no interface number 1 [ 368.787072][ T5926] usb 4-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 368.796609][ T5926] usb 4-1: too many endpoints for config 1 interface 2 altsetting 255: 255, using maximum allowed: 30 [ 368.809069][ T5926] usb 4-1: config 1 interface 2 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 368.825238][ T5926] usb 4-1: config 1 interface 2 has no altsetting 0 [ 368.836718][ T5926] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 368.982268][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.984466][ T9460] IPVS: set_ctl: invalid protocol: 10 127.0.0.1:32769 [ 368.991157][ T5926] usb 4-1: Product: syz [ 369.002183][ T5926] usb 4-1: Manufacturer: syz [ 369.007344][ T5926] usb 4-1: SerialNumber: syz [ 369.238920][ T30] audit: type=1326 audit(1746800710.823:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.1031" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc5539 code=0x0 [ 369.369716][ T5926] usb 4-1: 0:8 : does not exist [ 369.414387][ T5926] usb 4-1: USB disconnect, device number 56 [ 369.490962][ T8605] udevd[8605]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 369.516152][ T5890] usb 5-1: new full-speed USB device number 60 using dummy_hcd [ 369.734927][ T9472] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1036'. [ 369.742605][ T5890] usb 5-1: config 1 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 369.758141][ T5890] usb 5-1: config 1 interface 0 has no altsetting 0 [ 369.852114][ T55] Bluetooth: hci5: ACL packet for unknown connection handle 200 [ 369.871343][ T5890] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 369.882602][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.921845][ T5890] usb 5-1: Product: syz [ 369.931993][ T5890] usb 5-1: Manufacturer: syz [ 369.937354][ T5890] usb 5-1: SerialNumber: syz [ 370.037779][ T9478] FAULT_INJECTION: forcing a failure. [ 370.037779][ T9478] name failslab, interval 1, probability 0, space 0, times 0 [ 370.050793][ T9478] CPU: 0 UID: 0 PID: 9478 Comm: syz.5.1038 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 370.050820][ T9478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 370.050832][ T9478] Call Trace: [ 370.050841][ T9478] [ 370.050852][ T9478] dump_stack_lvl+0x189/0x250 [ 370.050889][ T9478] ? __pfx_dump_stack_lvl+0x10/0x10 [ 370.050917][ T9478] ? __pfx__printk+0x10/0x10 [ 370.050942][ T9478] ? __pfx___might_resched+0x10/0x10 [ 370.050959][ T9478] ? fs_reclaim_acquire+0x7d/0x100 [ 370.050991][ T9478] should_fail_ex+0x414/0x560 [ 370.051015][ T9478] should_failslab+0xa8/0x100 [ 370.051043][ T9478] kmem_cache_alloc_noprof+0x73/0x3c0 [ 370.051065][ T9478] ? posix_lock_inode+0x232/0x3290 [ 370.051099][ T9478] posix_lock_inode+0x232/0x3290 [ 370.051133][ T9478] ? __pfx_aa_file_perm+0x10/0x10 [ 370.051168][ T9478] ? __pfx_posix_lock_inode+0x10/0x10 [ 370.051207][ T9478] fcntl_setlk+0xae2/0x1090 [ 370.051245][ T9478] ? __pfx_fcntl_setlk+0x10/0x10 [ 370.051279][ T9478] do_compat_fcntl64+0x590/0x720 [ 370.051298][ T9478] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 370.051328][ T9478] ? __pfx_do_compat_fcntl64+0x10/0x10 [ 370.051353][ T9478] ? fput+0xa0/0xd0 [ 370.051381][ T9478] ? ksys_write+0x1f0/0x250 [ 370.051409][ T9478] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 370.051441][ T9478] ? lockdep_hardirqs_on+0x9c/0x150 [ 370.051465][ T9478] __do_fast_syscall_32+0xb4/0x110 [ 370.051490][ T9478] ? lockdep_hardirqs_on+0x9c/0x150 [ 370.051515][ T9478] do_fast_syscall_32+0x34/0x80 [ 370.051539][ T9478] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 370.051562][ T9478] RIP: 0023:0xf7fe8539 [ 370.051578][ T9478] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 370.051596][ T9478] RSP: 002b:00000000f510655c EFLAGS: 00000206 ORIG_RAX: 0000000000000037 [ 370.051616][ T9478] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000006 [ 370.051629][ T9478] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 370.051640][ T9478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 370.051651][ T9478] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 370.051663][ T9478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 370.051690][ T9478] [ 370.472273][ T9463] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1033'. [ 370.752244][ T9480] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1039'. [ 371.603545][ T5912] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 371.639337][ T5912] asix 1-1:0.0: probe with driver asix failed with error -71 [ 371.690014][ T5912] usb 1-1: USB disconnect, device number 55 [ 371.791618][ T9491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.820172][ T9491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 372.026125][ T5836] usb 3-1: new full-speed USB device number 65 using dummy_hcd [ 372.180300][ T5890] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 60 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 372.236854][ T5890] usb 5-1: USB disconnect, device number 60 [ 372.260895][ T5890] usblp0: removed [ 372.348454][ T5836] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 372.350371][ T9499] tipc: Started in network mode [ 372.357967][ T5836] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.357993][ T5836] usb 3-1: Product: syz [ 372.358009][ T5836] usb 3-1: Manufacturer: syz [ 372.358023][ T5836] usb 3-1: SerialNumber: syz [ 372.390078][ T9499] tipc: Node identity fe800000000000000000000000000013, cluster identity 4711 [ 372.397052][ T5836] usb 3-1: config 0 descriptor?? [ 372.412808][ T9499] FAULT_INJECTION: forcing a failure. [ 372.412808][ T9499] name failslab, interval 1, probability 0, space 0, times 0 [ 372.435580][ T9499] CPU: 0 UID: 0 PID: 9499 Comm: syz.4.1045 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 372.435611][ T9499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 372.435624][ T9499] Call Trace: [ 372.435633][ T9499] [ 372.435641][ T9499] dump_stack_lvl+0x189/0x250 [ 372.435679][ T9499] ? __pfx_dump_stack_lvl+0x10/0x10 [ 372.435707][ T9499] ? __pfx__printk+0x10/0x10 [ 372.435733][ T9499] ? __pfx___might_resched+0x10/0x10 [ 372.435769][ T9499] should_fail_ex+0x414/0x560 [ 372.435796][ T9499] should_failslab+0xa8/0x100 [ 372.435823][ T9499] __kmalloc_noprof+0xcb/0x4f0 [ 372.435846][ T9499] ? sock_kmalloc+0xd6/0x160 [ 372.435877][ T9499] sock_kmalloc+0xd6/0x160 [ 372.435906][ T9499] __ipv6_sock_mc_join+0x439/0x7b0 [ 372.435953][ T9499] enable_mcast+0x1c3/0x2a0 [ 372.435981][ T9499] ? __pfx_enable_mcast+0x10/0x10 [ 372.436011][ T9499] ? tipc_udp_enable+0x945/0xb30 [ 372.436042][ T9499] tipc_udp_enable+0x95f/0xb30 [ 372.436084][ T9499] ? __pfx_tipc_udp_enable+0x10/0x10 [ 372.436108][ T9499] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 372.436175][ T9499] ? __pfx_tipc_udp_recv+0x10/0x10 [ 372.436222][ T9499] ? __tipc_nl_bearer_enable+0xab3/0x13f0 [ 372.436252][ T9499] __tipc_nl_bearer_enable+0xc1e/0x13f0 [ 372.436277][ T9499] ? __pfx___mutex_trylock_common+0x10/0x10 [ 372.436305][ T9499] ? __pfx___tipc_nl_bearer_enable+0x10/0x10 [ 372.436327][ T9499] ? trace_contention_end+0x39/0x120 [ 372.436360][ T9499] ? tipc_nl_bearer_enable+0x17/0x40 [ 372.436387][ T9499] ? __pfx___mutex_lock+0x10/0x10 [ 372.436418][ T9499] ? __nla_parse+0x40/0x60 [ 372.436444][ T9499] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 372.436471][ T9499] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 372.436504][ T9499] tipc_nl_bearer_enable+0x22/0x40 [ 372.436547][ T9499] genl_family_rcv_msg_doit+0x212/0x300 [ 372.436583][ T9499] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 372.436638][ T9499] genl_rcv_msg+0x60e/0x790 [ 372.436674][ T9499] ? __pfx_genl_rcv_msg+0x10/0x10 [ 372.436701][ T9499] ? __pfx_tipc_nl_bearer_enable+0x10/0x10 [ 372.436729][ T9499] ? ref_tracker_free+0x63a/0x7d0 [ 372.436747][ T9499] ? __copy_skb_header+0xa7/0x550 [ 372.436785][ T9499] netlink_rcv_skb+0x219/0x490 [ 372.436808][ T9499] ? __pfx_genl_rcv_msg+0x10/0x10 [ 372.436837][ T9499] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 372.436886][ T9499] ? down_read+0x1ad/0x2e0 [ 372.436913][ T9499] genl_rcv+0x28/0x40 [ 372.436937][ T9499] netlink_unicast+0x758/0x8d0 [ 372.436968][ T9499] netlink_sendmsg+0x805/0xb30 [ 372.437000][ T9499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.437025][ T9499] ? __import_iovec+0x5d4/0x7f0 [ 372.437048][ T9499] ? aa_sock_msg_perm+0x94/0x160 [ 372.437079][ T9499] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 372.437101][ T9499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.437125][ T9499] __sock_sendmsg+0x219/0x270 [ 372.437148][ T9499] ____sys_sendmsg+0x505/0x830 [ 372.437180][ T9499] ? __pfx_____sys_sendmsg+0x10/0x10 [ 372.437225][ T9499] ___sys_sendmsg+0x21f/0x2a0 [ 372.437254][ T9499] ? __pfx____sys_sendmsg+0x10/0x10 [ 372.437331][ T9499] ? __fget_files+0x2a/0x420 [ 372.437356][ T9499] ? __fget_files+0x3a0/0x420 [ 372.437392][ T9499] __sys_sendmsg+0x164/0x220 [ 372.437419][ T9499] ? __pfx___sys_sendmsg+0x10/0x10 [ 372.437441][ T9499] ? irqentry_exit+0x74/0x90 [ 372.437487][ T9499] __do_fast_syscall_32+0xb4/0x110 [ 372.437513][ T9499] ? lockdep_hardirqs_on+0x9c/0x150 [ 372.437540][ T9499] do_fast_syscall_32+0x34/0x80 [ 372.437564][ T9499] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 372.437587][ T9499] RIP: 0023:0xf7f24539 [ 372.437604][ T9499] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 372.437621][ T9499] RSP: 002b:00000000f504655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 372.437642][ T9499] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 372.437656][ T9499] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 372.437667][ T9499] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 372.437678][ T9499] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 372.437689][ T9499] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 372.437717][ T9499] [ 372.869612][ T5836] airspy 3-1:0.0: usb_control_msg() failed -71 request 09 [ 372.895043][ T9499] tipc: Enabling of bearer rejected, failed to enable media [ 372.917960][ T5836] airspy 3-1:0.0: Could not detect board [ 372.941728][ T5836] airspy 3-1:0.0: probe with driver airspy failed with error -71 [ 372.961293][ T5836] usb 3-1: USB disconnect, device number 65 [ 373.167406][ T9511] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1049'. [ 373.312881][ T9522] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1052'. [ 373.586107][ T975] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 373.759086][ T975] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 373.776000][ T24] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 373.785378][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 373.800121][ T975] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 373.810218][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.819408][ T975] usb 1-1: Product: syz [ 373.823815][ T975] usb 1-1: Manufacturer: syz [ 373.833978][ T975] usb 1-1: SerialNumber: syz [ 373.847886][ T975] usb 1-1: config 0 descriptor?? [ 373.927756][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 373.948831][ T24] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 373.967710][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.996142][ T24] usb 4-1: Product: syz [ 374.006334][ T24] usb 4-1: Manufacturer: syz [ 374.017934][ T24] usb 4-1: SerialNumber: syz [ 374.031411][ T24] usb 4-1: config 0 descriptor?? [ 374.047943][ T24] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 374.048054][ T9538] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1058'. [ 374.199829][ T9520] cgroup: fork rejected by pids controller in /syz0 [ 374.660840][ T24] gspca_ov534_9: reg_w failed -71 [ 374.963397][ T55] Bluetooth: hci5: ISO packet too small [ 374.976607][ T24] gspca_ov534_9: Unknown sensor 0000 [ 374.976704][ T24] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 375.076525][ T24] usb 4-1: USB disconnect, device number 57 [ 375.288830][ T55] Bluetooth: hci5: ISO packet too small [ 375.719524][T11353] netlink: 'syz.5.1067': attribute type 10 has an invalid length. [ 375.731534][T11353] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1067'. [ 375.756206][ T5912] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 375.787909][T11353] batman_adv: batadv0: Adding interface: vlan1 [ 375.801269][T11353] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 375.826470][ C1] vkms_vblank_simulate: vblank timer overrun [ 375.841432][T11353] batman_adv: batadv0: Interface activated: vlan1 [ 375.926147][ T5912] usb 3-1: Using ep0 maxpacket: 16 [ 375.938278][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 375.966050][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 375.993156][ T5912] usb 3-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 376.033648][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.059613][ T5912] usb 3-1: config 0 descriptor?? [ 376.353537][ T975] powermate: unknown product id 0240 [ 376.385163][ T975] input: Griffin SoundKnob as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input29 [ 376.437025][ C1] powermate: config urb returned -71 [ 376.442895][ C1] powermate: config urb returned -71 [ 376.448600][ C1] powermate: config urb returned -71 [ 376.455266][ C1] powermate: config urb returned -71 [ 376.476323][ T975] usb 1-1: USB disconnect, device number 56 [ 376.482355][ C1] powermate 1-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 376.511483][T10815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.520705][T10815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.551923][ T5912] usbhid 3-1:0.0: can't add hid device: -71 [ 376.559231][ T5912] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 376.601098][ T5912] usb 3-1: USB disconnect, device number 66 [ 377.178128][T12320] xt_TCPMSS: Only works on TCP SYN packets [ 377.775185][T12338] tipc: Enabling of bearer rejected, failed to enable media [ 377.819932][ T5890] usb 6-1: new low-speed USB device number 44 using dummy_hcd [ 377.905739][T12342] binder: 12339:12342 ioctl c0306201 80000080 returned -14 [ 377.976274][ T5890] usb 6-1: Invalid ep0 maxpacket: 16 [ 378.106033][ T5890] usb 6-1: new low-speed USB device number 45 using dummy_hcd [ 378.258897][ T5890] usb 6-1: Invalid ep0 maxpacket: 16 [ 378.276994][ T5890] usb usb6-port1: attempt power cycle [ 378.364267][ T55] Bluetooth: hci0: ISO packet too small [ 378.655428][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.663207][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.696404][ T5890] usb 6-1: new low-speed USB device number 46 using dummy_hcd [ 378.776178][ T5890] usb 6-1: Invalid ep0 maxpacket: 16 [ 378.946661][ T10] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 378.954326][ T5890] usb 6-1: new low-speed USB device number 47 using dummy_hcd [ 378.987535][ T5890] usb 6-1: Invalid ep0 maxpacket: 16 [ 378.994231][ T5890] usb usb6-port1: unable to enumerate USB device [ 379.117026][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 379.123974][ T10] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 379.140187][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.168163][ T10] usb 3-1: config 0 descriptor?? [ 379.486055][T12355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.494764][ T5890] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 379.547071][T12355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 379.601454][ T10] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 379.636254][ T10] asix 3-1:0.0: probe with driver asix failed with error -32 [ 379.681208][ T5890] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 379.725148][ T5890] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 379.742369][ T5890] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 379.760114][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.775129][ T5890] usb 1-1: Product: syz [ 379.780470][ T5890] usb 1-1: Manufacturer: syz [ 379.785305][ T5890] usb 1-1: SerialNumber: syz [ 379.821639][ T5890] usb 1-1: selecting invalid altsetting 1 [ 380.090616][ T5890] cdc_ncm 1-1:1.0: bind() failure [ 380.210481][ T5890] usb 1-1: USB disconnect, device number 57 [ 380.706824][T12380] sctp: [Deprecated]: syz.4.1094 (pid 12380) Use of struct sctp_assoc_value in delayed_ack socket option. [ 380.706824][T12380] Use struct sctp_sack_info instead [ 381.016859][T12375] block device autoloading is deprecated and will be removed. [ 381.032873][T12375] syz.5.1093: attempt to access beyond end of device [ 381.032873][T12375] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 381.226008][ T975] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 381.256629][T12390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1096'. [ 381.458780][ T975] usb 1-1: Using ep0 maxpacket: 8 [ 381.484502][ T975] usb 1-1: config 0 has no interfaces? [ 381.500052][ T975] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 381.570258][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.594662][ T975] usb 1-1: config 0 descriptor?? [ 381.776558][T12393] fuse: Unknown parameter 'f' [ 381.789375][ T975] usb 3-1: USB disconnect, device number 67 [ 381.840009][T12384] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1095'. [ 381.947422][T12385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 381.982442][T12378] syz.4.1094: attempt to access beyond end of device [ 381.982442][T12378] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 381.997532][T12385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.007638][T12385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 382.018991][T12385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.029020][T12385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 382.039657][T12385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.049553][T12385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 382.068605][T12385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.081309][T12385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 382.093900][T12385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 382.113317][T12385] batadv_slave_0: entered promiscuous mode [ 382.124912][T12385] batadv_slave_0: left promiscuous mode [ 382.136030][ T5912] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 382.235470][ T1207] usb 1-1: USB disconnect, device number 58 [ 382.288190][ T5912] usb 6-1: unable to get BOS descriptor or descriptor too short [ 382.341952][ T5912] usb 6-1: config 129 has an invalid interface number: 135 but max is 0 [ 382.351550][ T5912] usb 6-1: config 129 has an invalid interface number: 5 but max is 0 [ 382.364036][ T5912] usb 6-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 382.400601][ T5912] usb 6-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 382.430809][ T5912] usb 6-1: config 129 has no interface number 0 [ 382.458336][ T5912] usb 6-1: config 129 has no interface number 1 [ 382.501605][ T5912] usb 6-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 382.558099][T12405] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1102'. [ 382.581862][ T5912] usb 6-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 382.625769][ T5912] usb 6-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 382.685847][ T5912] usb 6-1: config 129 interface 135 has no altsetting 0 [ 382.710820][ T5912] usb 6-1: config 129 interface 5 has no altsetting 0 [ 382.733460][ T5912] usb 6-1: string descriptor 0 read error: -22 [ 382.745153][ T5912] usb 6-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.62 [ 382.796792][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.880009][ T5912] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 382.909263][ T5912] usb 6-1: MIDIStreaming interface descriptor not found [ 383.331217][T12418] usb usb8: usbfs: process 12418 (syz.2.1106) did not claim interface 0 before use [ 383.633936][ T1207] usb 6-1: USB disconnect, device number 48 [ 383.706088][ T975] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 383.788886][T12425] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1108'. [ 383.890659][ T975] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 383.904693][ T975] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 383.966679][ T975] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 383.990123][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.031361][ T975] usb 1-1: Product: syz [ 384.056207][ T975] usb 1-1: Manufacturer: syz [ 384.060933][ T975] usb 1-1: SerialNumber: syz [ 384.083286][ T975] usb 1-1: selecting invalid altsetting 1 [ 384.350574][ T975] cdc_ncm 1-1:1.0: bind() failure [ 384.381384][ T975] usb 1-1: USB disconnect, device number 59 [ 384.439685][T12447] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1117'. [ 384.462921][ T5912] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 384.533054][T12449] usb usb8: usbfs: process 12449 (syz.3.1118) did not claim interface 0 before use [ 384.655092][T12451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1119'. [ 384.666476][ T5912] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 384.699986][ T5912] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 384.716490][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.725584][ T5912] usb 6-1: Product: syz [ 384.737112][ T5912] usb 6-1: Manufacturer: syz [ 384.741806][ T5912] usb 6-1: SerialNumber: syz [ 384.973999][ T5912] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 49 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 384.997754][ T1207] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 385.166493][ T10] usb 6-1: USB disconnect, device number 49 [ 385.174018][T12457] xt_TPROXY: Can be used only with -p tcp or -p udp [ 385.183704][ T1207] usb 4-1: Using ep0 maxpacket: 32 [ 385.210015][ T1207] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 385.238139][ T1207] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 385.247799][ T1207] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 385.257930][ T1207] usb 4-1: Product: syz [ 385.262536][ T1207] usb 4-1: Manufacturer: syz [ 385.269375][ T1207] usb 4-1: SerialNumber: syz [ 385.285136][ T1207] usb 4-1: config 0 descriptor?? [ 385.299884][T12453] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 385.312287][ T1207] hub 4-1:0.0: bad descriptor, ignoring hub [ 385.329890][ T1207] hub 4-1:0.0: probe with driver hub failed with error -5 [ 385.400002][T12439] usblp0: removed [ 385.666546][ T1207] usb 4-1: USB disconnect, device number 58 [ 386.512051][T12479] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1128'. [ 386.680168][ T1207] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 386.805352][T12485] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1132'. [ 386.858393][ T1207] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 386.871164][ T1207] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 386.902874][ T1207] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 386.922485][ T1207] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 386.937031][ T1207] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 386.954699][ T1207] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 386.964008][ T1207] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 386.980685][ T1207] usb 3-1: Product: syz [ 386.986035][ T1207] usb 3-1: Manufacturer: syz [ 387.008653][ T1207] cdc_wdm 3-1:1.0: skipping garbage [ 387.025015][ T1207] cdc_wdm 3-1:1.0: skipping garbage [ 387.045464][ T1207] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 387.052061][ T1207] cdc_wdm 3-1:1.0: Unknown control protocol [ 387.136255][ T10] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 387.312758][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 387.326208][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 387.378894][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 387.400704][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.415461][ T10] usb 1-1: Product: syz [ 387.447436][ T10] usb 1-1: Manufacturer: syz [ 387.452241][ T55] Bluetooth: hci5: ISO packet too small [ 387.458068][ T10] usb 1-1: SerialNumber: syz [ 387.482430][ T10] usb 1-1: selecting invalid altsetting 1 [ 387.742820][ T10] cdc_ncm 1-1:1.0: bind() failure [ 387.765114][T12502] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1136'. [ 387.789004][ T10] usb 1-1: USB disconnect, device number 60 [ 387.876090][ T1207] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 388.017517][ T1207] usb 4-1: device descriptor read/64, error -71 [ 388.276343][ T1207] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 388.406142][T12510] netlink: 'syz.0.1138': attribute type 11 has an invalid length. [ 388.426084][ T1207] usb 4-1: device descriptor read/64, error -71 [ 388.536711][ T1207] usb usb4-port1: attempt power cycle [ 388.767385][ T24] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 388.894377][ T1207] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 388.916990][ T1207] usb 4-1: device descriptor read/8, error -71 [ 388.926054][ T24] usb 1-1: device descriptor read/64, error -71 [ 389.095312][T12520] xt_TCPMSS: Only works on TCP SYN packets [ 389.166728][ T1207] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 389.168439][ T24] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 389.187613][ T1207] usb 4-1: device descriptor read/8, error -71 [ 389.309313][ T1207] usb usb4-port1: unable to enumerate USB device [ 389.316096][ T24] usb 1-1: device descriptor read/64, error -71 [ 389.344674][ T975] usb 3-1: USB disconnect, device number 68 [ 389.439280][ T24] usb usb1-port1: attempt power cycle [ 389.556862][T12526] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1145'. [ 389.806069][ T24] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 389.836786][ T24] usb 1-1: device descriptor read/8, error -71 [ 390.116574][ T24] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 390.149127][ T24] usb 1-1: device descriptor read/8, error -71 [ 390.296712][ T24] usb usb1-port1: unable to enumerate USB device [ 390.408809][ T1207] IPVS: starting estimator thread 0... [ 390.497095][T12540] IPVS: using max 33 ests per chain, 79200 per kthread [ 390.502166][T12542] tc_dump_action: action bad kind [ 390.616061][ T10] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 390.758378][T12551] FAULT_INJECTION: forcing a failure. [ 390.758378][T12551] name failslab, interval 1, probability 0, space 0, times 0 [ 390.773335][T12551] CPU: 0 UID: 0 PID: 12551 Comm: syz.2.1154 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 390.773367][T12551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 390.773380][T12551] Call Trace: [ 390.773389][T12551] [ 390.773398][T12551] dump_stack_lvl+0x189/0x250 [ 390.773435][T12551] ? __pfx_dump_stack_lvl+0x10/0x10 [ 390.773464][T12551] ? __pfx__printk+0x10/0x10 [ 390.773484][T12551] ? kasan_save_track+0x4f/0x80 [ 390.773504][T12551] ? kasan_save_free_info+0x46/0x50 [ 390.773538][T12551] ? __kasan_slab_free+0x62/0x70 [ 390.773559][T12551] ? kmem_cache_free+0x192/0x3f0 [ 390.773582][T12551] ? pfkey_sendmsg+0x48a/0x1090 [ 390.773599][T12551] ? __sock_sendmsg+0x219/0x270 [ 390.773615][T12551] ? ____sys_sendmsg+0x505/0x830 [ 390.773637][T12551] ? ___sys_sendmsg+0x21f/0x2a0 [ 390.773660][T12551] ? __sys_sendmsg+0x164/0x220 [ 390.773687][T12551] should_fail_ex+0x414/0x560 [ 390.773711][T12551] should_failslab+0xa8/0x100 [ 390.773738][T12551] kmem_cache_alloc_noprof+0x73/0x3c0 [ 390.773761][T12551] ? xfrm_state_alloc+0x24/0x2f0 [ 390.773791][T12551] xfrm_state_alloc+0x24/0x2f0 [ 390.773819][T12551] pfkey_add+0x6e4/0x2e00 [ 390.773856][T12551] ? __pfx_pfkey_add+0x10/0x10 [ 390.773872][T12551] ? kmem_cache_free+0x192/0x3f0 [ 390.773910][T12551] pfkey_sendmsg+0xbfb/0x1090 [ 390.773944][T12551] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 390.773986][T12551] ? __asan_memset+0x22/0x50 [ 390.774004][T12551] ? __import_iovec+0x5d4/0x7f0 [ 390.774028][T12551] ? aa_sock_msg_perm+0x94/0x160 [ 390.774053][T12551] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 390.774075][T12551] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 390.774094][T12551] __sock_sendmsg+0x219/0x270 [ 390.774115][T12551] ____sys_sendmsg+0x505/0x830 [ 390.774147][T12551] ? __pfx_____sys_sendmsg+0x10/0x10 [ 390.774190][T12551] ___sys_sendmsg+0x21f/0x2a0 [ 390.774218][T12551] ? __pfx____sys_sendmsg+0x10/0x10 [ 390.774280][T12551] ? __fget_files+0x2a/0x420 [ 390.774305][T12551] ? __fget_files+0x3a0/0x420 [ 390.774341][T12551] __sys_sendmsg+0x164/0x220 [ 390.774369][T12551] ? __pfx___sys_sendmsg+0x10/0x10 [ 390.774408][T12551] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 390.774434][T12551] ? lockdep_hardirqs_on+0x9c/0x150 [ 390.774459][T12551] __do_fast_syscall_32+0xb4/0x110 [ 390.774485][T12551] ? lockdep_hardirqs_on+0x9c/0x150 [ 390.774511][T12551] do_fast_syscall_32+0x34/0x80 [ 390.774542][T12551] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 390.774566][T12551] RIP: 0023:0xf710e539 [ 390.774583][T12551] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 390.774600][T12551] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 390.774620][T12551] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 390.774634][T12551] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 390.774646][T12551] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 390.774657][T12551] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 390.774669][T12551] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 390.774697][T12551] [ 391.088169][ C0] vkms_vblank_simulate: vblank timer overrun [ 391.175462][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.187692][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 391.204004][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 391.214185][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.225073][ T10] usb 6-1: Product: syz [ 391.229356][ T10] usb 6-1: Manufacturer: syz [ 391.233990][ T10] usb 6-1: SerialNumber: syz [ 391.254550][ T10] usb 6-1: selecting invalid altsetting 1 [ 391.404900][T12556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1156'. [ 391.524395][ T10] cdc_ncm 6-1:1.0: bind() failure [ 391.687051][ T10] usb 6-1: USB disconnect, device number 50 [ 392.025135][ T24] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 392.195316][T12565] FAULT_INJECTION: forcing a failure. [ 392.195316][T12565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.244296][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 392.256418][T12565] CPU: 0 UID: 0 PID: 12565 Comm: syz.3.1159 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 392.256447][T12565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 392.256460][T12565] Call Trace: [ 392.256469][T12565] [ 392.256478][T12565] dump_stack_lvl+0x189/0x250 [ 392.256511][T12565] ? __lock_acquire+0xaac/0xd20 [ 392.256541][T12565] ? __pfx_dump_stack_lvl+0x10/0x10 [ 392.256569][T12565] ? __pfx__printk+0x10/0x10 [ 392.256588][T12565] ? __might_fault+0xb0/0x130 [ 392.256631][T12565] should_fail_ex+0x414/0x560 [ 392.256652][T12565] _copy_from_user+0x2d/0xb0 [ 392.256679][T12565] video_usercopy+0x354/0x14f0 [ 392.256709][T12565] ? __pfx___video_do_ioctl+0x10/0x10 [ 392.256731][T12565] ? __pfx_video_usercopy+0x10/0x10 [ 392.256765][T12565] ? __fget_files+0x2a/0x420 [ 392.256789][T12565] v4l2_ioctl+0x18a/0x1e0 [ 392.256813][T12565] v4l2_compat_ioctl32+0x1d4/0x260 [ 392.256832][T12565] __ia32_compat_sys_ioctl+0x551/0x840 [ 392.256852][T12565] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 392.256869][T12565] ? __fget_files+0x3a0/0x420 [ 392.256893][T12565] ? fput+0xa0/0xd0 [ 392.256916][T12565] ? ksys_write+0x1f0/0x250 [ 392.256936][T12565] ? arch_syscall_is_vdso_sigreturn+0x175/0x1a0 [ 392.256956][T12565] ? syscall_user_dispatch+0x4f/0x90 [ 392.256982][T12565] __do_fast_syscall_32+0xb4/0x110 [ 392.257004][T12565] ? lockdep_hardirqs_on+0x9c/0x150 [ 392.257025][T12565] do_fast_syscall_32+0x34/0x80 [ 392.257045][T12565] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 392.257064][T12565] RIP: 0023:0xf7fc5539 [ 392.257078][T12565] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 392.257092][T12565] RSP: 002b:00000000f50e655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 392.257109][T12565] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0845657 [ 392.257121][T12565] RDX: 0000000080000580 RSI: 0000000000000000 RDI: 0000000000000000 [ 392.257131][T12565] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 392.257140][T12565] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 392.257150][T12565] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 392.257171][T12565] [ 392.272124][ T24] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 392.506352][ T24] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x2 has invalid wMaxPacketSize 0 [ 392.531668][ T24] usb 1-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 392.544999][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 392.551762][ T24] usb 1-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 392.561291][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.595469][ T24] usb 1-1: config 0 descriptor?? [ 393.240975][ T55] Bluetooth: hci5: ISO packet too small [ 393.245697][ T24] hid-thrustmaster 0003:044F:B65D.0015: unknown main item tag 0x0 [ 393.355828][ T24] hid-thrustmaster 0003:044F:B65D.0015: unknown main item tag 0x0 [ 393.435983][ T24] hid-thrustmaster 0003:044F:B65D.0015: collection stack underflow [ 393.443983][ T24] hid-thrustmaster 0003:044F:B65D.0015: item 0 0 0 12 parsing failed [ 393.496814][ T24] hid-thrustmaster 0003:044F:B65D.0015: parse failed with error -22 [ 393.513601][T12535] syz.4.1149 (12535): drop_caches: 2 [ 393.535534][ T24] hid-thrustmaster 0003:044F:B65D.0015: probe with driver hid-thrustmaster failed with error -22 [ 393.540453][T12574] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1161'. [ 393.589623][ T24] usb 1-1: USB disconnect, device number 65 [ 393.616092][T12574] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1161'. [ 393.651408][T12576] fuse: Bad value for 'user_id' [ 393.653925][T12571] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1161'. [ 393.676328][T12576] fuse: Bad value for 'user_id' [ 393.788725][T12574] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 394.011473][ T10] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 394.211854][ T10] usb 6-1: config 0 has no interfaces? [ 394.254187][ T10] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 394.273676][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.324588][ T10] usb 6-1: Product: syz [ 394.346407][ T10] usb 6-1: Manufacturer: syz [ 394.395647][ T10] usb 6-1: SerialNumber: syz [ 394.417170][ T10] usb 6-1: config 0 descriptor?? [ 394.486113][ T975] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 394.728761][T12578] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 394.766005][ T975] usb 1-1: Using ep0 maxpacket: 8 [ 394.786629][ T975] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 394.815569][ T975] usb 1-1: config 0 has no interfaces? [ 394.994609][ T975] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 395.026278][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.045369][ T975] usb 1-1: config 0 descriptor?? [ 395.313475][T12603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1169'. [ 395.329845][T12585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.358063][T12585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 395.826126][ T24] usb 3-1: new full-speed USB device number 69 using dummy_hcd [ 395.902334][T12608] FAULT_INJECTION: forcing a failure. [ 395.902334][T12608] name failslab, interval 1, probability 0, space 0, times 0 [ 395.915463][T12608] CPU: 1 UID: 0 PID: 12608 Comm: syz.3.1171 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 395.915487][T12608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 395.915496][T12608] Call Trace: [ 395.915503][T12608] [ 395.915510][T12608] dump_stack_lvl+0x189/0x250 [ 395.915542][T12608] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.915562][T12608] ? __pfx__printk+0x10/0x10 [ 395.915580][T12608] ? __pfx___might_resched+0x10/0x10 [ 395.915594][T12608] ? fs_reclaim_acquire+0x7d/0x100 [ 395.915619][T12608] should_fail_ex+0x414/0x560 [ 395.915636][T12608] should_failslab+0xa8/0x100 [ 395.915657][T12608] kmem_cache_alloc_noprof+0x73/0x3c0 [ 395.915675][T12608] ? skb_clone+0x212/0x3a0 [ 395.915697][T12608] skb_clone+0x212/0x3a0 [ 395.915715][T12608] ? nfnetlink_rcv+0x496/0x2530 [ 395.915737][T12608] nfnetlink_rcv+0x4c4/0x2530 [ 395.915757][T12608] ? __dev_queue_xmit+0x27e/0x3a70 [ 395.915778][T12608] ? __dev_queue_xmit+0x27e/0x3a70 [ 395.915806][T12608] ? __dev_queue_xmit+0x27e/0x3a70 [ 395.915826][T12608] ? do_fast_syscall_32+0x34/0x80 [ 395.915847][T12608] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 395.915880][T12608] ? ref_tracker_free+0x63a/0x7d0 [ 395.915894][T12608] ? __copy_skb_header+0xa7/0x550 [ 395.915924][T12608] ? __pfx_ref_tracker_free+0x10/0x10 [ 395.915961][T12608] ? skb_clone+0x246/0x3a0 [ 395.915989][T12608] ? __netlink_deliver_tap+0x807/0x850 [ 395.916011][T12608] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.916037][T12608] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.916058][T12608] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.916085][T12608] netlink_unicast+0x758/0x8d0 [ 395.916114][T12608] netlink_sendmsg+0x805/0xb30 [ 395.916145][T12608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.916170][T12608] ? __import_iovec+0x5d4/0x7f0 [ 395.916195][T12608] ? aa_sock_msg_perm+0x94/0x160 [ 395.916218][T12608] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 395.916240][T12608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.916272][T12608] __sock_sendmsg+0x219/0x270 [ 395.916294][T12608] ____sys_sendmsg+0x505/0x830 [ 395.916325][T12608] ? __pfx_____sys_sendmsg+0x10/0x10 [ 395.916366][T12608] ___sys_sendmsg+0x21f/0x2a0 [ 395.916393][T12608] ? __pfx____sys_sendmsg+0x10/0x10 [ 395.916454][T12608] ? __fget_files+0x2a/0x420 [ 395.916477][T12608] ? __fget_files+0x3a0/0x420 [ 395.916511][T12608] __sys_sendmsg+0x164/0x220 [ 395.916538][T12608] ? __pfx___sys_sendmsg+0x10/0x10 [ 395.916577][T12608] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 395.916602][T12608] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.916626][T12608] __do_fast_syscall_32+0xb4/0x110 [ 395.916652][T12608] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.916677][T12608] do_fast_syscall_32+0x34/0x80 [ 395.916701][T12608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 395.916725][T12608] RIP: 0023:0xf7fc5539 [ 395.916741][T12608] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 395.916757][T12608] RSP: 002b:00000000f50e655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 395.916778][T12608] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080007040 [ 395.916791][T12608] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 395.916803][T12608] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 395.916814][T12608] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 395.916825][T12608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 395.916852][T12608] [ 396.301458][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 396.311983][ T24] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 396.330728][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 396.341839][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 396.349931][ T24] usb 3-1: Product: syz [ 396.354306][ T24] usb 3-1: Manufacturer: syz [ 396.359080][ T24] usb 3-1: SerialNumber: syz [ 396.414080][ T24] usb 3-1: selecting invalid altsetting 1 [ 396.672546][ T24] cdc_ncm 3-1:1.0: bind() failure [ 396.701703][ T1207] usb 6-1: USB disconnect, device number 51 [ 396.730563][ T24] usb 3-1: USB disconnect, device number 69 [ 396.786680][ T10] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 396.947997][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 396.959768][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 396.970714][ T10] usb 4-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 396.994335][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.016357][ T10] usb 4-1: config 0 descriptor?? [ 397.101888][ T975] usb 1-1: string descriptor 0 read error: -71 [ 397.124197][ T975] usb 1-1: USB disconnect, device number 66 [ 397.441807][ T10] hid-led 0003:04D8:F372.0016: hidraw0: USB HID v0.00 Device [HID 04d8:f372] on usb-dummy_hcd.3-1/input0 [ 397.546183][ T975] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 397.611416][ T10] hid-led 0003:04D8:F372.0016: Greynut Luxafor initialized [ 397.642439][ T10] usb 4-1: USB disconnect, device number 63 [ 397.661536][ T13] leds luxafor0:blue:led5: Setting an LED's brightness failed (-38) [ 397.684003][ T13] leds luxafor0:green:led5: Setting an LED's brightness failed (-38) [ 397.703643][ T13] leds luxafor0:red:led5: Setting an LED's brightness failed (-38) [ 397.725866][ T13] leds luxafor0:blue:led4: Setting an LED's brightness failed (-38) [ 397.744554][ T975] usb 1-1: config 0 has no interfaces? [ 397.750696][ T975] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 397.762596][ T3482] leds luxafor0:green:led4: Setting an LED's brightness failed (-38) [ 397.771160][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.793245][ T3482] leds luxafor0:red:led4: Setting an LED's brightness failed (-38) [ 397.795070][ T975] usb 1-1: config 0 descriptor?? [ 397.821198][ T1144] leds luxafor0:blue:led3: Setting an LED's brightness failed (-38) [ 397.843726][ T13] leds luxafor0:green:led3: Setting an LED's brightness failed (-38) [ 397.862373][ T13] leds luxafor0:red:led3: Setting an LED's brightness failed (-38) [ 397.873883][ T3415] leds luxafor0:blue:led2: Setting an LED's brightness failed (-38) [ 397.892728][ T3415] leds luxafor0:green:led2: Setting an LED's brightness failed (-38) [ 397.922640][ T3482] leds luxafor0:red:led2: Setting an LED's brightness failed (-38) [ 397.948965][ T3501] leds luxafor0:blue:led1: Setting an LED's brightness failed (-38) [ 397.965310][ T3501] leds luxafor0:green:led1: Setting an LED's brightness failed (-38) [ 397.975497][ T3501] leds luxafor0:red:led1: Setting an LED's brightness failed (-38) [ 397.990055][ T3501] leds luxafor0:blue:led0: Setting an LED's brightness failed (-38) [ 398.000381][ T3415] leds luxafor0:green:led0: Setting an LED's brightness failed (-38) [ 398.010364][ T3415] leds luxafor0:red:led0: Setting an LED's brightness failed (-38) [ 398.042381][T12625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.059330][T12625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.173925][T12637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.184263][T12637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.209955][ T5926] usb 1-1: USB disconnect, device number 67 [ 398.316738][T12640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1181'. [ 398.332861][T12638] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1180'. [ 398.956027][ T5912] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 399.118064][ T5912] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 399.143882][ T5912] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 399.155046][ T5912] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 399.181413][ T5912] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 399.194531][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.203913][ T5912] usb 1-1: Product: syz [ 399.212065][ T5912] usb 1-1: Manufacturer: syz [ 399.218426][ T5912] usb 1-1: SerialNumber: syz [ 399.242732][ T5912] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 399.253078][ T5912] cdc_ncm 1-1:1.0: bind() failure [ 399.256161][ T5926] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 399.426557][ T5926] usb 4-1: Using ep0 maxpacket: 32 [ 399.433736][ T5926] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 399.442110][ T5926] usb 4-1: config 0 has no interface number 0 [ 399.448650][ T5926] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 399.462095][ T5926] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 399.475226][ T5926] usb 4-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 399.484695][ T5926] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.497072][ T5926] usb 4-1: config 0 descriptor?? [ 399.816061][ T975] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 399.956255][ T975] usb 3-1: device descriptor read/64, error -71 [ 400.048292][ T1207] usb 1-1: USB disconnect, device number 68 [ 400.196205][ T975] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 400.327933][ T975] usb 3-1: device descriptor read/64, error -71 [ 400.346325][ T10] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 400.440073][ T975] usb usb3-port1: attempt power cycle [ 400.498616][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 400.510617][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.522333][ T10] usb 6-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 400.534141][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.545196][ T10] usb 6-1: config 0 descriptor?? [ 400.786117][ T975] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 400.816802][ T975] usb 3-1: device descriptor read/8, error -71 [ 400.945564][T12659] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1188'. [ 401.027786][ T10] kye 0003:0458:5010.0017: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 401.065467][ T10] kye 0003:0458:5010.0017: unknown main item tag 0x0 [ 401.076153][ T975] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 401.086136][ T10] kye 0003:0458:5010.0017: unknown main item tag 0x0 [ 401.093216][ T10] kye 0003:0458:5010.0017: unknown main item tag 0x0 [ 401.110409][ T975] usb 3-1: device descriptor read/8, error -71 [ 401.116243][ T10] kye 0003:0458:5010.0017: unknown main item tag 0x0 [ 401.131050][ T10] kye 0003:0458:5010.0017: unknown main item tag 0x0 [ 401.149973][ T10] kye 0003:0458:5010.0017: hidraw0: USB HID v0.00 Device [HID 0458:5010] on usb-dummy_hcd.5-1/input0 [ 401.176352][ T10] kye 0003:0458:5010.0017: tablet-enabling feature report not found [ 401.195355][ T10] kye 0003:0458:5010.0017: tablet enabling failed [ 401.226457][ T975] usb usb3-port1: unable to enumerate USB device [ 401.526100][ T975] usb 1-1: new full-speed USB device number 69 using dummy_hcd [ 401.698767][ T975] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 401.709307][ T975] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 401.731589][ T975] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 401.741043][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.749210][ T975] usb 1-1: Product: syz [ 401.753581][ T975] usb 1-1: Manufacturer: syz [ 401.758424][ T975] usb 1-1: SerialNumber: syz [ 401.779765][ T975] usb 1-1: selecting invalid altsetting 1 [ 402.051006][ T975] cdc_ncm 1-1:1.0: bind() failure [ 402.170984][ T975] usb 1-1: USB disconnect, device number 69 [ 402.268749][ T5926] usbhid 4-1:0.1: can't add hid device: -71 [ 402.283934][ T5926] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 402.302292][ T5926] usb 4-1: USB disconnect, device number 64 [ 402.707849][T12678] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1193'. [ 402.734764][T12676] syz.3.1192: attempt to access beyond end of device [ 402.734764][T12676] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 402.782410][T12679] fuse: Unknown parameter 'ft' [ 402.806187][T12676] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 402.812758][T12676] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 402.848035][T12676] vhci_hcd vhci_hcd.0: Device attached [ 402.894073][ T55] Bluetooth: hci3: ISO packet too small [ 402.913789][T12682] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 402.935726][ T3482] vhci_hcd: stop threads [ 402.940561][ T3482] vhci_hcd: release socket [ 402.948543][ T3482] vhci_hcd: disconnect device [ 403.132003][T12694] netlink: 'syz.0.1198': attribute type 10 has an invalid length. [ 403.173518][T12694] syz_tun: entered promiscuous mode [ 403.195602][T12694] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 403.212469][ T10] usb 6-1: USB disconnect, device number 52 [ 403.547082][ T5926] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 403.787353][ T5926] usb 3-1: device descriptor read/64, error -71 [ 404.016439][ T10] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 404.246789][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN PTI [ 404.258742][ C0] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 404.267202][ C0] CPU: 0 UID: 0 PID: 12703 Comm: syz.0.1200 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 404.279264][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 404.289323][ C0] RIP: 0010:find_match+0xa3/0xc90 [ 404.294382][ C0] Code: 00 00 00 00 00 fc ff df 42 80 7c 25 00 00 74 08 48 89 df e8 2f c8 12 f8 48 89 d8 bb c0 00 00 00 48 03 18 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 0e c8 12 f8 48 8b 1b e8 76 11 47 [ 404.314009][ C0] RSP: 0018:ffffc900000067b0 EFLAGS: 00010206 [ 404.320082][ C0] RAX: 0000000000000018 RBX: 00000000000000c0 RCX: 0000000000000100 [ 404.328053][ C0] RDX: ffff8880310e8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 404.336045][ C0] RBP: 1ffff1100510ff84 R08: ffffc90000006b40 R09: ffffc90000006b50 [ 404.344028][ C0] R10: ffffc900000069a0 R11: ffffffff8a0efac0 R12: dffffc0000000000 [ 404.352002][ C0] R13: 0000000000000002 R14: 1ffff1100510ff86 R15: ffff88802887fc37 [ 404.359972][ C0] FS: 0000000000000000(0000) GS:ffff8881260cc000(0063) knlGS:00000000f5045b40 [ 404.368900][ C0] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 404.375480][ C0] CR2: 00000000800c0018 CR3: 0000000020ed6000 CR4: 00000000003526f0 [ 404.383448][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 404.391419][ C0] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 404.399433][ C0] Call Trace: [ 404.402708][ C0] [ 404.405547][ C0] rt6_nh_find_match+0xd9/0x150 [ 404.410403][ C0] nexthop_for_each_fib6_nh+0x1c6/0x400 [ 404.415944][ C0] ? __pfx_rt6_nh_find_match+0x10/0x10 [ 404.421405][ C0] __find_rr_leaf+0x461/0x6d0 [ 404.426085][ C0] ? __pfx___find_rr_leaf+0x10/0x10 [ 404.431291][ C0] fib6_table_lookup+0x39f/0xa80 [ 404.436255][ C0] ? __pfx_fib6_table_lookup+0x10/0x10 [ 404.441710][ C0] ? ip6_pol_route+0x162/0x1180 [ 404.446552][ C0] ip6_pol_route+0x222/0x1180 [ 404.451289][ C0] ? __pfx_ip6_pol_route+0x10/0x10 [ 404.456495][ C0] ? __lock_acquire+0xaac/0xd20 [ 404.461372][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 404.466582][ C0] fib6_rule_lookup+0x348/0x6f0 [ 404.471450][ C0] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 404.477168][ C0] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 404.482539][ C0] ? ip6_route_output_flags+0x2e/0x5d0 [ 404.488006][ C0] ? ip6_route_output_flags+0x2e/0x5d0 [ 404.493481][ C0] ? kernel_text_address+0xa5/0xe0 [ 404.498598][ C0] ? __kernel_text_address+0xd/0x40 [ 404.503894][ C0] ip6_route_output_flags+0x364/0x5d0 [ 404.509266][ C0] ? ip6_route_output_flags+0x2e/0x5d0 [ 404.514733][ C0] ip6_dst_lookup_tail+0x1ae/0x1500 [ 404.519945][ C0] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 404.525598][ C0] ? __lock_acquire+0xaac/0xd20 [ 404.530456][ C0] ? __siphash_unaligned+0x263/0x3b0 [ 404.535742][ C0] ip6_dst_lookup_flow+0x47/0xe0 [ 404.540683][ C0] ? __pfx_ip6_dst_lookup_flow+0x10/0x10 [ 404.546326][ C0] udp_tunnel6_dst_lookup+0x231/0x3c0 [ 404.551697][ C0] ? __pfx_udp_tunnel6_dst_lookup+0x10/0x10 [ 404.557599][ C0] ? geneve_get_dsfield+0xec/0x680 [ 404.562796][ C0] ? __pfx_geneve_get_dsfield+0x10/0x10 [ 404.568342][ C0] geneve_xmit+0xd2e/0x2b70 [ 404.572892][ C0] ? __lock_acquire+0xaac/0xd20 [ 404.577762][ C0] ? __pfx_skb_network_protocol+0x10/0x10 [ 404.583481][ C0] ? geneve_xmit+0x128/0x2b70 [ 404.588162][ C0] ? unwind_next_frame+0xa5/0x2390 [ 404.593341][ C0] ? __pfx_validate_xmit_xfrm+0x10/0x10 [ 404.598889][ C0] ? __pfx_geneve_xmit+0x10/0x10 [ 404.603835][ C0] dev_hard_start_xmit+0x2ff/0x880 [ 404.608950][ C0] ? do_raw_spin_lock+0x121/0x290 [ 404.613981][ C0] __dev_queue_xmit+0x1adf/0x3a70 [ 404.619014][ C0] ? __dev_queue_xmit+0x27e/0x3a70 [ 404.624134][ C0] ? neigh_resolve_output+0x438/0x750 [ 404.629501][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 404.634899][ C0] ? read_seqbegin+0x122/0x250 [ 404.639659][ C0] ? neigh_resolve_output+0x438/0x750 [ 404.645030][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 404.650229][ C0] ? read_seqbegin+0x1ac/0x250 [ 404.654987][ C0] ? __pfx_read_seqbegin+0x10/0x10 [ 404.660093][ C0] ? __local_bh_enable_ip+0x12d/0x1c0 [ 404.665470][ C0] ? eth_header+0x11b/0x200 [ 404.669969][ C0] ? __asan_memcpy+0x40/0x70 [ 404.674559][ C0] ip6_finish_output2+0x11fb/0x16a0 [ 404.679762][ C0] ? ip6_finish_output2+0x701/0x16a0 [ 404.685044][ C0] ? __pfx_ip6_finish_output2+0x10/0x10 [ 404.690588][ C0] ? ip6_mtu+0x7d/0x3f0 [ 404.694744][ C0] ? ip6_mtu+0x7d/0x3f0 [ 404.698898][ C0] ip6_finish_output+0x234/0x7d0 [ 404.703836][ C0] ndisc_send_skb+0xb47/0x1400 [ 404.708616][ C0] ? ndisc_send_skb+0x208/0x1400 [ 404.713575][ C0] ? __pfx_ndisc_send_skb+0x10/0x10 [ 404.718781][ C0] ? __pfx_dst_output+0x10/0x10 [ 404.723656][ C0] addrconf_rs_timer+0x369/0x670 [ 404.728596][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 404.734056][ C0] call_timer_fn+0x17b/0x5f0 [ 404.738644][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 404.744102][ C0] ? call_timer_fn+0xbe/0x5f0 [ 404.748780][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 404.753895][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 404.759089][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 404.764298][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 404.769775][ C0] __run_timer_base+0x61a/0x860 [ 404.774627][ C0] ? ktime_get+0x3e/0x1f0 [ 404.778956][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 404.784324][ C0] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 404.790619][ C0] run_timer_softirq+0xb7/0x180 [ 404.795499][ C0] handle_softirqs+0x283/0x870 [ 404.800285][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 404.805049][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 404.810344][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 404.815559][ C0] __irq_exit_rcu+0xca/0x1f0 [ 404.820147][ C0] ? __pfx___irq_exit_rcu+0x10/0x10 [ 404.825359][ C0] irq_exit_rcu+0x9/0x30 [ 404.829592][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 404.835220][ C0] [ 404.838149][ C0] [ 404.841073][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 404.847058][ C0] RIP: 0010:lock_is_held_type+0x137/0x190 [ 404.852771][ C0] Code: 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 05 89 34 1f 07 <48> 3b 44 24 08 75 43 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f [ 404.872373][ C0] RSP: 0018:ffffc9000ac47238 EFLAGS: 00000206 [ 404.878441][ C0] RAX: 24c8a8f4edb8f700 RBX: 0000000000000000 RCX: 24c8a8f4edb8f700 [ 404.886410][ C0] RDX: 0000000000000000 RSI: ffffffff8d935c50 RDI: ffffffff8bc1d260 [ 404.894373][ C0] RBP: 00000000ffffffff R08: ffffffff8f7ed177 R09: 1ffffffff1efda2e [ 404.902342][ C0] R10: dffffc0000000000 R11: fffffbfff1efda2f R12: 0000000000000246 [ 404.910311][ C0] R13: ffff8880310e8000 R14: ffffffff8df3b920 R15: 0000000000000001 [ 404.918291][ C0] __schedule+0x274/0x4cd0 [ 404.922710][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 404.927910][ C0] ? sched_clock+0x3f/0x60 [ 404.932327][ C0] ? sched_clock_cpu+0x74/0x430 [ 404.937179][ C0] ? psi_task_change+0xe5/0x250 [ 404.942025][ C0] ? preempt_schedule_common+0x83/0xd0 [ 404.947478][ C0] ? __pfx___schedule+0x10/0x10 [ 404.952319][ C0] ? __resched_curr+0x2ca/0x3d0 [ 404.957182][ C0] ? preempt_schedule+0xae/0xc0 [ 404.962027][ C0] preempt_schedule_common+0x83/0xd0 [ 404.967312][ C0] preempt_schedule+0xae/0xc0 [ 404.971982][ C0] ? __pfx_preempt_schedule+0x10/0x10 [ 404.977353][ C0] preempt_schedule_thunk+0x16/0x30 [ 404.982551][ C0] _raw_spin_unlock_irqrestore+0xfd/0x110 [ 404.988270][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 404.994595][ C0] ? autoremove_wake_function+0x39/0x100 [ 405.000234][ C0] __wake_up_common_lock+0x190/0x1f0 [ 405.005526][ C0] __unix_dgram_recvmsg+0x49b/0xdc0 [ 405.010726][ C0] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 405.016455][ C0] ? unix_dgram_recvmsg+0xb1/0xd0 [ 405.021490][ C0] ? __pfx_unix_dgram_recvmsg+0x10/0x10 [ 405.027035][ C0] sock_recvmsg_nosec+0x183/0x1c0 [ 405.032086][ C0] ____sys_recvmsg+0x3aa/0x460 [ 405.036850][ C0] ? __pfx_____sys_recvmsg+0x10/0x10 [ 405.042130][ C0] ? get_compat_msghdr+0x37e/0x4a0 [ 405.047247][ C0] ? rcu_is_watching+0x15/0xb0 [ 405.052009][ C0] ? ___sys_recvmsg+0x1c4/0x510 [ 405.056856][ C0] ___sys_recvmsg+0x1b5/0x510 [ 405.061536][ C0] ? __pfx____sys_recvmsg+0x10/0x10 [ 405.066737][ C0] ? do_recvmmsg+0x2da/0x760 [ 405.071325][ C0] do_recvmmsg+0x36a/0x760 [ 405.075739][ C0] ? __pfx_do_recvmmsg+0x10/0x10 [ 405.080679][ C0] ? rcu_is_watching+0x15/0xb0 [ 405.085443][ C0] ? do_sock_setsockopt+0x267/0x3e0 [ 405.090639][ C0] __sys_recvmmsg+0x19d/0x280 [ 405.095328][ C0] ? __pfx___sys_recvmmsg+0x10/0x10 [ 405.100521][ C0] ? __pfx___se_sys_futex_time32+0x10/0x10 [ 405.106325][ C0] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 405.112477][ C0] __do_fast_syscall_32+0xb4/0x110 [ 405.117592][ C0] do_fast_syscall_32+0x34/0x80 [ 405.122444][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 405.128774][ C0] RIP: 0023:0xf7f48539 [ 405.132835][ C0] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 405.152438][ C0] RSP: 002b:00000000f504555c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 405.160849][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 405.168821][ C0] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 405.176790][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 405.184759][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 405.192728][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 405.200705][ C0] [ 405.203729][ C0] Modules linked in: [ 405.207765][ C0] ---[ end trace 0000000000000000 ]--- [ 405.213229][ C0] RIP: 0010:find_match+0xa3/0xc90 [ 405.218275][ C0] Code: 00 00 00 00 00 fc ff df 42 80 7c 25 00 00 74 08 48 89 df e8 2f c8 12 f8 48 89 d8 bb c0 00 00 00 48 03 18 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 0e c8 12 f8 48 8b 1b e8 76 11 47 [ 405.237899][ C0] RSP: 0018:ffffc900000067b0 EFLAGS: 00010206 [ 405.243971][ C0] RAX: 0000000000000018 RBX: 00000000000000c0 RCX: 0000000000000100 [ 405.251959][ C0] RDX: ffff8880310e8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 405.259944][ C0] RBP: 1ffff1100510ff84 R08: ffffc90000006b40 R09: ffffc90000006b50 [ 405.267932][ C0] R10: ffffc900000069a0 R11: ffffffff8a0efac0 R12: dffffc0000000000 [ 405.275933][ C0] R13: 0000000000000002 R14: 1ffff1100510ff86 R15: ffff88802887fc37 [ 405.283920][ C0] FS: 0000000000000000(0000) GS:ffff8881260cc000(0063) knlGS:00000000f5045b40 [ 405.292886][ C0] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 405.299578][ C0] CR2: 00000000800c0018 CR3: 0000000020ed6000 CR4: 00000000003526f0 [ 405.307576][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 405.315545][ C0] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 405.323622][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 405.331236][ C0] Kernel Offset: disabled [ 405.335569][ C0] Rebooting in 86400 seconds..