last executing test programs: 2m36.341882421s ago: executing program 0 (id=39): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) r2 = socket$netlink(0x10, 0x3, 0x4) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x2f, 0x9, 0x90, 0x386, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @remote, 0xf800, 0x8000, 0x80000000, 0x80}}) sendmsg$nl_route(r2, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@ipv4_newroute={0x1c0, 0x18, 0x8, 0x70bd2c, 0x25dfdbfd, {0x2, 0x10, 0x80, 0x1, 0x0, 0x2, 0xff, 0x7, 0x200}, [@RTA_IIF={0x8, 0x3, r3}, @RTA_METRICS={0xe9, 0x8, 0x0, 0x1, "67c3efc2d896b8857e85175fd013416ea51294bef442a553f29247bbdc3f16fb24625566fd50b3ad3d537f1bfba030541d697791d8c0074b8812589f7dcafc800b8f208fd440f956f9bfd6b89c9eb66dd9770dda5ba56a2db3964cb0d2de53963ecfaf2f8760c43be7f726e6722b95e7899a197c981ca355a67c8f5c579cca97f73580cd3d04b7899f1877f0b1e8332c01e2203bdd904c90697db5cba35ef4f463974dc61d24eb75e59d28c3d3971836e4500f0256f2a8960c8667295ef5b21dbee134b9780c63d0eb08b908e4900324f2ad55a3453ceda51c83c671d144610a02801cb7d3"}, @RTA_SPORT={0x6, 0x1c, 0x4e23}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_METRICS={0x7f, 0x8, 0x0, 0x1, "2c60b79192d5e03fbd8222e442951a6c494de36506c31db62a897e8db821beac33e61fd0df4c7eedd99ffc3a93a58815d8b667d46048afb39d265c7ae34b77e23ea4394b897148673a48013605019df082f0e4353c13966e639dcfbf70c6c55816a5bf9ae2824de06704685afbbb4150fa46c103408a9b9a774db7"}, @RTA_IP_PROTO={0x5, 0x1b, 0x3a}, @RTA_SPORT={0x6, 0x1c, 0x4e23}, @RTA_PREFSRC={0x8, 0x7, @remote}, @RTA_FLOW={0x8, 0xb, 0x4}]}, 0x1c0}}, 0x40004) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000240)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000000000000000001000000000000004400050000000000000000000000000000000000fffffffc3c00000002000000ac1414aa000000000000000000600000000600000004030000010400"/181], 0xfc}}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) sendmmsg$inet6(r5, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="8233", 0x2}], 0x1}}], 0x1, 0x4400c800) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$packet(0x11, 0x2, 0x300) r7 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x8) r9 = openat$cgroup(r8, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000000)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000200)=0x1, 0x12) socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r10, &(0x7f0000000140), 0x10) r11 = socket(0x10, 0x3, 0x0) write(r11, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 2m35.767541185s ago: executing program 0 (id=43): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x83, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x20000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x20000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000240)="b805000000090200e1490000320f01d9660ff7e31bf7ecec05000000b90000c0fe0fae41d90100b9800000c00f3209083667dbd20f300f0826f30fc7b205000000660fc775022e0ffa600c980f320f3566b85700", 0x54}], 0x1, 0x17, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(0xffffffffffffffff, 0xc038563b, 0x0) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000040)={0x26e8}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000000)={0x1fb, 0x6, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x4a, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f00005a8000/0x1000)=nil, 0x1000, 0x13) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x4, 0x0, [{0x9a7, 0x0, 0x100}, {0xb65, 0x0, 0x2}, {0x37d, 0x0, 0x3}, {0x4b564d01, 0x0, 0x200}]}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_SET_MCE(r9, 0x4040ae9e, &(0x7f0000000180)={0x300000000000000, 0x0, 0x4, 0x2, 0x8}) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xf3b8, 0x0, 0x8000001000, 0x400, 0x4002004c4, 0x1000, 0x0, 0x97, 0x10, 0x0, 0x3, 0x8], 0xeeee8000, 0x140640}) ioctl$KVM_RUN(r9, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000100)) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfb, {0x0, 0x0, 0x2000, 0x0, 0x71f43, 0x3424f}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d848}, 0x8080) 2m34.620673652s ago: executing program 0 (id=47): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x101081, 0x0) ioctl$SOUND_PCM_READ_RATE(r0, 0x80045002, &(0x7f0000000040)) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @msi={0x0, 0xc0000000, 0x6, 0x6}}]}) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000280)=[@code={0xa, 0x5a, {"0f380a669766ba6100b000ee2309c0da00008c000000ba000000000f30c4827941fac4e1f96e42e46505e7ee1921b9500b00000f328fe9209b7ce100c403790cdeb8010000000f01d9"}}], 0x5a}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) fcntl$lock(r1, 0x26, &(0x7f00000001c0)={0x2, 0x1, 0x3, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$XFS_IOC_GETPARENTS(r1, 0xc028583e, &(0x7f00000005c0)={{[0x90ff, 0x4, 0x59, 0x9]}, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000440)=[{{@_ha_fsid={[0x728, 0x6]}, {0x7f, 0x74b, 0x800, 0x8}}, 0x0, 0x0, ')\xa2\x00'}, {{@align=0x6, {0x101, 0x1, 0x86, 0x100000000}}, 0x4, 0x0, '[(\x00'}, {{@_ha_fsid={[0x3f, 0x9]}, {0x7, 0xfffc, 0xe, 0xb}}, 0x401, 0x0, '&$/]\x00'}, {{@_ha_fsid={[0x81, 0x1e3]}, {0x1c, 0x800, 0x5, 0x3}}, 0x9, 0x0, '/dev/dsp1\x00'}, {{@_ha_fsid={[0xffff, 0xc]}, {0x2, 0x9, 0x1, 0x2}}, 0x5, 0x0, '\x00'}, {{@align=0x5, {0x8, 0x4, 0x4, 0x7}}, 0x8001, 0x0, '/dev/dsp1\x00'}, {{@_ha_fsid={[0x0, 0x7]}, {0x200, 0x9, 0x40, 0x8dd8}}, 0x3ff, 0x0, '\x00'}, {{@_ha_fsid={[0xfff, 0x1]}, {0x7bbf, 0x8, 0x8, 0x5}}, 0x2021, 0x0, '\x00'}, {{@_ha_fsid={[0x2, 0x100000]}, {0xa9b1, 0xa, 0xb762, 0x7fffffff}}, 0x9, 0x0, '/dev/dsp1\x00'}, {{@_ha_fsid={[0x0, 0x1]}, {0x9, 0xc34, 0x5, 0xc}}, 0x0, 0x0, '/dev/kvm\x00'}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000140)={[{0x1, 0xc, 0x6, 0x3, 0x6, 0x2, 0x42, 0x9, 0x1, 0x4, 0x2, 0x3, 0x3}, {0x1, 0x7, 0x7, 0x0, 0x8, 0x7, 0x49, 0xff, 0x2, 0x1, 0x9, 0xf, 0x20000000006}, {0x2, 0x5, 0x5, 0x84, 0x8, 0x7, 0xfd, 0x40, 0x5, 0x3, 0x4, 0x3, 0x80000000000}], 0xf87}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2m33.949455167s ago: executing program 0 (id=49): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x4, 0x2}, 0x8) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r1, &(0x7f0000000140)=[{0x0, 0x20}, {&(0x7f0000000500)=""/84, 0x54}], 0x2, 0x4, 0x8008) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x8) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000005c0)='syz_tun\x00', 0x10) sendto$inet(r5, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x42, &(0x7f00000000c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xaf, 0xe754}]}}}}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) r6 = dup3(0xffffffffffffffff, r2, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@fallback=r6, 0x1f, 0x0, 0xaba5, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300), 0x0}, 0x40) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, 0x0) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000) close_range(r0, 0xffffffffffffffff, 0x0) 2m32.991305425s ago: executing program 0 (id=54): r0 = gettid() timer_create(0x6, &(0x7f0000000240)={0x0, 0x40, 0x2, @tid=r0}, &(0x7f00000002c0)) r1 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="05000000000000000040000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES16, @ANYRES64=0x0, @ANYBLOB="000000000200000000000000000000003fd31340e92c4bb8"], 0x48}, 0x300}, 0x0) socket$inet(0x2b, 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000000080)=0x7) io_setup(0x1, &(0x7f0000000380)=0x0) io_submit(r5, 0x2, &(0x7f0000000000)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x7, 0xf, 0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0, 0x2}]) write$char_usb(r4, &(0x7f0000000040)="e2", 0x2778) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x400) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) read(r3, 0x0, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x28002) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r6, 0x4112, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x9}) timer_settime(0x0, 0x1, &(0x7f0000000140)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = getpgid(0x0) syz_pidfd_open(r7, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0) r8 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r8, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000180)=ANY=[@ANYBLOB="400323"], 0x0, 0x0}) 2m32.664158121s ago: executing program 0 (id=56): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_create_resource$binfmt(0x0) (async) r4 = syz_create_resource$binfmt(0x0) openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f00000001c0), &(0x7f0000000000)) (async) r6 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e51, 0x125, 0x1, 0x28d, 0x0, r6}, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x20000, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x1, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000000)={0x0, 0x0}) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000840)={0x0, &(0x7f0000000480)=[@code={0xa, 0x59, {"400f013966baf80cb8c0491188ef66bafc0c66b827c866ef0f32360f0666ba2100b800500000efc4e1d259427c0fc75d0066b87e000f00d8660f3882970000000066bad004b0e6ee"}}, @nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x32ca}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18, 0x2}, @in_dx={0x69, 0x20, {0xd8cd, 0x6}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x4c4, 0x8, 0x4, 0x29805c16}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x46a, 0x8, 0x1}}, @set_irq_handler={0xc8, 0x20, {0x1e}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xbf28, 0x6, 0x8000000000000000}}, @nested_vmresume={0x130, 0x18}, @nested_load_syzos={0x136, 0x90, {0x3, 0x5, [@wrmsr={0x65, 0x20, {0x181, 0x100000001}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control32=0x4004, 0x40, 0xe, 0x80}}, @nested_create_vm={0x12d, 0x18, 0x2}]}}, @uexit={0x0, 0x18, 0xfffffffffffffffc}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0xf6, 0x1, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_invlpga={0x17d, 0x20, {0x8000000, 0x1c6e}}, @wr_crn={0x67, 0x20, {0x2}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x4f, 0x82fa, 0x4e66, 0x9}}], 0x3a1}) (async) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000840)={0x0, &(0x7f0000000480)=[@code={0xa, 0x59, {"400f013966baf80cb8c0491188ef66bafc0c66b827c866ef0f32360f0666ba2100b800500000efc4e1d259427c0fc75d0066b87e000f00d8660f3882970000000066bad004b0e6ee"}}, @nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x32ca}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18, 0x2}, @in_dx={0x69, 0x20, {0xd8cd, 0x6}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x4c4, 0x8, 0x4, 0x29805c16}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x46a, 0x8, 0x1}}, @set_irq_handler={0xc8, 0x20, {0x1e}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xbf28, 0x6, 0x8000000000000000}}, @nested_vmresume={0x130, 0x18}, @nested_load_syzos={0x136, 0x90, {0x3, 0x5, [@wrmsr={0x65, 0x20, {0x181, 0x100000001}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control32=0x4004, 0x40, 0xe, 0x80}}, @nested_create_vm={0x12d, 0x18, 0x2}]}}, @uexit={0x0, 0x18, 0xfffffffffffffffc}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0xf6, 0x1, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_invlpga={0x17d, 0x20, {0x8000000, 0x1c6e}}, @wr_crn={0x67, 0x20, {0x2}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x4f, 0x82fa, 0x4e66, 0x9}}], 0x3a1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2m32.274009052s ago: executing program 32 (id=56): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_create_resource$binfmt(0x0) (async) r4 = syz_create_resource$binfmt(0x0) openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f00000001c0), &(0x7f0000000000)) (async) r6 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e51, 0x125, 0x1, 0x28d, 0x0, r6}, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x20000, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x1, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000000)={0x0, 0x0}) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000840)={0x0, &(0x7f0000000480)=[@code={0xa, 0x59, {"400f013966baf80cb8c0491188ef66bafc0c66b827c866ef0f32360f0666ba2100b800500000efc4e1d259427c0fc75d0066b87e000f00d8660f3882970000000066bad004b0e6ee"}}, @nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x32ca}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18, 0x2}, @in_dx={0x69, 0x20, {0xd8cd, 0x6}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x4c4, 0x8, 0x4, 0x29805c16}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x46a, 0x8, 0x1}}, @set_irq_handler={0xc8, 0x20, {0x1e}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xbf28, 0x6, 0x8000000000000000}}, @nested_vmresume={0x130, 0x18}, @nested_load_syzos={0x136, 0x90, {0x3, 0x5, [@wrmsr={0x65, 0x20, {0x181, 0x100000001}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control32=0x4004, 0x40, 0xe, 0x80}}, @nested_create_vm={0x12d, 0x18, 0x2}]}}, @uexit={0x0, 0x18, 0xfffffffffffffffc}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0xf6, 0x1, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_invlpga={0x17d, 0x20, {0x8000000, 0x1c6e}}, @wr_crn={0x67, 0x20, {0x2}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x4f, 0x82fa, 0x4e66, 0x9}}], 0x3a1}) (async) syz_kvm_add_vcpu$x86(r9, &(0x7f0000000840)={0x0, &(0x7f0000000480)=[@code={0xa, 0x59, {"400f013966baf80cb8c0491188ef66bafc0c66b827c866ef0f32360f0666ba2100b800500000efc4e1d259427c0fc75d0066b87e000f00d8660f3882970000000066bad004b0e6ee"}}, @nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x32ca}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18, 0x2}, @in_dx={0x69, 0x20, {0xd8cd, 0x6}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x4c4, 0x8, 0x4, 0x29805c16}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x46a, 0x8, 0x1}}, @set_irq_handler={0xc8, 0x20, {0x1e}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xbf28, 0x6, 0x8000000000000000}}, @nested_vmresume={0x130, 0x18}, @nested_load_syzos={0x136, 0x90, {0x3, 0x5, [@wrmsr={0x65, 0x20, {0x181, 0x100000001}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control32=0x4004, 0x40, 0xe, 0x80}}, @nested_create_vm={0x12d, 0x18, 0x2}]}}, @uexit={0x0, 0x18, 0xfffffffffffffffc}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0xf6, 0x1, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_invlpga={0x17d, 0x20, {0x8000000, 0x1c6e}}, @wr_crn={0x67, 0x20, {0x2}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x4f, 0x82fa, 0x4e66, 0x9}}], 0x3a1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 10.082571396s ago: executing program 2 (id=602): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x1e, 0x4, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1001, 0x1}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x80000007, 0x1}, 0x1c) syz_genetlink_get_family_id$nl80211(0x0, r2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000200)=ANY=[], 0x20) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) openat$cgroup_root(0xffffff9c, 0x0, 0x200002, 0x0) io_uring_enter(r5, 0x1f05, 0x40110a, 0x4d, 0x0, 0x0) recvmmsg$unix(r2, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/227, 0xe3}], 0x1}}], 0x1, 0x40000000, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg(0xffffffffffffffff, 0x0, 0x1f00) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 7.388844915s ago: executing program 4 (id=610): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x21, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000028000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000006609010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.263990248s ago: executing program 4 (id=611): openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r0 = socket(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$packet(0x11, 0x2, 0x300) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) bind$packet(r3, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x4, 0x6, @broadcast}, 0x14) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x129541, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000a80)={0x1, 0x0, @pic={0x96, 0x9, 0xe5, 0x80, 0x9, 0xa, 0x4, 0x7, 0x81, 0x39, 0x0, 0x8, 0xfd, 0x4, 0x0, 0x2}}) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x6, 0xfc, 0x1, 0x9, 0x1, 0x4, 0x9, 0x9, 0x1, 0x3, 0x9, 0x1, 0x9b, 0x9, 0x5, 0x7}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x20001, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="3124deffefff0005090000000000000002000000080000000000b80000"], 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) syz_open_procfs(0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="ac181435ffffffff0185000000000000"], 0x10) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r7, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x10) socket$nl_audit(0x10, 0x3, 0x9) 6.512023654s ago: executing program 2 (id=613): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) (async, rerun: 32) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x17ef, 0x60ee, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8, 0xb, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xe7}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x7b, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x800, 0xffffffff, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x800) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) (async) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0xfe) 6.50975602s ago: executing program 1 (id=614): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x3, 0xff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xa}, 0x1c) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 6.040644775s ago: executing program 1 (id=616): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) (async) r3 = add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa) keyctl$instantiate(0xc, 0x0, 0x0, 0x43, r3) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x44, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34080}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x20}}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x1004c080}, 0x4000001) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd"], 0x0) r5 = socket$packet(0x11, 0x3, 0x300) (async) r6 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r6) (async) getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b8"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) sendto$packet(r5, &(0x7f0000000040)="2717a90af1a30d71286f47000000", 0xe, 0x40000, &(0x7f0000000180)={0x11, 0x18, r7, 0x1, 0x0, 0x6, @link_local}, 0x14) 5.609001089s ago: executing program 1 (id=617): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@v={0x93, 0x92, 0xa0, 0x9, @generic=0x4, 0x2}) 5.408272306s ago: executing program 5 (id=619): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x14, 0x21, 0x11, 0x10, 0x4, 0xe80, 0x7, 0x40}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad", 0x1) (async) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad", 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0x3454, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) (async) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5, &(0x7f0000000000)=0x3, 0x4, 0x1) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000001000210400000000000000", @ANYRES32=0x0, @ANYBLOB="4b02d0694601650cfa8a902d0f904ffd5a5152b5c1ab571d70b6c3bbf4a807d1141ee42ea3408443f64abbf3d06d86c71fa15d0d5fbd7ea95355e0771fafa7cf"], 0x20}}, 0x20000004) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x6}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) (async) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x6}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) syz_open_dev$sndpcmc(0x0, 0x0, 0x42c001) (async) syz_open_dev$sndpcmc(0x0, 0x0, 0x42c001) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 5.343968413s ago: executing program 1 (id=620): unlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="31010000dccd5e08cb060300000000ea22010902240001000064000904340102d469e70009058acf"], 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x9, 0x71}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}]]}, 0x38}}, 0x20000000) syz_usb_control_io(r0, 0x0, 0x0) unlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="31010000dccd5e08cb060300000000ea22010902240001000064000904340102d469e70009058acf"], 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x9, 0x71}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}]]}, 0x38}}, 0x20000000) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) 5.001817454s ago: executing program 2 (id=621): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x21, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000040000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000006609010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.634217063s ago: executing program 2 (id=622): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000540), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f00000000c0)=[{0x5, 0x2, 0x0, 0x0, @time={0x4}, {}, {0x0, 0x1}, @result={0x9, 0x316}}], 0x1c) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000480)=ANY=[@ANYRES64=r0], 0x0) syz_usb_control_io(r1, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, {0xa, 0x4e23, 0x7, @loopback, 0xf5}}}, 0x3a) r3 = socket$tipc(0x1e, 0x7, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x43, 0x3}, 0x10) syz_usb_control_io$hid(r1, &(0x7f0000001140)={0x24, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}, 0x0) 4.402455642s ago: executing program 4 (id=624): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) r0 = socket$inet6(0xa, 0x2, 0x0) close(0xffffffffffffffff) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/243, 0xf3}, 0xf338}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x5c}, 0xd}], 0x3fffe16, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000001, 0x0, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x8000, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x3, 0x80000000, 0xfffffffb, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x5, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x8, 0x4c75, 0x80000000, 0xfffffffe, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x6, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x0, 0x5, 0xfffffff3, 0x129432e6, 0x40c8, 0x3, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0xea4, 0x0, 0xb94, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x2d, 0x4e2, 0x5, 0x4, 0xb, 0x2000004, 0x9, 0x80000001, 0x9, 0x6, 0x47, 0x8200, 0x1, 0xfe000000, 0x8, 0xfffffffc, 0x4, 0x4, 0x3, 0x50, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0xd5, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0x8000, 0x0, 0x5, 0xb, 0x5, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x3, 0x20000008, 0x4, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2, 0x1000, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x8, 0xca, 0x1ff, 0x3, 0x7ff, 0xbe, 0x4, 0x7, 0xe, 0x0, 0x5, 0x1c, 0x8, 0x4, 0x8, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2, 0x5, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x9, 0x2, 0x101, 0x10000, 0x2000004, 0x7fff, 0x10ffff, 0xa620, 0x2, 0x5, 0x7fffffff, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0x40007, 0xaf, 0x5, 0x6, 0x800227, 0x2, 0x5, 0xb, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x1, 0xb1e, 0xd7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 4.171273103s ago: executing program 3 (id=626): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x3, 0xff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xa}, 0x1c) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 3.962012287s ago: executing program 3 (id=627): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) r1 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) (async) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0xc}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000100)={{&(0x7f000003c000/0x2000)=nil, 0x2000}, 0x1}) (async, rerun: 32) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000100)={0x10001, 0x1, 0x2}) (async, rerun: 64) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000003c0)={0x1, @win={{0x1, 0x5, 0x5, 0xd06c}, 0x9, 0x4000000, &(0x7f0000000340)={{0x400, 0x9c7d, 0x38000000, 0x8}, &(0x7f0000000300)={{0x8, 0x3ff, 0x7a, 0x7}, &(0x7f00000002c0)={{0xf24, 0x9, 0x200, 0x4}, &(0x7f0000000280)={{0x9, 0x8000, 0xd1, 0x44ab}}}}}, 0x7, &(0x7f0000000380)="073af557352498520bc2526aae0901279fb010c6ebe9a3", 0x9}}) (async, rerun: 64) listen(r0, 0x0) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r5, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540), 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x3c, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x3e}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40000) (async) unshare(0x28040680) (async) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x6, 0x2}, {0x0, 0xb7}, {}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x0, 0xfffffffd}) (async) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) r8 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r8, &(0x7f00000001c0)={0x1d, r9}, 0x10) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r8, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) ioctl$SIOCGSTAMP(r8, 0x8906, 0x0) (async) sendmsg$can_raw(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@can={{}, 0x0, 0x3, 0x0, 0x0, "00000010000300"}, 0x10}}, 0x20000000) (async) read(r8, &(0x7f0000002340)=""/232, 0xe8) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) accept4(r0, 0x0, 0x0, 0x800) (async) sendto(r4, &(0x7f00000000c0)="3946d67d802fd3544efc39bd136a5e809889bf7686fcefa68c6bca360750da92f44b311a7be09226f2c5a6569484fb5ec9c1ad5d1428050d2dbf8cb6ebfda9a73d550a552ec3ad0101aa2c2132bb5e088759d93b43a72ca90f739a06d76accec084bbef73300", 0x66, 0x240c08c3, 0x0, 0x0) recvmmsg(r4, &(0x7f0000005cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004400)=""/211, 0xd3}}, {{0x0, 0x0, &(0x7f0000004600), 0x2, 0x0, 0x52}}, {{0x0, 0x0, &(0x7f0000005c40)=[{0x0, 0x7}], 0x1}}], 0x3, 0x0, &(0x7f0000005ec0)={0x0, 0x989680}) 3.839925914s ago: executing program 3 (id=628): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000068a000000000000040000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffa9adb702000008000000b703000002000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0xfed, &(0x7f0000001840)=""/4077}, 0x94) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x38, r1, 0x1, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb7b}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x75}]}]}, 0x38}}, 0xc840) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="a8", @ANYRES16=r2, @ANYBLOB="000226bd7000fddbdf25130000000800068004000200cc000180100001006574683a67726574617030000c0002800800040010000000240002800800010005000000080002004d0f00000800030000000000080002000800000014000280080001001300000008000200000000000d0001007564703a73797a3000000000440002800800010015000000080003000600000008000400020000000800040008000000080001000b000000080002004b0a000008000200050000000800020001000000150001006574683a7465616d5f736c6176655f310000000008000300a47d0000"], 0xe8}, 0x1, 0x0, 0x0, 0x8000}, 0x20040000) r3 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540), 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x30, r2, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x1c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x11) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd2(0x4db5, 0x80801) r7 = eventfd2(0x4, 0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000040)={r7, 0x7, 0x2, r6}) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000100)={r6, 0x7, 0x2, r7}) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x9, 0xc0, 0x5, 0x7, 0x7f, 0x0, 0x1, 0x7, 0x1, 0x41, 0x3, 0x58, 0x7, 0x5, 0xb, 0x7f}}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000003c0)={[0xcb, 0xd, 0x2000000000004, 0x6d, 0x2, 0x1002, 0x80000ef, 0x200, 0x7fffffffffffb, 0x8d, 0x2, 0x1, 0xfffffffffffffffe, 0x5, 0x3, 0xbdf], 0x2000, 0x67a64fa265d6d617}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000300)={&(0x7f00000001c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_SETPLANE(r3, 0xc03064b7, &(0x7f0000000200)={r9, 0x0, 0x0, 0x100, 0xa0ca, 0x80000004, 0x4f, 0x0, 0x9, 0xe, 0xd, 0x31e}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(r10, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="00022bbd7000fcdbc625170000000c009900eade0000380000000a000600080211d83dd4fa697223130e9462421100c454ca4ccaaf6d44ffffffffffff00000a001a0008021100000000"], 0x50}, 0x1, 0x0, 0x0, 0x44}, 0x4000080) 3.79272793s ago: executing program 5 (id=629): futex(0x0, 0xb, 0x2, 0x0, &(0x7f0000000080)=0x6, 0x4fffffb) 3.604195804s ago: executing program 5 (id=630): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="03010000ac0fce405d0501904431000000010902120009000080040904"], 0x0) (async) socket(0x25, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0x40045010, 0x0) (async) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x4d, &(0x7f0000caaffb), &(0x7f0000000180)=0xc) (async) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x5, 0x7, 0x9, 0x3, 0x12, "4bf8269dc8c718c9d46b6fed87700d14836709"}) (async) write$UHID_INPUT(r4, &(0x7f0000001040)={0xc, {"a2e3ad21ed0d52f91b5d360887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc825d8e524b2451138e495bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546850a27af9544ae15a7e454dea05918b4fd42513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cfe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2691491abf8ab9c015073014d9e08d4338b8780bdecd436cf0541e4505bc3a45237f104b962102de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd735892892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5407000000e3ad038f2211f1033195563c7f93cd54b9094f226e78b271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005008000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546def271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652770711935f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f42f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599af40005b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fd30d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb84d9a88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678458fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000bd700", 0x1000}}, 0x375) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xa0000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="0303dbdf250c00000008000300af988a8745ebb4c11858194e81831ca46496e1d84386708a4be101e1b3eccbd4dcd1966c60c98986fd271738203c507049a399d9203e0b733ca852d385aa2eabdb007a6beca65c4b82f3ae6ab0fb54dd5d441b0f74fd3d576818272d18885e59e907520ae9486e47d84896f2de8aee2534ba7986f3fa9175c5", @ANYRES32=r6, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8050}, 0x4000) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="78000000e6e418d860ba02bf4f8594e4f8cb9279721d2af7354852784b78eec5a9b7beacd0b607031b994ef98addcce10640c0a126f10c538c50c3797cb9267825f6917210fbd42c2e197779519af342136e3dca8937f28985164f34fab18720d92aecdef260f0d8c6ce5b0308a72a9d96bf3a4da14b12fac85b2378afc67e9344e3ae964aa08e9058cf957cf32653117139c3d3c3526e9c8eac755f380ec24b12509e0e248f492a53a37730d7822d3d2ac87fc044fef36556579f60b5880e2c0995ce2ca88db2650c6beccdfa4f0f07b672900cde64afdeda60f25f96a6", @ANYRES16=r7, @ANYBLOB="020027bd7000ffdbdf250900000008000b003000000005002a00000000000a000900aaaaaaaaaabb000008002b00ff03000008002c00539800000500290001000000080032000800000005002a0000000000080034007f0000000500290001000000"], 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x600000b5) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000040)={@host}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r8, 0x0, 0x50, 0x0, &(0x7f0000000100)) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000800)=@filter={'filter\x00', 0x4, 0x4, 0x368, 0xffffffff, 0x0, 0x0, 0x1b8, 0xfeffffff, 0xffffffff, 0x298, 0x298, 0x298, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, [0xffffff00, 0xffffff00, 0xffffffff, 0xffffffff], [0xff, 0x0, 0xff000000, 0x9fef11ecb176da43], 'pimreg\x00', 'ip6erspan0\x00', {0xff}, {}, 0x62, 0x3, 0x4, 0x3}, 0x2f2, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0xfa, 0xc, "8e497e5d0c2137c96f6ad12a202b8ac1ed26df8f060c010eda04d75cfa60"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x1, 0x4}, {0x4, 0x3, 0x4}, {0x3, 0x6, 0x5}, 0x7fff, 0x8000}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) (async) close(r0) 3.488618282s ago: executing program 1 (id=631): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) r1 = syz_usb_connect$uac1(0x4, 0xcc, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xba, 0x3, 0x1, 0x3, 0x40, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8, 0x1d}, [@selector_unit={0x7, 0x24, 0x5, 0x5, 0x7, "70e8"}, @input_terminal={0xc, 0x24, 0x2, 0x6, 0x402, 0x5, 0x7, 0x9, 0x9, 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x197, 0x200, 0x2, "d1b4d201f585b4"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x0, 0x3, 0xf1, {0x7, 0x25, 0x1, 0xc, 0x6, 0xffff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x4, 0x4, 0x9, 0x8, "d9", "c8fb"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x7, 0xff, 0x6, 0x6}, @as_header={0x7, 0x24, 0x1, 0xe, 0x2, 0x1001}, @as_header={0x7, 0x24, 0x1, 0xfa, 0x9, 0x5}, @as_header={0x7, 0x24, 0x1, 0x2, 0x8, 0x3}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x9, 0x53d8, 0x6, "7a3326eb49"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x0, 0xd5, 0x8, {0x7, 0x25, 0x1, 0x8, 0x4, 0x800}}}}}}}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x0, 0xf, 0x3, 0x10, 0xff, 0x81}, 0x27, &(0x7f00000001c0)={0x5, 0xf, 0x27, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x0, 0x2, 0xbe0}, @ssp_cap={0x18, 0x10, 0xa, 0x5d, 0x3, 0x9, 0xf00, 0xff, [0xff0000, 0x18000, 0x0]}]}, 0x5, [{0xce, &(0x7f0000000880)=ANY=[@ANYBLOB="ce03169af46a78694fc9b4e3b28b0eb8db304128010791ec0414ed33e486d732ba61bf0f9a14b315164bd6b8b64d0958d00600d33f3c69202467b0eec5a6ad78cf3ae295aaa27a5caa0859e0b83a6516a993e085ffbd2b787d1e2b0a27af33c76021c3fe8deb846d214a40658e33aa770f97ea5f78099acd78e7c299e9ec25a1c7de5f9fafaa650f302cd23c1085097071b2c3c9e6bc9c6c305b7c0bb881cdd07c68cd5e616e1f3c1f348bcee684305745b43d9a98f5cebeb4b2e789760743bd407edbc489bac601b5231ffd7746e0eb1408f3bb37250f741d3ced5a2633da91753b2ca5fd69da73225aaaca2bc7ad7dce8fd5d046dd70"]}, {0xca, &(0x7f0000000400)=@string={0xca, 0x3, "c7e3acb4e86320c31376f4e1f7b519f7cb24c38d7ac603907e9980f64df679cb45be9c9c34c9028a57a6495ca4f440a6b323e38aa470a318088658ddde3cfd94751e6ca83d795fd57e29bdf48a2282dd7aee40e8faaff1ba213ae9c2e12d78bf56560c824f61938cff851c30b68fd0c822f8540c74e0b5dd1e76ce325a04f79e60c2e8abfe12cc2884b07d4114e3a4685cdb2f640ef233bc44ec2b827e89228bbd5b2fc1f923431e70c5da8ac76c7081f10001f433c017a7b1804373a0c62846c144b3d6f5ac9f06"}}, {0xd7, &(0x7f0000000500)=@string={0xd7, 0x3, "8419f176cd6554cf4d0c3169c727e54b9dde650a24f20e66c0fb8ba5b50d68a7acaa8a6b9f86a9eb9108079213545643ba906a9cf11a56143e6ff6d761260077553ac8454087c5eb053805e502d58ac45c78c8db59ea4a852e7dc2826e2e6ce985ce139ae499d2fe90b404dacc394d2c6e8ad664d6562c9299cceba55f40e1ae0265d8fb673b9e2b93830112ea34a5b9ff48643d45d4b0ef6d9dce8a183b05fd44835969e42d533d1a0eda235d2e10ebaa6e54cfd8ad809fd00533660248549e93e1c60e39552c60144ddc810c363c8bfaf014e690"}}, {0x6b, &(0x7f0000000600)=@string={0x6b, 0x3, "130720f0297203b439eae29b5870e3d70f6f19d727136c5697360d54313d6a155727c8957626f0ec70010adb6ce62d32a0b4f8e64dbd20a22eadd1fccd227f47cb2b5c73eed61913feff2808b1dd93d3e145cb0a4340121ebc4275cb188f43b90af0c92bfd417be481"}}, {0x66, &(0x7f0000000680)=@string={0x66, 0x3, "c4bc236f9bc91471ac09e8c6ed8b0f27446257359481f0bb565895d8e0953abb596ac24db14d5155b39c40ca8250357d8ea1bd4467ec63424090e9ae08b2295f11f2944fef0ba2d687adedb4d2a0df13ef878fb3471589de159d6e193f306209622bb570"}}]}) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x6, 0xc0, 0x40, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x7, 0x1, 0x1, 0xe3, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x7, 0x3, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.444736138s ago: executing program 4 (id=632): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x21, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000041000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000006609010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.299950253s ago: executing program 5 (id=633): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$kcm(0x1e, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x4, 0x1}}, 0x80, 0x0}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$key(0xf, 0x3, 0x2) socket$inet_sctp(0x2, 0x1, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r1], 0x28}}, 0x802) 3.263402112s ago: executing program 4 (id=634): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 3.254449073s ago: executing program 3 (id=635): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x10, 0xffffffffffffffff, 0xf5699000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x4400, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='attr\x00') getdents64(r1, &(0x7f0000002f40)=""/4098, 0x1002) 3.164420916s ago: executing program 4 (id=636): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) close(0xffffffffffffffff) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r4, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/243, 0xf3}, 0xf338}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x5c}, 0xd}], 0x3fffe16, 0x2, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) landlock_create_ruleset(0x0, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xbc3d, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x1, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) 3.109867079s ago: executing program 5 (id=637): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x3, 0xff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xa}, 0x1c) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 3.089486659s ago: executing program 3 (id=638): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000003380)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="02000000010003000040000001000000", @ANYRES32=0x0, @ANYBLOB="0400000000000000100005000000000020"], 0x2c, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) 2.890827136s ago: executing program 5 (id=639): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007882b740422c0917b7ca010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @broadcast}, @redirect={0x8, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @remote}}}}}}, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000140)={0x40, 0x9, 0x1, "f9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, &(0x7f0000000380)={0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="400d66000000660f820200ae44579496c86c6d449fc560ee6c4926185677f6e4d7277b9880d962c67c68b07782412849d1b6d21a1c8b6c133c71ad0f9969eb91fba3c94811b0549765c335f507cabb57450be9659d8a9d81785abcf780ec755ac0e78be0ffdfb81bcfab5f9b"], &(0x7f00000002c0)={0x0, 0x3, 0x86, @string={0x86, 0x3, "be7acffb2d12ee3612a7d0a1c71b3177df6e4236e4bdad53cb1423708c7ee3a6e1f76498f4b0c9d0bd2b04618dac0cbd97400a850c481008738b3d05ef4e1c56b4ea5c185c51ef22f7f643391d8f03d1e9b6ab76316bb6d40b08b533be831b9c165f4dc87635a1c314425ee1bd88a36209ea891d848a328a522b301415aa14bb377edd18"}}}, &(0x7f00000009c0)={0x2c, &(0x7f0000000780)={0x20, 0x31, 0x100, "775d33e7394feb433096a48c639c59cf9d4e22fd56071cc85adc22b07e66091f2b7cb8c7fbca69c230084d3dcbe0bf121e9ea803cf455e00abd7885d5388b3132ac450dfef5951b6c87ccbdfa276a752f60ca99b935cd73b1c106dfd1fbec359ebca301719b47b27975453efc95c7072969528d4ab394145fadf44ce9fbafd528db93473c7c51d873db2a8aa879e2feab486aa45ceafe9d9c2644aac4037444b17476c4f9320c99898a8a0580591d02c57a1af423887a7ab7b559c1550ce4ad036325cb51f119bf4c61e17fdcc8983a9d5fc248f48ce6f11f74f4cf0875e8cafab4f029e1d8836d9233b8ad33a60f7198e4c4e520504f04533b5c050a3a89219"}, &(0x7f00000008c0)={0x0, 0xa, 0x1, 0x2f}, &(0x7f0000000900)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000940)={0xc0, 0x5, 0x2, 'n\v'}, &(0x7f0000000980)={0x40, 0x5, 0x4, "b2ade4a4"}}) syz_usb_control_io$uac3(r0, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000580)={0x40, 0x31, 0x1, 'e'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x20000) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)='.', 0x1}], 0x1, 0x0, 0x0, 0x2400}, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async) r2 = syz_usb_connect$cdc_ncm(0x2, 0x7c, &(0x7f0000000200)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6a, 0x2, 0x1, 0x4, 0x40, 0xb, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "7d447d6401cd"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x2, 0x40, 0x6}, {0x6, 0x24, 0x1a, 0x3, 0x5}, [@mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x2, 0x3}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0x4}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x28, 0x2, 0x3, 0x70}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x3, 0x8, 0x1c}}}}}}}]}}, &(0x7f0000000d40)={0xa, &(0x7f0000000500)={0xa, 0x6, 0xef2638673f0ac57f, 0x9, 0x7, 0x1, 0xff, 0x1}, 0x4c, &(0x7f0000000a00)={0x5, 0xf, 0x4c, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "9f3b5b47e5b47c468957981e7b737ca6"}, @ss_container_id={0x14, 0x10, 0x4, 0xf, "8032368d12588a8d9902886289cc7beb"}, @ss_container_id={0x14, 0x10, 0x4, 0x7d, "ad56329e5d46574c33ec57615bf8afee"}, @wireless={0xb, 0x10, 0x1, 0xc, 0xc, 0x0, 0x3, 0x2, 0x8}]}, 0x5, [{0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x1004}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x3009}}, {0x9c, &(0x7f0000000b00)=@string={0x9c, 0x3, "fb8efc1589356caca738a112f8ebee482e75e5e6661a7ed3a42734c1dc60f56d126ed05e2f1c789651af9026755ce87f141d02197957cb8093d7d33186de0b7eddcdc8b0254ed9d356911d0abaf3d21f4ef4deb7ca93afd38fb84673da1e667bb36c18a807c39dd7b344a932ab8fcffdd7f3c54cc2a150047d632f7761986c55fe1e02f1f38e1baf9605270e22be5a69de42e3ed61a6f2612f4d"}}, {0x87, &(0x7f0000000bc0)=@string={0x87, 0x3, "f67cc87d631a13123b45d137c7f82de93bf6fd006b3bb79f31fa6b404cf3282789956489bd4d742dd1464185d6d6bed0d6c433e30f9297dd6c5d5513ea97db8a02d7967ac2b98c41138c1ec54d3ed9974ff946cdd89fe4ca1ebaf78bb9ac3e6d87ff41d356a9fcf8763eef90d5f410287c1402342bcc5816e88d418f204c014d7f387f8f10"}}, {0x4, &(0x7f0000000c80)=@lang_id={0x4, 0x3, 0x1801}}]}) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000e80)={0x14, &(0x7f0000000dc0)={0x0, 0x0, 0x73, {0x73, 0xa, "de18f69acd47a0393f1c1e21eaa6f3f3a4fd3a9f5bb9ead01f82e36786a922673c27440d19be53a74a37086a7c69c50e42330e6ab5a0864caee2b1809af3ce7eb9f0e044b6e0f7abc8ab2104d0d5e594b8e55075da3f1d348cde16f92917a27445f9149f8aa5f7ff784b3c3f69d77f8c96"}}, &(0x7f0000000e40)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001180)={0x44, &(0x7f0000000ec0)={0x40, 0x0, 0xca, "c736382094d16077decfa75ebd13613bb97d77a1acc8c125f3516d375e63bd1bd571d1695e62617c665e76ff8e2af5461324f5b4ee32660a5831f436c786272a630685c69ff883ccebf0d987dfcf61026e969aa6fc48970fbb7a98c5aa705dffa94ea9dc4cd72d414315d3755d2cdbbb3a4c9f7d1bd409a3c82b71d43fa2bfcc38ee39433d0b3710e5a2c991acbd5b1a9d785b2d82b678bf8486e0a8bde7782c8502a7337de3c402d840e55e1c986d9cf355ca9fde3a3df90806811c301d6e85fb3c6a3677f4eacaab0d"}, &(0x7f0000000fc0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000001000)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000001040)={0x20, 0x80, 0x1c, {0xad, 0x8, 0x4, 0x3, 0x0, 0x9, 0xfffa, 0xc951, 0x5, 0x80, 0x0, 0x7}}, &(0x7f0000001080)={0x20, 0x85, 0x4, 0x7}, &(0x7f00000010c0)={0x20, 0x83, 0x2}, &(0x7f0000001100)={0x20, 0x87, 0x2, 0x7fff}, &(0x7f0000001140)={0x20, 0x89, 0x2, 0x1}}) (async, rerun: 32) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x40045731, &(0x7f0000000000)) (async, rerun: 32) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000004c0)={0x34, &(0x7f0000000680)={0x20, 0x16, 0xdb, "97c7d440b13781e19f50c96d338bb377c2c2668358ea0357ab39e07938fda3e016382209f9e14417923ea0b5cad6fc6408b5f78c0b568c95f12fd55091e4424aaa9f12a2d8078597a010d648ebdf8aac857bfea755a8174f7492c94b8f0474321f54aa137540c647932ac326d1095af7fc8c31aac66e316943d7bc9d0b438b79e29bb254ea6a2f75cedb92dc3bba64e2df465ee08a5a9d5061b2b45bd3b4c517a00b8ee867b9aefe0effbd48924cff0438e96986d464f5757af9a4f04b201ad2f84b1be1e8d2f9f4a2de65a342f5a53c632f1db7e0cb36a3967709"}, &(0x7f0000000040)={0x0, 0xa, 0x1}, &(0x7f00000000c0)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000100)={0xc0, 0xa1, 0x4, 0x506b5785}, &(0x7f00000003c0)={0x40, 0xa0, 0x4, 0xecf}, &(0x7f0000000400)={0xc0, 0xa2, 0x2f, "f066eb231a32c5cfaaff8a2c296cb671a380a35845aaed2c9b85d3bce36e6e2e55b8961285728e2164929cd00917a2"}}) 1.38812765s ago: executing program 2 (id=640): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000a5f000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r9, 0x0) futex(0x0, 0xb, 0x2, 0x0, &(0x7f0000000080)=0x6, 0x4fffffb) 1.021332173s ago: executing program 2 (id=641): ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000200)=0x80000) syz_open_dev$video4linux(0x0, 0x3, 0x342c1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000600)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r2}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(0xffffffffffffffff, 0x3ba0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) setxattr$incfs_metadata(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), &(0x7f0000002680)="568fb1ce0f27271fd1ef8366a5f6833f642ff6f2eb031a44e602ac66b361a2145f915b2d8aa39abfeace90f4ad7e042073991d605210aecd1efd9b973e24bda44b79821e2b73950959890bba599a0b23572b53bb3a694ddb9e17442fc501df02d77572d34bdc347b3a3d67900f3f4f86cc9c30e8430f9bdab4a7c01c66eb9ac63fb7a475b1392309829cef8ccff4ea88f9ad68577bf4df48ae8df3fbcd6652e627407d2b22bf4d64af1c48dcf98a3cbeac1ae49bfd8651f7fac949be51335d0cf4206dd64cc47d0849c3f257164158d0d94765b577653573ec34fe65731565e9fa26b3a9ce8909808f463a66c431585256c7325ad74dbc8cef386ad372ae86f5c8dcc394ffa9f522e4487bf7ee57e1a62b2588a2225f6c5a9d421992d761cf79880649d4b57e946d2a476862f095bfd22f4ab26f6e34fc63216c58e4084f1d1c9d97297ec07a95", 0xff57, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x2}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0xcac) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x400102, 0x0) setsockopt$SO_J1939_FILTER(r8, 0x6b, 0x1, &(0x7f0000000100)=[{0x1, 0x0, {0x1, 0xf0, 0x2}, {0x1, 0x1, 0x2}, 0x2, 0x1}, {0x1, 0x0, {0x7906b2fa2658f7a5, 0x1, 0x2}, {0x0, 0xf1, 0x3}, 0x0, 0xdebb5fae46dec38d}, {0x3, 0x0, {0x0, 0xff}, {0x1, 0x0, 0x4}, 0xfd, 0x1}, {0x1, 0x3, {0x2, 0xf0, 0x2}, {0x2}, 0x1, 0xfe}, {0x3, 0x1, {0x2, 0xf0, 0x3}, {0x0, 0xff, 0x3}, 0x1, 0xfe}], 0xa0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 69.924371ms ago: executing program 3 (id=642): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) r0 = socket$inet6(0xa, 0x2, 0x0) close(0xffffffffffffffff) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/243, 0xf3}, 0xf338}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x5c}, 0xd}], 0x3fffe16, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) landlock_create_ruleset(0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 0s ago: executing program 1 (id=643): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r2, &(0x7f0000001080)=[{0xff, 0x9, 0x3, 0xfd, @time={0x0, 0x1}, {0x46, 0xfe}, {0xf}, @note={0x3, 0xb7, 0x10, 0xc2, 0x5}}], 0x1c) r3 = dup3(r1, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x22}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000bc0)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) kernel console output (not intermixed with test programs): led: -71 [ 158.374430][ T10] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 158.399410][ T10] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 158.416680][ T10] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 158.441938][ T10] input input9: Timeout waiting for response from device. [ 158.504838][ T10] usb 4-1: USB disconnect, device number 27 [ 158.668100][ T1218] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 158.841365][ T1218] usb 3-1: Using ep0 maxpacket: 8 [ 158.872454][ T1218] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 158.884352][ T1218] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.895266][ T1218] usb 3-1: Product: syz [ 158.899803][ T1218] usb 3-1: Manufacturer: syz [ 158.910147][ T1218] usb 3-1: SerialNumber: syz [ 158.927868][ T1218] usb 3-1: config 0 descriptor?? [ 159.088931][ T5834] usb 5-1: USB disconnect, device number 16 [ 159.166283][ T1218] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 159.232074][ T6995] sctp: [Deprecated]: syz.4.258 (pid 6995) Use of int in max_burst socket option. [ 159.232074][ T6995] Use struct sctp_assoc_value instead [ 159.443405][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.5.259'. [ 159.557991][ T5834] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 159.567713][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 159.739267][ T5834] usb 5-1: device descriptor read/64, error -71 [ 159.995041][ T5834] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 160.123266][ T7008] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 160.157819][ T5834] usb 5-1: device descriptor read/64, error -71 [ 160.309890][ T5834] usb usb5-port1: attempt power cycle [ 160.315217][ T1218] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 160.398110][ T1218] usb 3-1: USB disconnect, device number 14 [ 160.667908][ T5918] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 160.698083][ T5834] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 160.747336][ T5834] usb 5-1: device descriptor read/8, error -71 [ 160.848893][ T5918] usb 4-1: Using ep0 maxpacket: 8 [ 160.886543][ T5918] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 160.915377][ T5918] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 160.942108][ T5918] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.975237][ T5918] usb 4-1: Product: syz [ 160.992901][ T5918] usb 4-1: Manufacturer: syz [ 160.997596][ T5918] usb 4-1: SerialNumber: syz [ 161.008445][ T5834] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 161.051708][ T5918] usb 4-1: config 0 descriptor?? [ 161.071830][ T5834] usb 5-1: device descriptor read/8, error -71 [ 161.087907][ T5918] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 161.199185][ T5834] usb usb5-port1: unable to enumerate USB device [ 161.727720][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 162.477263][ T5918] gspca_zc3xx: reg_w_i err -71 [ 162.847857][ T5890] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 163.117796][ T5918] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 163.126238][ T5918] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 163.177037][ T7048] netlink: 4 bytes leftover after parsing attributes in process `syz.1.274'. [ 163.191265][ T5918] usb 4-1: USB disconnect, device number 28 [ 163.204354][ T7048] netlink: 'syz.1.274': attribute type 3 has an invalid length. [ 163.233647][ T5890] usb 5-1: device descriptor read/64, error -71 [ 163.350178][ T7046] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 163.540090][ T5890] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 163.729202][ T5890] usb 5-1: device descriptor read/64, error -71 [ 163.838197][ T5890] usb usb5-port1: attempt power cycle [ 164.617961][ T5890] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 164.713681][ T5890] usb 5-1: device descriptor read/8, error -71 [ 164.780415][ T7062] xt_cgroup: invalid path, errno=-2 [ 165.002600][ T5918] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 165.015828][ T5890] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 165.058474][ T5890] usb 5-1: device descriptor read/8, error -71 [ 165.127753][ T5920] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 165.231818][ T5890] usb usb5-port1: unable to enumerate USB device [ 165.564254][ T5918] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 165.633222][ T5918] usb 3-1: Duplicate descriptor for config 0 interface 0 altsetting 0, skipping [ 165.783922][ T5918] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 165.814427][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.827889][ T5920] usb 4-1: device descriptor read/64, error -71 [ 165.836460][ T5918] usb 3-1: Product: syz [ 165.872120][ T5918] usb 3-1: Manufacturer: syz [ 165.898393][ T5918] usb 3-1: SerialNumber: syz [ 165.919939][ T5918] usb 3-1: config 0 descriptor?? [ 165.947192][ T30] audit: type=1804 audit(1775682263.169:22): pid=7069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.279" name="/newroot/55/file1" dev="fuse" ino=1 res=1 errno=0 [ 166.147810][ T5920] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 166.237991][ T1218] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 166.288724][ T5920] usb 4-1: device descriptor read/64, error -71 [ 166.398237][ T5920] usb usb4-port1: attempt power cycle [ 166.409679][ T1218] usb 5-1: device descriptor read/64, error -71 [ 166.730457][ T1218] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 166.779984][ T5920] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 166.814060][ T5920] usb 4-1: device descriptor read/8, error -71 [ 166.897910][ T1218] usb 5-1: device descriptor read/64, error -71 [ 166.905515][ T5933] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 167.018486][ T1218] usb usb5-port1: attempt power cycle [ 167.038241][ T5933] usb 6-1: device descriptor read/64, error -71 [ 167.058870][ T5920] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 167.307813][ T5933] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 167.389356][ T1218] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 167.418805][ T1218] usb 5-1: device descriptor read/8, error -71 [ 167.457909][ T5933] usb 6-1: device descriptor read/64, error -71 [ 167.568478][ T5933] usb usb6-port1: attempt power cycle [ 167.667835][ T1218] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 167.695666][ T5920] usb 4-1: device descriptor read/8, error -71 [ 167.703275][ T1218] usb 5-1: device descriptor read/8, error -71 [ 167.818206][ T5920] usb usb4-port1: unable to enumerate USB device [ 167.828615][ T1218] usb usb5-port1: unable to enumerate USB device [ 167.958447][ T5933] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 168.014936][ T5918] usb 3-1: USB disconnect, device number 15 [ 168.078491][ T5933] usb 6-1: device descriptor read/8, error -71 [ 168.341912][ T5933] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 168.379044][ T5933] usb 6-1: device descriptor read/8, error -71 [ 168.538504][ T5933] usb usb6-port1: unable to enumerate USB device [ 169.728839][ T5911] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 169.895513][ T5911] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 169.947839][ T5834] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 169.967834][ T5911] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 170.012931][ T5911] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 170.040407][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.065050][ T5911] usb 5-1: Product: 㠷 [ 170.075485][ T5911] usb 5-1: Manufacturer: ఊ [ 170.089246][ T5911] usb 5-1: SerialNumber: ю [ 170.099532][ T5834] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 170.118100][ T5933] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 170.126164][ T5834] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 170.151157][ T5834] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 170.193132][ T5834] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 170.220386][ T5834] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 170.242526][ T7117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 170.250430][ T7117] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 170.259837][ T7117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 170.267305][ T7117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 170.290267][ T5834] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 170.316401][ T5834] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 170.330196][ T5834] usb 3-1: Product: syz [ 170.335928][ T5834] usb 3-1: Manufacturer: syz [ 170.349608][ T5834] cdc_wdm 3-1:1.0: skipping garbage [ 170.355260][ T5834] cdc_wdm 3-1:1.0: skipping garbage [ 170.364611][ T5933] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 170.415664][ T5933] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 170.459240][ T5933] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.489150][ T5834] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 170.514272][ T5834] cdc_wdm 3-1:1.0: Unknown control protocol [ 170.524120][ T5933] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 170.585544][ T5911] cdc_ncm 5-1:1.0: bind() failure [ 170.597818][ T5933] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 170.616914][ T5911] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 170.629174][ T1218] usb 3-1: USB disconnect, device number 16 [ 170.656389][ T5933] usb 6-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 170.680135][ T5911] cdc_ncm 5-1:1.1: bind() failure [ 170.715280][ T5933] usb 6-1: config 1 interface 1 has no altsetting 0 [ 170.728767][ T5911] usb 5-1: USB disconnect, device number 29 [ 170.771857][ T5933] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 170.818570][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.839790][ T5933] usb 6-1: Product: syz [ 170.847077][ T5933] usb 6-1: Manufacturer: syz [ 170.852049][ T5933] usb 6-1: SerialNumber: syz [ 170.875441][ T5933] cdc_ncm 6-1:1.0: skipping garbage [ 170.883925][ T5933] cdc_ncm 6-1:1.0: NCM or ECM functional descriptors missing [ 170.896178][ T5933] cdc_ncm 6-1:1.0: bind() failure [ 171.058195][ T5920] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 171.227768][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 171.237983][ T5920] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 171.255071][ T5920] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 171.270985][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.281904][ T5920] usb 2-1: Product: syz [ 171.294153][ T5920] usb 2-1: Manufacturer: syz [ 171.299454][ T5920] usb 2-1: SerialNumber: syz [ 171.399922][ T30] audit: type=1326 audit(1775682268.539:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 171.493273][ T5920] snd-ua101 2-1:1.1: sample format descriptor not found [ 171.562426][ T30] audit: type=1326 audit(1775682268.539:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 171.590241][ T5920] snd-ua101 2-1:1.0: invalid num_altsetting [ 171.614649][ T30] audit: type=1326 audit(1775682268.539:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 171.657589][ T30] audit: type=1326 audit(1775682268.539:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 171.711663][ T5920] usb 2-1: USB disconnect, device number 22 [ 171.870870][ T30] audit: type=1326 audit(1775682268.549:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 171.894386][ T30] audit: type=1326 audit(1775682268.549:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 172.117828][ T30] audit: type=1326 audit(1775682268.549:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 172.182897][ T30] audit: type=1326 audit(1775682268.549:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 172.259151][ T30] audit: type=1326 audit(1775682268.549:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 172.281932][ T30] audit: type=1326 audit(1775682268.549:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7105 comm="syz.5.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 172.766694][ T7141] netlink: 8 bytes leftover after parsing attributes in process `syz.4.300'. [ 173.259315][ T5920] usb 6-1: USB disconnect, device number 12 [ 173.594120][ T7158] hub 1-0:1.0: USB hub found [ 173.602305][ T7158] hub 1-0:1.0: 1 port detected [ 173.660274][ T5834] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 173.882175][ T5834] usb 4-1: config 8 has an invalid interface number: 223 but max is 0 [ 173.916703][ T5834] usb 4-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 173.976899][ T5834] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 174.066441][ T5834] usb 4-1: config 8 has no interface number 0 [ 174.095199][ T5834] usb 4-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 15872, setting to 64 [ 174.110017][ T5834] usb 4-1: config 8 interface 223 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 174.150695][ T5834] usb 4-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 174.276460][ T5834] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.305617][ T5834] usb 4-1: Product: syz [ 174.312946][ T5834] usb 4-1: Manufacturer: syz [ 174.480448][ T5834] usb 4-1: SerialNumber: syz [ 174.806193][ T7150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.815465][ T7150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.900730][ T5834] usb 4-1: USB disconnect, device number 33 [ 175.237968][ T5933] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 175.411492][ T5933] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 175.429452][ T5933] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 175.471424][ T5933] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 175.487929][ T5933] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 175.508755][ T5933] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 175.562384][ T5933] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 175.626382][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 175.647077][ T5933] usb 2-1: Product: syz [ 175.657404][ T5933] usb 2-1: Manufacturer: syz [ 175.710746][ T5933] cdc_wdm 2-1:1.0: skipping garbage [ 175.744770][ T5933] cdc_wdm 2-1:1.0: skipping garbage [ 175.782257][ T5933] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 175.791061][ T5933] cdc_wdm 2-1:1.0: Unknown control protocol [ 175.992729][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 176.001489][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 176.009003][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 176.015652][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 176.022454][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 176.029075][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 176.035720][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 176.042594][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 176.049126][ T5933] usb 2-1: USB disconnect, device number 23 [ 176.248804][ T7188] netlink: 20 bytes leftover after parsing attributes in process `syz.2.313'. [ 176.311296][ T5834] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 176.480070][ T5834] usb 5-1: too many endpoints for config 0 interface 0 altsetting 4: 129, using maximum allowed: 30 [ 176.491695][ T5834] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 176.503567][ T5834] usb 5-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 176.521635][ T5834] usb 5-1: config 0 interface 0 has no altsetting 0 [ 176.528880][ T5834] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0a51, bcdDevice= 0.00 [ 176.538981][ T5834] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.552448][ T5834] usb 5-1: config 0 descriptor?? [ 176.559206][ T7181] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 176.995817][ T7198] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.119927][ T7203] netlink: 64 bytes leftover after parsing attributes in process `syz.5.315'. [ 177.492330][ T7181] netlink: 8 bytes leftover after parsing attributes in process `syz.4.311'. [ 177.530914][ T5834] usbhid 5-1:0.0: can't add hid device: -71 [ 177.536975][ T5834] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 177.596845][ T5834] usb 5-1: USB disconnect, device number 30 [ 177.961655][ T7218] i2c i2c-0: dtv_property_process_set: SET cmd 0x4b54d78c undefined [ 178.169942][ T7228] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 178.193978][ T7228] netlink: 12 bytes leftover after parsing attributes in process `syz.4.324'. [ 178.211930][ T7227] netlink: 'syz.3.323': attribute type 14 has an invalid length. [ 178.258498][ T1218] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 178.450332][ T1218] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 179.101875][ T1218] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.112581][ T1218] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 179.145220][ T1218] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 179.275455][ T1218] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.309067][ T1218] usb 3-1: config 0 descriptor?? [ 179.372795][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 179.372818][ T30] audit: type=1326 audit(1775682276.599:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7238 comm="syz.3.327" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe8f979c819 code=0x0 [ 179.417801][ T5918] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 179.523872][ T30] audit: type=1326 audit(1775682276.749:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7243 comm="syz.1.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba4af9c819 code=0x7ffc0000 [ 179.555056][ T30] audit: type=1326 audit(1775682276.749:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7243 comm="syz.1.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fba4af9c819 code=0x7ffc0000 [ 179.630589][ T5918] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 179.639780][ T5918] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 179.655798][ T5918] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 179.684552][ T5918] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 179.725633][ T5918] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 179.776531][ T5918] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 179.797190][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 179.819707][ T5918] usb 6-1: Product: syz [ 179.837379][ T1218] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x4 [ 179.856789][ T5918] usb 6-1: Manufacturer: syz [ 179.901670][ T1218] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 179.967132][ T5918] cdc_wdm 6-1:1.0: skipping garbage [ 179.986519][ T5918] cdc_wdm 6-1:1.0: skipping garbage [ 180.012854][ T5918] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 180.033260][ T5918] cdc_wdm 6-1:1.0: Unknown control protocol [ 180.178671][ T5918] usb 6-1: USB disconnect, device number 13 [ 180.331974][ T7264] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 180.635163][ T7269] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 180.674248][ T7269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.335'. [ 180.757773][ T1218] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 180.818026][ T7269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.335'. [ 180.968078][ T1218] usb 4-1: device descriptor read/64, error -71 [ 181.147979][ T5834] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 181.267808][ T1218] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 181.368608][ T5834] usb 2-1: Using ep0 maxpacket: 32 [ 181.382788][ T5834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.394533][ T5834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.405125][ T5834] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 181.414446][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.417981][ T1218] usb 4-1: device descriptor read/64, error -71 [ 181.450893][ T5834] usb 2-1: config 0 descriptor?? [ 181.469779][ T5834] hub 2-1:0.0: USB hub found [ 181.548663][ T1218] usb usb4-port1: attempt power cycle [ 181.672936][ T7271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.684362][ T7271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.703947][ T7271] netlink: 20 bytes leftover after parsing attributes in process `syz.1.336'. [ 181.716610][ T5834] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 181.888544][ T1218] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 181.908471][ T1218] usb 4-1: device descriptor read/8, error -71 [ 181.922201][ T796] usb 3-1: USB disconnect, device number 17 [ 182.002337][ T5834] usbhid 2-1:0.0: can't add hid device: -71 [ 182.010793][ T5834] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 182.050243][ T5834] usb 2-1: USB disconnect, device number 24 [ 182.077859][ T5918] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 182.157860][ T1218] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 182.185282][ T1218] usb 4-1: device descriptor read/8, error -71 [ 182.227822][ T5918] usb 6-1: Using ep0 maxpacket: 32 [ 182.235562][ T5918] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 182.246823][ T5918] usb 6-1: config 0 has no interface number 0 [ 182.253410][ T5918] usb 6-1: config 0 interface 12 has no altsetting 0 [ 182.263347][ T5918] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 182.274486][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.287852][ T5918] usb 6-1: Product: syz [ 182.292122][ T5918] usb 6-1: Manufacturer: syz [ 182.298977][ T5918] usb 6-1: SerialNumber: syz [ 182.300894][ T1218] usb usb4-port1: unable to enumerate USB device [ 182.331505][ T5918] usb 6-1: config 0 descriptor?? [ 182.654085][ T5918] f81534 6-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 182.683925][ T5918] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 182.715282][ T5918] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 182.742402][ T5918] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 182.781300][ T5918] usb 6-1: USB disconnect, device number 14 [ 183.452104][ T5890] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 183.637831][ T5890] usb 6-1: Using ep0 maxpacket: 8 [ 183.647194][ T5890] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 183.678123][ T5890] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 183.707955][ T5890] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 183.732184][ T5890] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 183.748123][ T5890] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 183.760569][ T5890] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.780150][ T7306] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 183.862632][ T7307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.346'. [ 183.872171][ T7307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.346'. [ 184.025595][ T5890] usb 6-1: GET_CAPABILITIES returned 0 [ 184.043140][ T5890] usbtmc 6-1:16.0: can't read capabilities [ 184.134011][ T7309] netlink: 68 bytes leftover after parsing attributes in process `syz.2.347'. [ 184.239253][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.268610][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.277910][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.287254][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.301080][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.310283][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.322373][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.331636][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.340844][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.349945][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.363359][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.372642][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.381888][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.391220][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.409060][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.418248][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 184.614620][ T5933] usb 6-1: USB disconnect, device number 15 [ 184.897531][ T7341] netlink: 4 bytes leftover after parsing attributes in process `syz.4.352'. [ 185.180814][ T5890] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 185.198014][ T5911] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 185.216391][ T7346] capability: warning: `syz.4.355' uses 32-bit capabilities (legacy support in use) [ 185.378012][ T5911] usb 4-1: device descriptor read/64, error -71 [ 185.378680][ T5890] usb 2-1: Using ep0 maxpacket: 8 [ 185.437315][ T5890] usb 2-1: unable to get BOS descriptor or descriptor too short [ 185.458140][ T5890] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 983 [ 185.468682][ T5890] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 32 [ 185.581812][ T5890] usb 2-1: New USB device found, idVendor=0e41, idProduct=4246, bcdDevice= 0.40 [ 185.618221][ T5911] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 185.634583][ T5890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.663624][ T5890] usb 2-1: Product: syz [ 185.684494][ T5890] usb 2-1: Manufacturer: syz [ 185.711517][ T5890] usb 2-1: SerialNumber: syz [ 185.761477][ T5911] usb 4-1: device descriptor read/64, error -71 [ 185.780300][ T7336] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 185.788541][ T7336] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 185.818833][ T30] audit: type=1326 audit(1775682283.039:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 185.872597][ T30] audit: type=1326 audit(1775682283.039:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 185.897778][ T5834] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 185.904535][ T5911] usb usb4-port1: attempt power cycle [ 185.937362][ T30] audit: type=1326 audit(1775682283.069:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.010568][ T30] audit: type=1326 audit(1775682283.069:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.041597][ T7334] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 186.061810][ T5933] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 186.101935][ T30] audit: type=1326 audit(1775682283.069:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.127049][ T5834] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 186.138811][ T30] audit: type=1326 audit(1775682283.069:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.162619][ T30] audit: type=1326 audit(1775682283.069:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.186708][ T5834] usb 5-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 186.196702][ T5834] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.205047][ T30] audit: type=1326 audit(1775682283.069:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.227402][ T5834] usb 5-1: Product: syz [ 186.231713][ T5834] usb 5-1: Manufacturer: syz [ 186.236606][ T5834] usb 5-1: SerialNumber: syz [ 186.248772][ T30] audit: type=1326 audit(1775682283.069:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.279502][ T5834] usb 5-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 186.298923][ T5911] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 186.326937][ T30] audit: type=1326 audit(1775682283.069:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7361 comm="syz.5.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f653839c819 code=0x7ffc0000 [ 186.365063][ T5933] usb 3-1: Using ep0 maxpacket: 16 [ 186.370800][ T5911] usb 4-1: device descriptor read/8, error -71 [ 186.399522][ T5933] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 186.409584][ T5933] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 186.421047][ T5933] usb 3-1: Product: syz [ 186.425460][ T5933] usb 3-1: Manufacturer: syz [ 186.432183][ T5933] usb 3-1: SerialNumber: syz [ 186.446058][ T5933] usb 3-1: config 0 descriptor?? [ 186.458112][ T5920] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 186.610739][ T5911] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 186.627713][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 186.639669][ T5920] usb 6-1: config index 0 descriptor too short (expected 1068, got 27) [ 186.661824][ T5920] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 186.685352][ T5911] usb 4-1: device descriptor read/8, error -71 [ 186.700670][ T5834] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 186.794220][ T1218] usb 3-1: USB disconnect, device number 18 [ 186.800961][ T5911] usb usb4-port1: unable to enumerate USB device [ 186.864072][ T5834] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 186.894106][ T5834] usb 5-1: media controller created [ 186.923769][ T5920] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 186.966046][ T5920] usb 6-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9 [ 186.976752][ T5834] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 186.997432][ T5920] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.023256][ T5920] usb 6-1: Product: syz [ 187.041783][ T5920] usb 6-1: Manufacturer: syz [ 187.054333][ T5920] usb 6-1: SerialNumber: syz [ 187.085268][ T5920] usb 6-1: config 0 descriptor?? [ 187.315987][ T5911] usb 6-1: USB disconnect, device number 16 [ 187.515618][ T5911] usb 5-1: USB disconnect, device number 31 [ 187.646955][ T5890] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 187.655558][ T5890] usb 2-1: MIDIStreaming interface descriptor not found [ 187.778650][ T7373] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 187.807236][ T7373] netlink: 8 bytes leftover after parsing attributes in process `syz.1.361'. [ 187.830970][ T7373] netlink: 8 bytes leftover after parsing attributes in process `syz.1.361'. [ 187.886851][ T5890] usb 2-1: USB disconnect, device number 25 [ 188.060591][ T5964] udevd[5964]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 188.111609][ T5911] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 188.205004][ T7386] fuse: Unknown parameter 'n' [ 188.212921][ T7386] sg_write: data in/out 458722/56 bytes for SCSI command 0x0-- guessing data in; [ 188.212921][ T7386] program syz.4.368 not setting count and/or reply_len properly [ 188.278641][ T5911] usb 4-1: Using ep0 maxpacket: 32 [ 188.285986][ T5911] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 188.294622][ T1218] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 188.302507][ T5911] usb 4-1: config 0 has no interface number 0 [ 188.309633][ T5911] usb 4-1: config 0 interface 12 has no altsetting 0 [ 188.319142][ T5911] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 188.328488][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.336616][ T5911] usb 4-1: Product: syz [ 188.341154][ T5911] usb 4-1: Manufacturer: syz [ 188.345820][ T5911] usb 4-1: SerialNumber: syz [ 188.354761][ T5911] usb 4-1: config 0 descriptor?? [ 188.378050][ T5890] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 188.407852][ T5920] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 188.460416][ T1218] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 188.471990][ T1218] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 188.478247][ T5834] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 188.488747][ T1218] usb 6-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 188.502571][ T1218] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.514061][ T1218] usb 6-1: config 0 descriptor?? [ 188.527874][ T5890] usb 2-1: device descriptor read/64, error -71 [ 188.567820][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 188.575692][ T5920] usb 3-1: unable to get BOS descriptor or descriptor too short [ 188.585659][ T5920] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 188.596555][ T5920] usb 3-1: config 1 interface 0 altsetting 127 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 188.610348][ T5920] usb 3-1: config 1 interface 0 has no altsetting 0 [ 188.621230][ T5920] usb 3-1: New USB device found, idVendor=05ac, idProduct=0242, bcdDevice= 0.40 [ 188.630656][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.638862][ T5920] usb 3-1: Product: syz [ 188.643120][ T5920] usb 3-1: Manufacturer: syz [ 188.647825][ T5920] usb 3-1: SerialNumber: syz [ 188.662270][ T5834] usb 5-1: config 0 has an invalid interface number: 200 but max is 0 [ 188.671335][ T5920] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input10 [ 188.678306][ T5834] usb 5-1: config 0 has no interface number 0 [ 188.686818][ T5834] usb 5-1: config 0 interface 200 altsetting 2 has an endpoint descriptor with address 0xFB, changing to 0x8B [ 188.700542][ T5834] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 188.712057][ T5834] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x8B has invalid wMaxPacketSize 0 [ 188.725812][ T5834] usb 5-1: config 0 interface 200 has no altsetting 0 [ 188.739213][ T5834] usb 5-1: New USB device found, idVendor=0b57, idProduct=8520, bcdDevice=6d.39 [ 188.748632][ T5834] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.756708][ T5834] usb 5-1: Product: syz [ 188.761177][ T5834] usb 5-1: Manufacturer: syz [ 188.765836][ T5834] usb 5-1: SerialNumber: syz [ 188.774412][ T5834] usb 5-1: config 0 descriptor?? [ 188.779566][ T5890] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 188.862349][ T5179] bcm5974 3-1:1.0: could not read from device [ 188.874766][ T5920] bcm5974 3-1:1.0: could not read from device [ 188.887815][ T5179] bcm5974 3-1:1.0: could not read from device [ 188.904535][ T5920] input: failed to attach handler mousedev to device input10, error: -5 [ 188.918036][ T5890] usb 2-1: device descriptor read/64, error -71 [ 188.927314][ T5179] bcm5974 3-1:1.0: could not read from device [ 188.937226][ T7382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.948762][ T5179] bcm5974 3-1:1.0: could not read from device [ 188.960766][ T5920] usb 3-1: USB disconnect, device number 19 [ 188.969383][ T7382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.999056][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.010021][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.016949][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.026769][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.035056][ T5890] usb usb2-port1: attempt power cycle [ 189.042377][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.058927][ T5834] usb 5-1: USB disconnect, device number 32 [ 189.061220][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.081259][ T1218] isku 0003:1E7D:319C.0006: unknown main item tag 0x0 [ 189.112213][ T1218] isku 0003:1E7D:319C.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.5-1/input0 [ 189.398597][ T5920] usb 6-1: USB disconnect, device number 17 [ 189.408770][ T5890] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 189.438972][ T5890] usb 2-1: device descriptor read/8, error -71 [ 189.619257][ T7394] input: syz0 as /devices/virtual/input/input12 [ 189.687937][ T5890] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 189.699200][ T7391] binder: BINDER_SET_CONTEXT_MGR already set [ 189.719695][ T5890] usb 2-1: device descriptor read/8, error -71 [ 189.723491][ T7391] binder: 7390:7391 ioctl 4018620d 200000000100 returned -16 [ 189.780517][ T7391] pim6reg: entered allmulticast mode [ 189.788456][ T7397] pim6reg: left allmulticast mode [ 189.829502][ T5890] usb usb2-port1: unable to enumerate USB device [ 190.068673][ T7405] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 190.234268][ T5911] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 190.303006][ T7408] syzkaller0: entered promiscuous mode [ 190.337833][ T5911] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 190.347952][ T7408] syzkaller0: entered allmulticast mode [ 190.367350][ T5911] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 190.403936][ T5911] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 190.403991][ T7412] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 190.451253][ T5911] usb 4-1: USB disconnect, device number 42 [ 190.987784][ T5911] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 191.063037][ T30] kauditd_printk_skb: 82 callbacks suppressed [ 191.063060][ T30] audit: type=1326 audit(1775682288.289:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7424 comm="syz.5.379" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f653839c819 code=0x0 [ 191.169803][ T5911] usb 3-1: not running at top speed; connect to a high speed hub [ 191.193519][ T5911] usb 3-1: New USB device found, idVendor=041e, idProduct=30df, bcdDevice= 0.40 [ 191.204934][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.213092][ T5911] usb 3-1: Product: syz [ 191.217324][ T5911] usb 3-1: Manufacturer: syz [ 191.224469][ T5911] usb 3-1: SerialNumber: syz [ 191.859678][ T5911] usb 3-1: USB disconnect, device number 20 [ 192.074334][ T6062] udevd[6062]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 192.174180][ T7441] netlink: 4 bytes leftover after parsing attributes in process `syz.5.384'. [ 192.183859][ T7441] netlink: 4 bytes leftover after parsing attributes in process `syz.5.384'. [ 192.410066][ T7446] netlink: 'syz.4.386': attribute type 7 has an invalid length. [ 192.947844][ T5918] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 193.325796][ T5918] usb 4-1: Using ep0 maxpacket: 32 [ 193.349616][ T5918] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 193.359411][ T5918] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.367473][ T5918] usb 4-1: Product: syz [ 193.375371][ T7461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.389'. [ 193.389850][ T7459] fuse: Bad value for 'user_id' [ 193.404830][ T7459] fuse: Bad value for 'user_id' [ 193.494500][ T5918] usb 4-1: Manufacturer: syz [ 193.502434][ T5918] usb 4-1: SerialNumber: syz [ 193.754493][ T5918] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 193.762680][ T5918] usb 4-1: 2:1 : bogus bTerminalLink 23 [ 193.792673][ T5918] usb 4-1: unit 6 not found! [ 193.803666][ T5918] usb 4-1: unit 246 not found! [ 194.051085][ T5918] usb 4-1: USB disconnect, device number 43 [ 194.126583][ T6062] udevd[6062]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 194.230132][ T5834] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 194.431432][ T5834] usb 6-1: Using ep0 maxpacket: 16 [ 194.441142][ T5834] usb 6-1: config 16 has an invalid interface number: 103 but max is 0 [ 194.449514][ T7472] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 194.475196][ T5834] usb 6-1: config 16 has no interface number 0 [ 194.483123][ T5834] usb 6-1: config 16 interface 103 altsetting 247 has an invalid descriptor for endpoint zero, skipping [ 194.497407][ T5834] usb 6-1: config 16 interface 103 altsetting 247 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 194.510686][ T5834] usb 6-1: config 16 interface 103 has no altsetting 0 [ 194.530295][ T5834] usb 6-1: New USB device found, idVendor=2019, idProduct=ed01, bcdDevice=99.aa [ 194.545265][ T5834] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.575666][ T5834] usb 6-1: Product: syz [ 194.592821][ T5834] usb 6-1: Manufacturer: Њ [ 194.610226][ T5834] usb 6-1: SerialNumber: syz [ 194.647973][ T5890] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 194.778919][ T5918] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 194.812272][ T5890] usb 3-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 194.825335][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.835113][ T5890] usb 3-1: Product: syz [ 194.840001][ T5890] usb 3-1: Manufacturer: syz [ 194.845424][ T5890] usb 3-1: SerialNumber: syz [ 194.877055][ T5890] usb 3-1: config 0 descriptor?? [ 194.944096][ T796] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 194.952608][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.959595][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.966299][ T7466] kvm: requested 129066 ns i8254 timer period limited to 200000 ns [ 194.987811][ T5918] usb 4-1: Using ep0 maxpacket: 16 [ 195.002097][ T5918] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 195.020896][ T5918] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 195.034422][ T5918] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 195.044929][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.058157][ T5918] usb 4-1: config 0 descriptor?? [ 195.068700][ T5911] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 195.128351][ T796] usb 5-1: Using ep0 maxpacket: 16 [ 195.156957][ T796] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 195.190297][ T5890] usb 3-1: USB disconnect, device number 21 [ 195.197522][ T796] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 2047, setting to 1024 [ 195.241463][ T796] usb 5-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 195.262749][ T796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.280538][ T5834] usb 6-1: USB disconnect, device number 18 [ 195.296568][ T796] usb 5-1: Product: syz [ 195.311294][ T796] usb 5-1: Manufacturer: syz [ 195.323369][ T796] usb 5-1: SerialNumber: syz [ 195.485208][ T5918] microsoft 0003:045E:07DA.0007: ignoring exceeding usage max [ 195.501390][ T5918] HID 045e:07da: Invalid code 65791 type 1 [ 195.514514][ T5918] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0007/input/input13 [ 195.561196][ T7474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 195.571254][ T5918] microsoft 0003:045E:07DA.0007: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 195.597240][ T7474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.638258][ T980] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 195.701165][ T5920] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 195.767611][ T796] usb 5-1: USB disconnect, device number 33 [ 195.949180][ T5911] usb 4-1: USB disconnect, device number 44 [ 196.240545][ T5920] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 196.373133][ T7497] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 196.382827][ T10] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 196.391112][ T5920] usb 6-1: device descriptor read/64, error -71 [ 196.527946][ T796] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 196.608006][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 197.057998][ T5920] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 197.078023][ T10] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 197.086386][ T10] usb 3-1: config 0 has no interface number 0 [ 197.098402][ T49] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 197.115848][ T49] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 197.125630][ T10] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 197.140875][ T10] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 197.204264][ T5920] usb 6-1: device descriptor read/64, error -71 [ 197.225053][ T10] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 197.235241][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.251781][ T10] usb 3-1: Product: syz [ 197.256374][ T10] usb 3-1: Manufacturer: syz [ 197.261417][ T10] usb 3-1: SerialNumber: syz [ 197.277407][ T10] usb 3-1: config 0 descriptor?? [ 197.318334][ T5920] usb usb6-port1: attempt power cycle [ 197.397782][ T796] usb 2-1: Using ep0 maxpacket: 16 [ 197.411225][ T796] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 197.430754][ T796] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.447930][ T796] usb 2-1: config 1 has no interface number 0 [ 197.457900][ T796] usb 2-1: config 1 interface 105 altsetting 2 endpoint 0x3 has invalid wMaxPacketSize 0 [ 197.477821][ T796] usb 2-1: config 1 interface 105 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 197.491367][ T796] usb 2-1: config 1 interface 105 has no altsetting 0 [ 197.510076][ T796] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 197.519717][ T796] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 197.528015][ T5834] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 197.528581][ T10] radio-si470x 3-1:0.35: this is not a si470x device. [ 197.540009][ T796] usb 2-1: Product: syz [ 197.547526][ T796] usb 2-1: Manufacturer: syz [ 197.556508][ T796] usb 2-1: SerialNumber: syz [ 197.598966][ T10] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 197.622115][ T10] usb 3-1: USB disconnect, device number 22 [ 197.660198][ T5920] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 197.688549][ T5920] usb 6-1: device descriptor read/8, error -71 [ 197.707787][ T5834] usb 4-1: Using ep0 maxpacket: 32 [ 197.715234][ T5834] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.727815][ T5834] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.738423][ T5834] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 197.748347][ T5834] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.771591][ T5834] usb 4-1: config 0 descriptor?? [ 197.785797][ T796] aqc111 2-1:1.105: probe with driver aqc111 failed with error -22 [ 197.818042][ T1218] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 197.826943][ T5834] hub 4-1:0.0: USB hub found [ 197.856601][ T7503] netlink: 132 bytes leftover after parsing attributes in process `syz.4.402'. [ 197.927863][ T5920] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 197.968807][ T5920] usb 6-1: device descriptor read/8, error -71 [ 197.998000][ T796] usb 2-1: USB disconnect, device number 30 [ 198.091379][ T5920] usb usb6-port1: unable to enumerate USB device [ 198.142750][ T7513] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 198.273431][ T5834] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 198.308192][ T5834] usbhid 4-1:0.0: can't add hid device: -71 [ 198.325053][ T5834] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 198.374385][ T5834] usb 4-1: USB disconnect, device number 45 [ 198.427785][ T5920] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 198.556584][ T7527] netlink: 'syz.2.408': attribute type 1 has an invalid length. [ 198.807823][ T5834] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 198.989297][ T5834] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.016069][ T5834] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 199.137491][ T5834] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 199.192909][ T5834] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.201551][ T5834] usb 5-1: Product: syz [ 199.205789][ T5834] usb 5-1: Manufacturer: syz [ 199.265844][ T1218] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 199.300097][ T5834] usb 5-1: SerialNumber: syz [ 199.357162][ T7530] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 199.445780][ T1218] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.457553][ T1218] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.460671][ T7554] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 199.476603][ T1218] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 199.486981][ T1218] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 199.502523][ T1218] usb 4-1: Manufacturer: syz [ 199.521839][ T1218] usb 4-1: config 0 descriptor?? [ 200.220308][ T7560] syz_tun: entered promiscuous mode [ 200.229387][ T7560] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 200.592712][ T7563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.604420][ T7563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.617527][ T5834] cdc_ncm 5-1:1.0: bind() failure [ 200.648143][ T5834] usbtest 5-1:1.1: probe with driver usbtest failed with error -71 [ 200.654897][ T1218] uclogic 0003:256C:006D.0008: v1 frame probing failed: -71 [ 200.666678][ T1218] uclogic 0003:256C:006D.0008: failed probing parameters: -71 [ 200.680205][ T1218] uclogic 0003:256C:006D.0008: probe with driver uclogic failed with error -71 [ 200.686970][ T5834] usb 5-1: USB disconnect, device number 34 [ 200.713661][ T1218] usb 4-1: USB disconnect, device number 46 [ 200.817778][ T5911] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 200.967819][ T5911] usb 3-1: Using ep0 maxpacket: 32 [ 200.976369][ T5911] usb 3-1: config 1 interface 0 altsetting 6 endpoint 0x1 has invalid wMaxPacketSize 0 [ 200.986470][ T5911] usb 3-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 0 [ 200.996529][ T5911] usb 3-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 16 [ 201.006728][ T5911] usb 3-1: config 1 interface 0 has no altsetting 0 [ 201.015984][ T5911] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 201.029480][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.037558][ T5911] usb 3-1: Product: Ћ [ 201.041776][ T5911] usb 3-1: Manufacturer: щ [ 201.046337][ T5911] usb 3-1: SerialNumber: 숮㛘炑霺摇엄鮲␌罔⨏믟鐛饢ከᰯ⦡箸ՙ絡餜뾎摺墏ꊊ홀㝞落碠Ὶ笳ꮮ碵㜆췄섭ㅓ聤彶㴪蝫飑쎙㻁窐岘炖︜屪ꦿ툥 [ 201.095590][ T7564] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 201.178097][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 201.349775][ T7573] netlink: 68 bytes leftover after parsing attributes in process `syz.3.423'. [ 201.520937][ T7564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.533864][ T7563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.544228][ T7564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.553717][ T7563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.656961][ T5911] usblp 3-1:1.0: usblp0: USB Bidirectional printer dev 24 if 0 alt 6 proto 2 vid 0x0525 pid 0xA4A8 [ 201.678211][ T5834] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 201.707623][ T5911] usb 3-1: USB disconnect, device number 24 [ 201.742999][ T5911] usblp0: removed [ 201.773282][ T7583] netlink: 48 bytes leftover after parsing attributes in process `syz.2.426'. [ 201.829189][ T5834] usb 5-1: device descriptor read/64, error -71 [ 202.087937][ T5834] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 202.188093][ T5911] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 202.247807][ T5834] usb 5-1: device descriptor read/64, error -71 [ 202.337238][ T7588] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 202.348183][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 202.358171][ T5834] usb usb5-port1: attempt power cycle [ 202.360191][ T5911] usb 3-1: too many configurations: 231, using maximum allowed: 8 [ 202.383467][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 202.391662][ T5911] usb 3-1: can't read configurations, error -61 [ 202.518782][ T7595] bridge3: entered promiscuous mode [ 202.527909][ T5911] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 202.671795][ T7599] bridge0: port 3(hsr0) entered blocking state [ 202.679019][ T7599] bridge0: port 3(hsr0) entered disabled state [ 202.686558][ T7599] hsr0: entered allmulticast mode [ 202.692449][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 202.698793][ T5911] usb 3-1: too many configurations: 231, using maximum allowed: 8 [ 202.706832][ T7599] hsr_slave_0: entered allmulticast mode [ 202.714543][ T7599] hsr_slave_1: entered allmulticast mode [ 202.720669][ T5834] usb 5-1: new full-speed USB device number 37 using dummy_hcd [ 202.732523][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 202.740648][ T5911] usb 3-1: can't read configurations, error -61 [ 202.748593][ T5834] usb 5-1: device descriptor read/8, error -71 [ 202.749821][ T5911] usb usb3-port1: attempt power cycle [ 202.779069][ T7599] hsr0: entered promiscuous mode [ 202.786984][ T7599] bridge0: port 3(hsr0) entered blocking state [ 202.793845][ T7599] bridge0: port 3(hsr0) entered forwarding state [ 202.987758][ T5834] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 203.008436][ T5834] usb 5-1: device descriptor read/8, error -71 [ 203.118046][ T5834] usb usb5-port1: unable to enumerate USB device [ 203.147867][ T5911] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 203.188942][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 203.195363][ T5911] usb 3-1: too many configurations: 231, using maximum allowed: 8 [ 203.213184][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 203.221744][ T5911] usb 3-1: can't read configurations, error -61 [ 203.355217][ T7602] 8021q: adding VLAN 0 to HW filter on device bond1 [ 203.358569][ T5911] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 203.409639][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 203.415567][ T5911] usb 3-1: too many configurations: 231, using maximum allowed: 8 [ 203.427802][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 203.435461][ T5911] usb 3-1: can't read configurations, error -61 [ 203.446068][ T5911] usb usb3-port1: unable to enumerate USB device [ 203.537430][ T7605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.433'. [ 203.593488][ T7605] netlink: 'syz.1.433': attribute type 18 has an invalid length. [ 203.655336][ T7605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.433'. [ 203.773338][ T7611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.435'. [ 204.228852][ T5834] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 204.414439][ T5834] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 204.425846][ T5834] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 204.464817][ T5834] usb 2-1: New USB device found, idVendor=08b7, idProduct=8000, bcdDevice= 0.00 [ 204.497353][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 204.508486][ T5834] usb 2-1: SerialNumber: syz [ 204.813472][ T5834] usb 2-1: 0:2 : does not exist [ 204.963299][ T5834] usb 2-1: USB disconnect, device number 31 [ 205.061876][ T6052] udevd[6052]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 205.357836][ T5890] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 205.477598][ T7635] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 205.573056][ T5890] usb 4-1: Using ep0 maxpacket: 32 [ 205.594307][ T5890] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 205.607424][ T5890] usb 4-1: config 0 has no interface number 0 [ 205.634948][ T5890] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 205.845015][ T5890] usb 4-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 205.876767][ T5890] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 205.907372][ T5890] usb 4-1: config 0 interface 196 has no altsetting 0 [ 205.994052][ T5890] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 206.031924][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.057346][ T5890] usb 4-1: Product: syz [ 206.125597][ T5890] usb 4-1: Manufacturer: syz [ 206.135975][ T5890] usb 4-1: SerialNumber: syz [ 206.193552][ T5890] usb 4-1: config 0 descriptor?? [ 206.219287][ T7630] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 206.447916][ T5890] ipheth 4-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 206.476254][ T5890] ipheth 4-1:0.196: probe with driver ipheth failed with error -71 [ 206.552135][ T5890] usb 4-1: USB disconnect, device number 47 [ 207.007029][ T7636] hsr0: entered promiscuous mode [ 207.132318][ T7625] hsr0: left promiscuous mode [ 207.707757][ T5911] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 207.884645][ T7673] netlink: 24 bytes leftover after parsing attributes in process `syz.5.451'. [ 207.927971][ T5890] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 208.047924][ T5834] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 208.108619][ T5890] usb 5-1: config 1 has an invalid interface descriptor of length 8, skipping [ 208.117612][ T5890] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.149082][ T5890] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 208.158499][ T5890] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 60, changing to 7 [ 208.185202][ T5890] usb 5-1: New USB device found, idVendor=0499, idProduct=5008, bcdDevice= 0.40 [ 208.194850][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.203660][ T5890] usb 5-1: Product: syz [ 208.208292][ T5890] usb 5-1: Manufacturer: syz [ 208.213067][ T5890] usb 5-1: SerialNumber: syz [ 208.227784][ T5834] usb 2-1: Using ep0 maxpacket: 16 [ 208.249544][ T5834] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.261947][ T5834] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 208.285237][ T5834] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 208.296706][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.306449][ T5834] usb 2-1: Product: syz [ 208.310845][ T5834] usb 2-1: Manufacturer: syz [ 208.316476][ T5834] usb 2-1: SerialNumber: syz [ 208.629904][ T5834] usb 2-1: 0:2 : does not exist [ 208.682100][ T5834] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 208.699555][ T7685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.734747][ T7685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.858403][ T5834] usb 2-1: USB disconnect, device number 32 [ 209.070507][ T7689] netlink: 24 bytes leftover after parsing attributes in process `syz.2.453'. [ 209.238707][ T796] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 209.265764][ T6062] udevd[6062]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 209.438535][ T796] usb 4-1: Using ep0 maxpacket: 32 [ 209.464846][ T796] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 209.481880][ T796] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.502602][ T7693] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 209.526221][ T796] usb 4-1: config 0 descriptor?? [ 209.547178][ T796] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 209.617788][ T10] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 209.657904][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 209.780520][ T10] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 209.789097][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.799660][ T10] usb 6-1: config 0 has no interface number 0 [ 209.805957][ T10] usb 6-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice= 0.05 [ 209.862066][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.893907][ T10] usb 6-1: config 0 descriptor?? [ 209.938977][ T10] usb 6-1: bad CDC descriptors [ 209.980706][ T5834] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 210.157338][ T10] usb 6-1: USB disconnect, device number 24 [ 210.167890][ T5834] usb 2-1: Using ep0 maxpacket: 32 [ 210.200427][ T796] gspca_vc032x: reg_w err -71 [ 210.205440][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.213375][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.227692][ T5834] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 210.237394][ T5834] usb 2-1: config 0 has no interface number 0 [ 210.248648][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.255551][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.262027][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.268177][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.276149][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.283284][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.289973][ T5834] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 210.305356][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.314239][ T5834] usb 2-1: Product: syz [ 210.319261][ T5834] usb 2-1: Manufacturer: syz [ 210.324258][ T5834] usb 2-1: SerialNumber: syz [ 210.331608][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.341661][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.350601][ T5834] usb 2-1: config 0 descriptor?? [ 210.379547][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.394958][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.617226][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.626026][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.637163][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.664403][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.909791][ T5834] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 210.921209][ T5890] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 210.932236][ T5890] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 210.967833][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 210.997764][ T5834] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 211.018595][ T796] gspca_vc032x: I2c Bus Busy Wait 00 [ 211.024056][ T796] gspca_vc032x: Unknown sensor... [ 211.043354][ T5890] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 211.071081][ T796] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 211.138652][ T796] usb 4-1: USB disconnect, device number 48 [ 211.189342][ T7701] usb usb9: usbfs: process 7701 (syz.5.458) did not claim interface 0 before use [ 211.317564][ T7701] netlink: 14 bytes leftover after parsing attributes in process `syz.5.458'. [ 211.375704][ T5890] snd-usb-audio 5-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 211.445626][ T5890] usb 5-1: USB disconnect, device number 39 [ 211.485011][ T6052] udevd[6052]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 211.564127][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.589675][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.597495][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.652957][ T5834] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 211.680973][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.704265][ T5834] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 211.745922][ T5834] usb 2-1: USB disconnect, device number 33 [ 211.752407][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.767890][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.825660][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.847416][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.860722][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 211.876952][ T7707] netlink: 'syz.3.460': attribute type 3 has an invalid length. [ 212.268090][ T5834] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 212.340880][ T796] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 212.457757][ T5834] usb 2-1: Using ep0 maxpacket: 16 [ 212.471757][ T5834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.489143][ T5834] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 212.501759][ T5834] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.513473][ T5834] usb 2-1: config 0 descriptor?? [ 212.518685][ T796] usb 5-1: Using ep0 maxpacket: 32 [ 212.534326][ T796] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 212.551062][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.568571][ T796] usb 5-1: config 0 descriptor?? [ 212.604449][ T796] as10x_usb: device has been detected [ 212.620130][ T796] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 212.650523][ T796] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 212.690294][ T796] as10x_usb: error during firmware upload part1 [ 212.698109][ T10] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 212.714301][ T796] Registered device nBox DVB-T Dongle [ 212.728273][ T5920] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 212.747607][ T7727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.801112][ T7727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.828179][ T7732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.838890][ T7732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.855035][ T7727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.868618][ T7727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.878402][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 212.886212][ T10] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 212.895811][ T10] usb 4-1: config 0 has no interface number 0 [ 212.905313][ T10] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 212.916749][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.091627][ T796] usb 5-1: USB disconnect, device number 40 [ 213.127786][ T1218] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 213.145817][ T5920] usb 3-1: too many configurations: 146, using maximum allowed: 8 [ 213.189630][ T5920] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 213.196206][ T796] Unregistered device nBox DVB-T Dongle [ 213.206075][ T796] as10x_usb: device has been disconnected [ 213.247741][ T5920] usb 3-1: can't read configurations, error -61 [ 213.268782][ T10] usb 4-1: Product: syz [ 213.273045][ T10] usb 4-1: Manufacturer: syz [ 213.288316][ T10] usb 4-1: SerialNumber: syz [ 213.305689][ T10] usb 4-1: config 0 descriptor?? [ 213.329105][ T10] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 213.390923][ T1218] usb 6-1: Using ep0 maxpacket: 32 [ 213.397946][ T5920] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 213.424881][ T1218] usb 6-1: config index 0 descriptor too short (expected 6701, got 45) [ 213.437811][ T1218] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 213.457884][ T1218] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.646188][ T10] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 213.663902][ T10] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 213.679324][ T1218] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 213.690002][ T5920] usb 3-1: too many configurations: 146, using maximum allowed: 8 [ 213.708927][ T5920] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 213.717334][ T5920] usb 3-1: can't read configurations, error -61 [ 213.823640][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - port change to invalid port: 252 [ 213.836151][ T5920] usb usb3-port1: attempt power cycle [ 213.841813][ T1218] usb 6-1: config 0 interface 0 has no altsetting 0 [ 213.856981][ T1218] usb 6-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.9d [ 213.875405][ T1218] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.949520][ T1218] usb 6-1: config 0 descriptor?? [ 214.026740][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 214.028999][ T796] usb 4-1: USB disconnect, device number 49 [ 214.086857][ T796] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 214.195952][ T5920] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 214.209047][ T796] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 214.274462][ T796] quatech2 4-1:0.51: device disconnected [ 214.276100][ T5920] usb 3-1: too many configurations: 146, using maximum allowed: 8 [ 214.300964][ T5920] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 214.310285][ T5920] usb 3-1: can't read configurations, error -61 [ 214.316767][ T5834] usbhid 2-1:0.0: can't add hid device: -71 [ 214.334239][ T5834] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 214.425422][ T5834] usb 2-1: USB disconnect, device number 34 [ 214.467946][ T5920] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 214.493711][ T5920] usb 3-1: too many configurations: 146, using maximum allowed: 8 [ 214.513893][ T5920] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 214.528995][ T5920] usb 3-1: can't read configurations, error -61 [ 214.536287][ T5920] usb usb3-port1: unable to enumerate USB device [ 214.627844][ T5911] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 215.668880][ T5911] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 215.757963][ T5911] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.794707][ T5911] usb 5-1: config 0 descriptor?? [ 216.138339][ T7756] AppArmor: change_hat: Invalid input '0x000000000000000' [ 216.151198][ T5911] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 216.213437][ T7764] IPVS: stopping backup sync thread 7762 ... [ 216.297600][ T5911] [drm:udl_init] *ERROR* Selecting channel failed [ 216.416145][ T1218] usbhid 6-1:0.0: can't add hid device: -71 [ 216.547567][ T1218] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 216.599303][ T5911] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 216.631644][ T1218] usb 6-1: USB disconnect, device number 25 [ 216.643953][ T5911] [drm] Initialized udl on minor 2 [ 216.675694][ T5911] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 216.719271][ T5911] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 216.746312][ T10] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 216.765513][ T10] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 216.776976][ T5911] usb 5-1: USB disconnect, device number 41 [ 217.038049][ T1218] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 217.230349][ T1218] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 217.254399][ T1218] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 217.325968][ T1218] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 217.337151][ T1218] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.350295][ T7768] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 217.382027][ T1218] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 217.558323][ T10] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 217.613570][ T7768] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 217.710649][ T1218] usb 6-1: USB disconnect, device number 26 [ 217.719523][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 217.759929][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 217.806435][ T10] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 217.818608][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.837966][ T10] usb 4-1: config 0 descriptor?? [ 218.019104][ T7792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.085921][ T7792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.094287][ T7788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.104962][ T7788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.136184][ T7788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.246825][ T7788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.262940][ T5834] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 219.093218][ T7814] netlink: 16 bytes leftover after parsing attributes in process `syz.4.484'. [ 219.102309][ T7814] netlink: 4 bytes leftover after parsing attributes in process `syz.4.484'. [ 219.202083][ T7815] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 219.619352][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 219.627971][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 219.883500][ T10] usb 4-1: USB disconnect, device number 50 [ 219.961126][ T5920] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 220.199538][ T5920] usb 2-1: Using ep0 maxpacket: 16 [ 220.230541][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.257831][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.281071][ T5920] usb 2-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 220.322678][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.361837][ T5920] usb 2-1: config 0 descriptor?? [ 220.464223][ T7836] capability: warning: `syz.5.490' uses deprecated v2 capabilities in a way that may be insecure [ 220.803026][ T5920] bigben 0003:146B:0902.0009: unexpected rdesc, please submit for review [ 220.818651][ T5920] bigben 0003:146B:0902.0009: unknown main item tag 0x0 [ 220.916903][ T5920] bigben 0003:146B:0902.0009: unknown main item tag 0x0 [ 221.060186][ T5920] bigben 0003:146B:0902.0009: unknown main item tag 0x0 [ 221.187799][ T5920] bigben 0003:146B:0902.0009: unknown main item tag 0x0 [ 221.287354][ T5920] bigben 0003:146B:0902.0009: item fetching failed at offset 4/5 [ 221.322758][ T5920] bigben 0003:146B:0902.0009: parse failed [ 221.406990][ T5920] bigben 0003:146B:0902.0009: probe with driver bigben failed with error -22 [ 222.037818][ T5890] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 222.279835][ T5890] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 222.307931][ T5890] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 222.358050][ T5834] usb 2-1: USB disconnect, device number 35 [ 222.416536][ T5890] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 222.455250][ T5890] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 222.491285][ T5890] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 222.510780][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.539072][ T5890] usb 5-1: config 0 descriptor?? [ 222.685009][ T7860] ptrace attach of "./syz-executor exec"[5842] was attempted by " ./file0   8    \x09   /sys/kernel/debug/binder/stats cgroup.controllers [ 222.847960][ T5834] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 223.038444][ T5890] plantronics 0003:047F:FFFF.000A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 223.251393][ T5834] usb 2-1: Using ep0 maxpacket: 32 [ 223.262809][ T5834] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 223.274852][ T5834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 223.302822][ T5834] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 223.316860][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.438394][ T5834] usb 2-1: Product: syz [ 223.442846][ T5834] usb 2-1: Manufacturer: syz [ 223.451688][ T7875] netlink: 92 bytes leftover after parsing attributes in process `syz.5.498'. [ 223.500715][ T5834] usb 2-1: SerialNumber: syz [ 223.535714][ T5834] usb 2-1: config 0 descriptor?? [ 224.000588][ T5834] hub 2-1:0.0: bad descriptor, ignoring hub [ 224.015938][ T5834] hub 2-1:0.0: probe with driver hub failed with error -5 [ 224.044911][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.054080][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.066692][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.076070][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.267998][ T7855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.314795][ T5920] usb 5-1: USB disconnect, device number 43 [ 224.347280][ T7855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.498126][ T5911] usb 2-1: USB disconnect, device number 36 [ 225.207790][ T5911] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 225.370050][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.397874][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 225.424910][ T5911] usb 5-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 225.438742][ T7893] netlink: 12 bytes leftover after parsing attributes in process `syz.5.504'. [ 225.445021][ T5911] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.487820][ T7893] netlink: 40 bytes leftover after parsing attributes in process `syz.5.504'. [ 225.496917][ T7893] netlink: 588 bytes leftover after parsing attributes in process `syz.5.504'. [ 225.509065][ T5911] usb 5-1: config 0 descriptor?? [ 225.527877][ T5834] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 225.708267][ T5834] usb 4-1: device descriptor read/64, error -71 [ 225.724685][ T7893] sctp: [Deprecated]: syz.5.504 (pid 7893) Use of struct sctp_assoc_value in delayed_ack socket option. [ 225.724685][ T7893] Use struct sctp_sack_info instead [ 225.784290][ T7879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.810633][ T7879] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.967763][ T5834] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 226.046532][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.054108][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.061784][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.070262][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.080488][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.097806][ T5834] usb 4-1: device descriptor read/64, error -71 [ 226.103734][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.126201][ T5911] arvo 0003:1E7D:30D4.000B: unknown main item tag 0x0 [ 226.148434][ T5911] arvo 0003:1E7D:30D4.000B: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.4-1/input0 [ 226.213056][ T5834] usb usb4-port1: attempt power cycle [ 226.258330][ T5911] arvo 0003:1E7D:30D4.000B: couldn't init struct arvo_device [ 226.273606][ T5911] arvo 0003:1E7D:30D4.000B: couldn't install keyboard [ 226.340334][ T5911] arvo 0003:1E7D:30D4.000B: probe with driver arvo failed with error -71 [ 226.440430][ T5911] usb 5-1: USB disconnect, device number 44 [ 226.500400][ T7901] fido_id[7901]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 226.597953][ T5834] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 226.658623][ T5834] usb 4-1: device descriptor read/8, error -71 [ 226.937929][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 226.947930][ T5834] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 226.987011][ T5834] usb 4-1: device descriptor read/8, error -71 [ 227.099252][ T5834] usb usb4-port1: unable to enumerate USB device [ 227.158303][ T5919] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 227.298064][ T5834] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 227.319871][ T5919] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 227.331623][ T5919] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 227.345121][ T5919] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 227.354779][ T5919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.369439][ T7915] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 227.411860][ T5919] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 227.480733][ T5834] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 227.492541][ T5834] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.527950][ T5890] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 227.545192][ T5834] usb 6-1: config 0 descriptor?? [ 227.563419][ T5834] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 227.707921][ T5890] usb 3-1: Using ep0 maxpacket: 8 [ 227.716110][ T5919] usb 5-1: USB disconnect, device number 45 [ 227.732676][ T5890] usb 3-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 227.742793][ T5890] usb 3-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 227.751558][ T5890] usb 3-1: Product: syz [ 227.756242][ T5890] usb 3-1: Manufacturer: syz [ 227.762843][ T5890] usb 3-1: SerialNumber: syz [ 227.793499][ T5890] usb 3-1: config 0 descriptor?? [ 227.805174][ T5890] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 227.995952][ T5834] cpia1 6-1:0.0: unexpected state after lo power cmd: 00 [ 228.039245][ T7922] netlink: 4 bytes leftover after parsing attributes in process `syz.1.512'. [ 228.054289][ T7922] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.073067][ T7922] bridge_slave_1 (unregistering): left allmulticast mode [ 228.080387][ T7922] bridge_slave_1 (unregistering): left promiscuous mode [ 228.088136][ T7922] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.195967][ T7926] fuse: Unknown parameter '0x00000000000000040x0000000000000004' [ 228.277174][ T7928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.295998][ T7928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.414149][ T5890] input: gspca_zc3xx as /devices/platform/dummy_hcd.2/usb3/3-1/input/input16 [ 228.483904][ T7934] validate_nla: 42 callbacks suppressed [ 228.483929][ T7934] netlink: 'syz.4.516': attribute type 1 has an invalid length. [ 228.513523][ T5834] gspca_cpia1: usb_control_msg 02, error -32 [ 228.536074][ T5834] gspca_cpia1: usb_control_msg 02, error -71 [ 228.563424][ T5834] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 228.620845][ T7919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.622529][ T5834] usb 6-1: USB disconnect, device number 27 [ 228.640464][ T7919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.645988][ T7934] 8021q: adding VLAN 0 to HW filter on device bond1 [ 228.673205][ T7936] bond1: entered allmulticast mode [ 228.855948][ T5911] usb 3-1: USB disconnect, device number 33 [ 228.866621][ T7942] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 228.907287][ T7942] netlink: 32 bytes leftover after parsing attributes in process `syz.3.518'. [ 230.858343][ T5911] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 231.074988][ T7977] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 231.387956][ T30] audit: type=1326 audit(1775682328.489:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 231.577022][ T30] audit: type=1326 audit(1775682328.489:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 231.743686][ T30] audit: type=1326 audit(1775682328.489:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 231.944819][ T30] audit: type=1326 audit(1775682328.489:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 231.997502][ T30] audit: type=1326 audit(1775682328.489:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 232.205512][ T30] audit: type=1326 audit(1775682328.489:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 232.341411][ T30] audit: type=1326 audit(1775682328.489:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 232.477901][ T30] audit: type=1326 audit(1775682328.489:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 232.660678][ T30] audit: type=1326 audit(1775682328.489:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 232.807957][ T30] audit: type=1326 audit(1775682328.489:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7975 comm="syz.2.525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2f0559c819 code=0x7ffc0000 [ 233.265666][ T8003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.294302][ T8003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.458356][ T5920] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 233.618726][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 233.625900][ T5920] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 233.641271][ T5920] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 233.670195][ T5920] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 233.743119][ T5920] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 233.792947][ T5920] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 233.814920][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.839998][ T5920] usb 2-1: Product: syz [ 233.860112][ T5920] usb 2-1: Manufacturer: syz [ 233.871710][ T5920] usb 2-1: SerialNumber: syz [ 233.913493][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 234.031789][ T5920] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input17 [ 234.125855][ T5920] imon:send_packet: packet tx failed (-71) [ 234.158016][ T5920] imon 2-1:155.0: panel buttons/knobs setup failed [ 234.164665][ T5920] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 234.179842][ T5920] (id 0x00) [ 234.383498][ T5920] rc_core: IR keymap rc-imon-pad not found [ 234.396147][ T5920] Registered IR keymap rc-empty [ 234.404761][ T5920] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 234.432744][ T5920] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 234.436469][ T5920] imon:send_packet: packet tx failed (-71) [ 234.466448][ T5920] imon 2-1:155.0: remote input dev register failed [ 234.466581][ T5920] imon 2-1:155.0: imon_init_intf0: rc device setup failed [ 234.521753][ T8019] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 234.522659][ T5920] imon 2-1:155.0: unable to initialize intf0, err 0 [ 234.522676][ T5920] imon:imon_probe: failed to initialize context! [ 234.522687][ T5920] imon 2-1:155.0: unable to register, err -19 [ 234.587336][ T5920] usb 2-1: USB disconnect, device number 37 [ 234.927783][ T5890] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 235.087762][ T5890] usb 5-1: Using ep0 maxpacket: 16 [ 235.103617][ T5890] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.138020][ T5890] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 235.174158][ T5890] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 235.198119][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.227951][ T5890] usb 5-1: Product: syz [ 235.246405][ T5890] usb 5-1: Manufacturer: syz [ 235.263022][ T5890] usb 5-1: SerialNumber: syz [ 235.375535][ T8033] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 235.458172][ T5920] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 235.478016][ T8036] program syz.2.541 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 235.500798][ T5890] usb 5-1: 0:2 : does not exist [ 235.540319][ T5890] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 235.622624][ T5920] usb 2-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 1023 [ 235.657814][ T5920] usb 2-1: config 1 interface 0 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 235.709556][ T5890] usb 5-1: USB disconnect, device number 46 [ 235.715653][ T5920] usb 2-1: config 1 interface 0 has no altsetting 0 [ 235.762567][ T5920] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 235.802999][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.823213][ T6052] udevd[6052]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 235.870313][ T5920] usb 2-1: Product: 봠晽ᰁ럴駇탫⮤男쾺饺ᾁ﬉ꭝ㙛ު㦊笤⻍쒍੔ꇚ섧蘧듞捻뽋뎯萦䮁ڨ쏀ഖำࣴ줈紖ࡗ臨访치擞⅞㽧稭ӓ⊧쉨鋸甼帟쾵뺎鼍⠋矠䑇ᮦ跴댔㢃ȹ뫺頗 [ 236.188631][ T5920] usb 2-1: Manufacturer: ç몄⇖왢ﺆ䶈⏱ܰ셰蝍ᢕ錍졦䀔簩켤ℙ溋⣃ꏄ蹥훳䏧嵨崫ཽ⭰䙣옙惭拓ᦎ収苽⧰껳䴕᜹뱡ゑ跹钑ꀐ킌ẉꕄꏇ۳鰈㷛騥 [ 236.246577][ T5920] usb 2-1: SerialNumber: 㐣黎瘵苭墤䙤ᖤ㫍젅ᦱ쪬垡ꄱ輚코ઽ牎▌鹗쳿ঙ睈底Ḿ䏥擡⦠㾉ῐ블十ᥗ棶買唊珤ჾᔫÎᦐﺥ噣劦賓뗀Ấ㱅䕒揗⣰ᕥ퓎䠹ぶ邆fi恌层㷁ꩂℯ푄啀疧抷軑읦葔 [ 236.377208][ T8029] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 236.444519][ T8049] sctp: [Deprecated]: syz.4.546 (pid 8049) Use of int in max_burst socket option. [ 236.444519][ T8049] Use struct sctp_assoc_value instead [ 237.212918][ T5920] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 237.378394][ T5920] usb 2-1: USB disconnect, device number 38 [ 237.578444][ T8069] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 237.978308][ T8077] netlink: 'syz.3.551': attribute type 1 has an invalid length. [ 238.104561][ T8077] bond2: entered promiscuous mode [ 238.121787][ T8077] 8021q: adding VLAN 0 to HW filter on device bond2 [ 238.270581][ T8077] bond2: (slave bridge1): making interface the new active one [ 238.283217][ T8077] bridge1: entered promiscuous mode [ 238.297088][ T8077] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 239.527820][ T1218] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 239.609428][ T5920] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 239.703191][ T1218] usb 6-1: Using ep0 maxpacket: 8 [ 239.725241][ T1218] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.766705][ T1218] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 239.791656][ T1218] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.801546][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.813378][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 240.430747][ T1218] usb 6-1: config 0 descriptor?? [ 240.435903][ T5920] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 240.458003][ T1218] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 240.465206][ T5920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.497150][ T5920] usb 3-1: config 0 descriptor?? [ 240.925010][ T5920] cp2112 0003:10C4:EA90.000C: unknown main item tag 0x0 [ 240.976896][ T5920] cp2112 0003:10C4:EA90.000C: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 241.071068][ T1218] gspca_vc032x: reg_r err -32 [ 241.075107][ T8094] netlink: 14 bytes leftover after parsing attributes in process `syz.5.556'. [ 241.076302][ T1218] vc032x 6-1:0.0: probe with driver vc032x failed with error -32 [ 241.175603][ T5920] cp2112 0003:10C4:EA90.000C: error requesting version [ 241.237194][ T5920] cp2112 0003:10C4:EA90.000C: probe with driver cp2112 failed with error -32 [ 241.292452][ T8094] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 241.343705][ T8094] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 241.375577][ T8094] bond0 (unregistering): Released all slaves [ 241.393056][ T8096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.408352][ T8096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.486924][ T796] usb 3-1: USB disconnect, device number 35 [ 241.505073][ T1218] usb 6-1: USB disconnect, device number 28 [ 241.691030][ T3499] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.977069][ T3499] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.401669][ T3499] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.655309][ T8141] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 242.832257][ T5920] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 242.910953][ T8154] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.570'. [ 242.975818][ T3499] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.020237][ T5920] usb 5-1: unable to get BOS descriptor or descriptor too short [ 243.030229][ T5920] usb 5-1: config 1 interface 0 altsetting 252 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 243.065051][ T5920] usb 5-1: config 1 interface 0 has no altsetting 0 [ 243.087866][ T5920] usb 5-1: string descriptor 0 read error: -22 [ 243.101686][ T5920] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 243.129955][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.187997][ T1218] usb 4-1: new full-speed USB device number 55 using dummy_hcd [ 243.217820][ T8143] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 243.253198][ T5920] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 243.338548][ T1218] usb 4-1: device descriptor read/64, error -71 [ 243.440133][ T5890] usb 5-1: USB disconnect, device number 47 [ 243.573232][ T3499] bridge_slave_1: left allmulticast mode [ 243.588445][ T3499] bridge_slave_1: left promiscuous mode [ 243.599368][ T3499] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.627942][ T1218] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 243.698353][ T3499] bridge_slave_0: left allmulticast mode [ 243.767271][ T3499] bridge_slave_0: left promiscuous mode [ 243.785937][ T3499] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.827849][ T1218] usb 4-1: device descriptor read/64, error -71 [ 243.948708][ T1218] usb usb4-port1: attempt power cycle [ 244.405083][ T1218] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 244.549761][ T1218] usb 4-1: device descriptor read/8, error -71 [ 244.650103][ T5920] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 244.803416][ T1218] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 244.839737][ T1218] usb 4-1: device descriptor read/8, error -71 [ 244.848417][ T5920] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.979138][ T1218] usb usb4-port1: unable to enumerate USB device [ 245.012530][ T5920] usb 2-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 245.047445][ T3499] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 245.083674][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.103165][ T3499] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.128193][ T5920] usb 2-1: Product: syz [ 245.139501][ T3499] bond0 (unregistering): (slave team0): Releasing backup interface [ 245.154936][ T5920] usb 2-1: Manufacturer: syz [ 245.163473][ T3499] bond0 (unregistering): Released all slaves [ 245.174751][ T5920] usb 2-1: SerialNumber: syz [ 245.196947][ T5920] usb 2-1: config 0 descriptor?? [ 245.209529][ T8190] syz_tun: entered promiscuous mode [ 245.215716][ T8190] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 245.250274][ T5920] ljca 2-1:0.0: bulk endpoints not found [ 245.554366][ T8179] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 245.732787][ T5920] usb 2-1: USB disconnect, device number 39 [ 245.763922][ T3499] hsr_slave_0: left promiscuous mode [ 245.797359][ T3499] hsr_slave_1: left promiscuous mode [ 245.815470][ T3499] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.833760][ T3499] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.847164][ T3499] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.864578][ T3499] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.894246][ T3499] veth1_macvtap: left promiscuous mode [ 245.903735][ T3499] veth0_macvtap: left promiscuous mode [ 245.918605][ T3499] veth1_vlan: left promiscuous mode [ 245.927096][ T3499] veth0_vlan: left promiscuous mode [ 246.888028][ T796] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 247.018321][ T796] usb 6-1: device descriptor read/64, error -71 [ 247.268344][ T796] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 247.331794][ T3499] team0 (unregistering): Port device team_slave_1 removed [ 247.396538][ T8220] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 247.405436][ T796] usb 6-1: device descriptor read/64, error -71 [ 247.422067][ T3499] team0 (unregistering): Port device team_slave_0 removed [ 247.519016][ T796] usb usb6-port1: attempt power cycle [ 247.532467][ T8222] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 247.551829][ T8222] FAULT_INJECTION: forcing a failure. [ 247.551829][ T8222] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 247.569739][ T8222] CPU: 1 UID: 0 PID: 8222 Comm: syz.4.585 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.569780][ T8222] Tainted: [L]=SOFTLOCKUP [ 247.569788][ T8222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 247.569803][ T8222] Call Trace: [ 247.569812][ T8222] [ 247.569820][ T8222] dump_stack_lvl+0xe8/0x150 [ 247.569877][ T8222] should_fail_ex+0x412/0x560 [ 247.569916][ T8222] _copy_from_user+0x2d/0xb0 [ 247.569944][ T8222] ___sys_sendmsg+0x1c6/0x360 [ 247.569980][ T8222] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.570045][ T8222] ? __fget_files+0x2a/0x420 [ 247.570064][ T8222] ? __fget_files+0x3a0/0x420 [ 247.570091][ T8222] __x64_sys_sendmsg+0x1bd/0x2a0 [ 247.570121][ T8222] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 247.570154][ T8222] ? __pfx_ksys_write+0x10/0x10 [ 247.570186][ T8222] do_syscall_64+0x14d/0xf80 [ 247.570211][ T8222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.570228][ T8222] ? clear_bhb_loop+0x40/0x90 [ 247.570253][ T8222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.570275][ T8222] RIP: 0033:0x7f487f79c819 [ 247.570303][ T8222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.570321][ T8222] RSP: 002b:00007f48806bd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 247.570344][ T8222] RAX: ffffffffffffffda RBX: 00007f487fa15fa0 RCX: 00007f487f79c819 [ 247.570360][ T8222] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000006 [ 247.570373][ T8222] RBP: 00007f48806bd090 R08: 0000000000000000 R09: 0000000000000000 [ 247.570385][ T8222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.570397][ T8222] R13: 00007f487fa16038 R14: 00007f487fa15fa0 R15: 00007f487fb3fa48 [ 247.570429][ T8222] [ 248.037769][ T796] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 248.087895][ T796] usb 6-1: device descriptor read/8, error -71 [ 248.107783][ T10] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 248.259807][ T10] usb 5-1: device descriptor read/64, error -71 [ 248.337792][ T796] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 248.371634][ T796] usb 6-1: device descriptor read/8, error -71 [ 248.497832][ T796] usb usb6-port1: unable to enumerate USB device [ 248.580812][ T10] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 248.633825][ T8241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.589'. [ 248.679818][ T8239] netlink: 16 bytes leftover after parsing attributes in process `syz.2.588'. [ 248.690679][ T8239] netlink: 16 bytes leftover after parsing attributes in process `syz.2.588'. [ 248.874007][ T10] usb 5-1: device descriptor read/64, error -71 [ 249.003498][ T10] usb usb5-port1: attempt power cycle [ 250.023822][ T10] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 250.064998][ T10] usb 5-1: device descriptor read/8, error -71 [ 250.518232][ T10] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 250.595673][ T10] usb 5-1: device descriptor read/8, error -71 [ 250.728586][ T10] usb usb5-port1: unable to enumerate USB device [ 251.327859][ T10] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 251.532569][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 251.567363][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 251.632683][ T10] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 251.659557][ T10] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 251.676279][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.708041][ T10] usb 4-1: Product: syz [ 251.722553][ T10] usb 4-1: Manufacturer: syz [ 251.736346][ T10] usb 4-1: SerialNumber: syz [ 252.438035][ T10] usb 4-1: Cannot retrieve CPort count: -110 [ 252.444412][ T10] usb 4-1: Cannot retrieve CPort count: -110 [ 252.450951][ T10] es2_ap_driver 4-1:7.0: probe with driver es2_ap_driver failed with error -110 [ 252.552944][ T8285] netlink: 8 bytes leftover after parsing attributes in process `syz.3.595'. [ 252.636669][ T8285] netlink: 8 bytes leftover after parsing attributes in process `syz.3.595'. [ 253.168190][ T796] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 253.249179][ T5911] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 253.327908][ T796] usb 2-1: Using ep0 maxpacket: 16 [ 253.342518][ T796] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 253.357489][ T796] usb 2-1: config 0 has no interface number 0 [ 253.374247][ T796] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 253.412134][ T796] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 253.438230][ T5911] usb 6-1: Using ep0 maxpacket: 8 [ 253.447860][ T796] usb 2-1: config 0 interface 41 has no altsetting 0 [ 253.460440][ T5911] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 253.470896][ T796] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 253.490421][ T5911] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 253.527908][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.552693][ T5911] usb 6-1: New USB device found, idVendor=17cc, idProduct=0839, bcdDevice= 0.40 [ 253.572365][ T796] usb 2-1: Product: syz [ 253.586205][ T5911] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.587458][ T796] usb 2-1: Manufacturer: syz [ 253.631569][ T796] usb 2-1: SerialNumber: syz [ 253.643266][ T5911] usb 6-1: Product: syz [ 253.687041][ T5911] usb 6-1: Manufacturer: syz [ 253.694365][ T796] usb 2-1: config 0 descriptor?? [ 253.705823][ T5911] usb 6-1: SerialNumber: syz [ 253.728296][ T8300] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 253.746336][ T8300] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 253.993599][ T8302] netlink: 'syz.5.601': attribute type 63 has an invalid length. [ 254.030744][ T5911] usb 6-1: selecting invalid altsetting 1 [ 254.049049][ T5911] snd-usb-caiaq 6-1:1.0: can't set alt interface. [ 254.056015][ T5911] usb 6-1: unable to init card! (ret=-5) [ 254.081405][ T8316] loop5: detected capacity change from 0 to 7 [ 254.124220][ T5911] snd-usb-caiaq 6-1:1.0: probe with driver snd-usb-caiaq failed with error -5 [ 254.173892][ T10] usb 4-1: USB disconnect, device number 59 [ 254.227997][ T8316] Dev loop5: unable to read RDB block 7 [ 254.260060][ T8316] loop5: AHDI p1 p2 [ 254.297318][ T8316] loop5: partition table partially beyond EOD, truncated [ 254.372072][ T5911] usb 6-1: USB disconnect, device number 33 [ 254.400489][ T8316] loop5: p1 size 150995456 extends beyond EOD, truncated [ 254.453374][ T8300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.511009][ T8300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.536377][ T796] sr9700 2-1:0.41: probe with driver sr9700 failed with error -71 [ 254.578567][ T796] usb 2-1: USB disconnect, device number 40 [ 254.873841][ T8331] binder: BINDER_SET_CONTEXT_MGR already set [ 254.895953][ T8331] binder: 8322:8331 ioctl 4018620d 200000000040 returned -16 [ 254.936027][ T6062] udevd[6062]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 256.394286][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.402235][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.852853][ T8366] syzkaller0: entered promiscuous mode [ 256.858778][ T8366] syzkaller0: entered allmulticast mode [ 256.976843][ T8366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.615'. [ 257.117882][ T5911] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 257.218184][ T8376] netlink: 'syz.1.616': attribute type 1 has an invalid length. [ 257.297819][ T5911] usb 3-1: Using ep0 maxpacket: 32 [ 257.314717][ T5911] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.342042][ T5911] usb 3-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 257.362357][ T8376] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 257.384165][ T5911] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.461920][ T5911] usb 3-1: config 0 descriptor?? [ 257.642597][ T8385] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 257.756556][ T8385] FAULT_INJECTION: forcing a failure. [ 257.756556][ T8385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 257.812882][ T8385] CPU: 1 UID: 0 PID: 8385 Comm: syz.3.618 Tainted: G L syzkaller #0 PREEMPT(full) [ 257.812920][ T8385] Tainted: [L]=SOFTLOCKUP [ 257.812928][ T8385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 257.812942][ T8385] Call Trace: [ 257.812951][ T8385] [ 257.812961][ T8385] dump_stack_lvl+0xe8/0x150 [ 257.812998][ T8385] should_fail_ex+0x412/0x560 [ 257.813035][ T8385] _copy_from_iter+0x1d3/0x1670 [ 257.813063][ T8385] ? rcu_is_watching+0x15/0xb0 [ 257.813100][ T8385] ? __pfx__copy_from_iter+0x10/0x10 [ 257.813129][ T8385] ? netlink_sendmsg+0x650/0xb40 [ 257.813152][ T8385] ? skb_put+0x11b/0x210 [ 257.813180][ T8385] netlink_sendmsg+0x6c0/0xb40 [ 257.813211][ T8385] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.813237][ T8385] ? aa_sock_msg_perm+0xf1/0x1b0 [ 257.813281][ T8385] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 257.813310][ T8385] ____sys_sendmsg+0x972/0x9f0 [ 257.813347][ T8385] ? __pfx_____sys_sendmsg+0x10/0x10 [ 257.813385][ T8385] ? import_iovec+0x73/0xa0 [ 257.813413][ T8385] ___sys_sendmsg+0x2a5/0x360 [ 257.813444][ T8385] ? __pfx____sys_sendmsg+0x10/0x10 [ 257.813504][ T8385] ? __fget_files+0x2a/0x420 [ 257.813527][ T8385] ? __fget_files+0x3a0/0x420 [ 257.813556][ T8385] __x64_sys_sendmsg+0x1bd/0x2a0 [ 257.813588][ T8385] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 257.813625][ T8385] ? __pfx_ksys_write+0x10/0x10 [ 257.813661][ T8385] do_syscall_64+0x14d/0xf80 [ 257.813690][ T8385] ? trace_irq_disable+0x3b/0x150 [ 257.813708][ T8385] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.813731][ T8385] ? clear_bhb_loop+0x40/0x90 [ 257.813759][ T8385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.813780][ T8385] RIP: 0033:0x7fe8f979c819 [ 257.813803][ T8385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.813822][ T8385] RSP: 002b:00007fe8fa600028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.813844][ T8385] RAX: ffffffffffffffda RBX: 00007fe8f9a15fa0 RCX: 00007fe8f979c819 [ 257.813859][ T8385] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000006 [ 257.813871][ T8385] RBP: 00007fe8fa600090 R08: 0000000000000000 R09: 0000000000000000 [ 257.813884][ T8385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.813897][ T8385] R13: 00007fe8f9a16038 R14: 00007fe8f9a15fa0 R15: 00007fe8f9b3fa48 [ 257.813926][ T8385] [ 257.825605][ T5911] usbhid 3-1:0.0: can't add hid device: -71 [ 258.081916][ T5911] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 258.108804][ T5911] usb 3-1: USB disconnect, device number 36 [ 258.657890][ T10] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 258.813654][ T8408] openvswitch: netlink: VXLAN extension message has 16 unknown bytes. [ 258.823069][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 258.838417][ T10] usb 2-1: config 0 has an invalid interface number: 52 but max is 0 [ 258.857039][ T10] usb 2-1: config 0 has an invalid descriptor of length 97, skipping remainder of the config [ 258.876235][ T10] usb 2-1: config 0 has no interface number 0 [ 258.882717][ T5911] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 258.891117][ T10] usb 2-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 97, changing to 10 [ 258.913053][ T10] usb 2-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 24929, setting to 1024 [ 258.946182][ T10] usb 2-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 258.960107][ T10] usb 2-1: config 0 interface 52 has no altsetting 0 [ 258.969360][ T10] usb 2-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice= 0.00 [ 258.984433][ T10] usb 2-1: New USB device strings: Mfr=0, Product=234, SerialNumber=34 [ 258.994338][ T10] usb 2-1: Product: syz [ 258.999138][ T10] usb 2-1: SerialNumber: syz [ 259.014166][ T10] usb 2-1: config 0 descriptor?? [ 259.038208][ T5911] usb 3-1: device descriptor read/64, error -71 [ 259.271419][ T10] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.52/input/input20 [ 259.292171][ T5911] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 259.436371][ T8421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.448770][ T8421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.468219][ T5911] usb 3-1: device descriptor read/64, error -71 [ 259.550111][ T5834] usb 2-1: USB disconnect, device number 41 [ 259.550136][ C0] synaptics_usb 2-1:0.52: synusb_irq - usb_submit_urb failed with result: -19 [ 259.578311][ T5911] usb usb3-port1: attempt power cycle [ 259.595825][ T8420] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 259.937894][ T5911] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 259.980095][ T5911] usb 3-1: device descriptor read/8, error -71 [ 260.079180][ T5834] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 260.217991][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 260.228486][ T5911] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 260.237706][ T5834] usb 2-1: Using ep0 maxpacket: 32 [ 260.244835][ T5834] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 260.278558][ T5911] usb 3-1: device descriptor read/8, error -71 [ 260.292201][ T10] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 260.639631][ T5911] usb usb3-port1: unable to enumerate USB device [ 260.684451][ T5834] usb 2-1: config 0 has no interface number 0 [ 260.706317][ T5834] usb 2-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 260.728254][ T5834] usb 2-1: config 0 interface 89 has no altsetting 0 [ 260.743124][ T5834] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 260.757731][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.774836][ T5834] usb 2-1: Product: syz [ 260.786326][ T5834] usb 2-1: Manufacturer: syz [ 260.793135][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 260.802711][ T10] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 260.814127][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.822178][ T5834] usb 2-1: SerialNumber: syz [ 260.830935][ T10] usb 4-1: Product: syz [ 260.835301][ T10] usb 4-1: Manufacturer: syz [ 260.842440][ T10] usb 4-1: SerialNumber: syz [ 260.857230][ T5834] usb 2-1: config 0 descriptor?? [ 260.862417][ T10] usb 4-1: config 0 descriptor?? [ 260.877745][ T5918] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 260.888141][ T5834] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 260.902742][ T10] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 260.910026][ T5834] em28xx 2-1:0.89: Video interface 89 found: [ 261.059299][ T5918] usb 6-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 261.075476][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.091672][ T8435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.106398][ T8435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.118171][ T5918] usb 6-1: Product: syz [ 261.122457][ T5918] usb 6-1: Manufacturer: syz [ 261.134446][ T5918] usb 6-1: SerialNumber: syz [ 261.147061][ T5918] usb 6-1: config 0 descriptor?? [ 261.537882][ T5834] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 262.183565][ T5918] usb 6-1: f81604_read: reg: 100e failed: -EPIPE [ 262.324728][ T10] gspca_topro: reg_r err -71 [ 262.330732][ T10] gspca_topro: Sensor soi763a [ 262.385697][ T10] usb 4-1: USB disconnect, device number 60 [ 262.425429][ T8452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.436339][ T5834] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 262.447844][ T5834] em28xx 2-1:0.89: board has no eeprom [ 262.468347][ T8452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.527485][ T5834] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 262.543600][ T5834] em28xx 2-1:0.89: analog set to bulk mode. [ 262.559748][ T5890] em28xx 2-1:0.89: Registering V4L2 extension [ 262.618314][ T5834] usb 2-1: USB disconnect, device number 42 [ 262.645639][ T5834] em28xx 2-1:0.89: Disconnecting em28xx [ 262.780414][ T5890] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 262.818780][ T5890] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 262.836588][ T5918] usb 6-1: f81604_read: reg: 200e failed: -EPROTO [ 262.854240][ T5890] em28xx 2-1:0.89: No AC97 audio processor [ 262.876952][ T5918] usb 6-1: USB disconnect, device number 34 [ 262.920136][ T5890] usb 2-1: Decoder not found [ 262.934900][ T5890] em28xx 2-1:0.89: failed to create media graph [ 262.944827][ T5890] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 262.970388][ T5918] usb 6-1: f81604_read: reg: 100f failed: -ENODEV [ 263.062528][ T8462] ================================================================== [ 263.070866][ T8462] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 263.078312][ T8462] Read of size 8 at addr ffff88807c138790 by task v4l_id/8462 [ 263.085849][ T8462] [ 263.088221][ T8462] CPU: 1 UID: 0 PID: 8462 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 263.088252][ T8462] Tainted: [L]=SOFTLOCKUP [ 263.088260][ T8462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 263.088273][ T8462] Call Trace: [ 263.088282][ T8462] [ 263.088290][ T8462] dump_stack_lvl+0xe8/0x150 [ 263.088322][ T8462] print_report+0xba/0x230 [ 263.088346][ T8462] ? v4l2_fh_open+0xac/0x420 [ 263.088375][ T8462] kasan_report+0x117/0x150 [ 263.088403][ T8462] ? v4l2_fh_open+0xac/0x420 [ 263.088435][ T8462] v4l2_fh_open+0xac/0x420 [ 263.088464][ T8462] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 263.088496][ T8462] em28xx_v4l2_open+0x157/0x9a0 [ 263.088521][ T8462] ? do_raw_spin_lock+0x12b/0x2f0 [ 263.088546][ T8462] v4l2_open+0x1bf/0x3a0 [ 263.088580][ T8462] chrdev_open+0x4cd/0x5e0 [ 263.088608][ T8462] ? __pfx_chrdev_open+0x10/0x10 [ 263.088633][ T8462] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 263.088659][ T8462] ? __pfx_chrdev_open+0x10/0x10 [ 263.088683][ T8462] do_dentry_open+0x785/0x14e0 [ 263.088736][ T8462] vfs_open+0x3b/0x340 [ 263.088763][ T8462] ? path_openat+0x2df0/0x3860 [ 263.088786][ T8462] path_openat+0x2e08/0x3860 [ 263.088816][ T8462] ? __pfx_stack_trace_save+0x10/0x10 [ 263.088840][ T8462] ? stack_depot_save_flags+0x33/0x810 [ 263.088883][ T8462] ? __pfx_path_openat+0x10/0x10 [ 263.088904][ T8462] ? __x64_sys_openat+0x138/0x170 [ 263.088933][ T8462] ? do_syscall_64+0x14d/0xf80 [ 263.088960][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.088986][ T8462] ? __lock_acquire+0x6b5/0x2cf0 [ 263.089014][ T8462] do_file_open+0x23e/0x4a0 [ 263.089040][ T8462] ? __pfx_do_file_open+0x10/0x10 [ 263.089073][ T8462] ? _raw_spin_unlock+0x28/0x50 [ 263.089095][ T8462] ? alloc_fd+0x64b/0x6c0 [ 263.089129][ T8462] do_sys_openat2+0x113/0x200 [ 263.089160][ T8462] ? __pfx_do_sys_openat2+0x10/0x10 [ 263.089190][ T8462] ? exc_page_fault+0x6a/0xc0 [ 263.089218][ T8462] ? do_user_addr_fault+0xc6f/0x1340 [ 263.089247][ T8462] __x64_sys_openat+0x138/0x170 [ 263.089279][ T8462] do_syscall_64+0x14d/0xf80 [ 263.089305][ T8462] ? trace_irq_disable+0x3b/0x150 [ 263.089323][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.089343][ T8462] ? clear_bhb_loop+0x40/0x90 [ 263.089366][ T8462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.089386][ T8462] RIP: 0033:0x7f46808a7407 [ 263.089407][ T8462] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 263.089425][ T8462] RSP: 002b:00007ffc6159f1d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 263.089447][ T8462] RAX: ffffffffffffffda RBX: 00007f468081d880 RCX: 00007f46808a7407 [ 263.089463][ T8462] RDX: 0000000000000000 RSI: 00007ffc615a0f1d RDI: ffffffffffffff9c [ 263.089477][ T8462] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 263.089488][ T8462] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 263.089500][ T8462] R13: 00007ffc6159f420 R14: 00007f46810a1000 R15: 0000557705c8e4d8 [ 263.089524][ T8462] [ 263.089532][ T8462] [ 263.393715][ T8462] Allocated by task 5890: [ 263.398070][ T8462] kasan_save_track+0x3e/0x80 [ 263.402966][ T8462] __kasan_kmalloc+0x93/0xb0 [ 263.407582][ T8462] __kmalloc_cache_noprof+0x31c/0x660 [ 263.412997][ T8462] em28xx_v4l2_init+0x10b/0x2e70 [ 263.418170][ T8462] em28xx_init_extension+0x120/0x1c0 [ 263.423602][ T8462] process_scheduled_works+0xb6e/0x18c0 [ 263.429205][ T8462] worker_thread+0xa53/0xfc0 [ 263.433825][ T8462] kthread+0x388/0x470 [ 263.437907][ T8462] ret_from_fork+0x51e/0xb90 [ 263.442792][ T8462] ret_from_fork_asm+0x1a/0x30 [ 263.447591][ T8462] [ 263.449950][ T8462] Freed by task 5890: [ 263.453950][ T8462] kasan_save_track+0x3e/0x80 [ 263.458635][ T8462] kasan_save_free_info+0x46/0x50 [ 263.463680][ T8462] __kasan_slab_free+0x5c/0x80 [ 263.468573][ T8462] kfree+0x1c1/0x630 [ 263.472546][ T8462] em28xx_v4l2_init+0x1683/0x2e70 [ 263.477574][ T8462] em28xx_init_extension+0x120/0x1c0 [ 263.482923][ T8462] process_scheduled_works+0xb6e/0x18c0 [ 263.488521][ T8462] worker_thread+0xa53/0xfc0 [ 263.493124][ T8462] kthread+0x388/0x470 [ 263.497250][ T8462] ret_from_fork+0x51e/0xb90 [ 263.501849][ T8462] ret_from_fork_asm+0x1a/0x30 [ 263.506718][ T8462] [ 263.509055][ T8462] The buggy address belongs to the object at ffff88807c138000 [ 263.509055][ T8462] which belongs to the cache kmalloc-8k of size 8192 [ 263.523300][ T8462] The buggy address is located 1936 bytes inside of [ 263.523300][ T8462] freed 8192-byte region [ffff88807c138000, ffff88807c13a000) [ 263.537327][ T8462] [ 263.539672][ T8462] The buggy address belongs to the physical page: [ 263.546134][ T8462] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7c138 [ 263.555005][ T8462] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 263.563528][ T8462] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 263.571207][ T8462] page_type: f5(slab) [ 263.575324][ T8462] raw: 00fff00000000040 ffff88813fea7280 dead000000000100 dead000000000122 [ 263.584023][ T8462] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 263.592807][ T8462] head: 00fff00000000040 ffff88813fea7280 dead000000000100 dead000000000122 [ 263.601497][ T8462] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 263.610289][ T8462] head: 00fff00000000003 ffffea0001f04e01 00000000ffffffff 00000000ffffffff [ 263.618983][ T8462] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 263.627697][ T8462] page dumped because: kasan: bad access detected [ 263.634162][ T8462] page_owner tracks the page as allocated [ 263.639972][ T8462] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5479, tgid 5479 (S40network), ts 54981730294, free_ts 54973903736 [ 263.660554][ T8462] post_alloc_hook+0x231/0x280 [ 263.665341][ T8462] get_page_from_freelist+0x24dc/0x2580 [ 263.670907][ T8462] __alloc_frozen_pages_noprof+0x18d/0x380 [ 263.676833][ T8462] allocate_slab+0x77/0x660 [ 263.681381][ T8462] refill_objects+0x331/0x3c0 [ 263.686077][ T8462] __pcs_replace_empty_main+0x2e6/0x730 [ 263.691657][ T8462] __kmalloc_cache_noprof+0x392/0x660 [ 263.697041][ T8462] tomoyo_init_log+0x112e/0x1fb0 [ 263.701991][ T8462] tomoyo_supervisor+0x353/0x1570 [ 263.707029][ T8462] tomoyo_env_perm+0x151/0x1f0 [ 263.712081][ T8462] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 263.717742][ T8462] tomoyo_bprm_check_security+0x11b/0x180 [ 263.723509][ T8462] security_bprm_check+0x85/0x240 [ 263.728813][ T8462] bprm_execve+0x896/0x1460 [ 263.733326][ T8462] do_execveat_common+0x50d/0x690 [ 263.738371][ T8462] __x64_sys_execve+0x97/0xc0 [ 263.743071][ T8462] page last free pid 5478 tgid 5478 stack trace: [ 263.749415][ T8462] __free_frozen_pages+0xc2b/0xdb0 [ 263.754627][ T8462] __slab_free+0x263/0x2b0 [ 263.759145][ T8462] qlist_free_all+0x97/0x100 [ 263.763758][ T8462] kasan_quarantine_reduce+0x148/0x160 [ 263.769308][ T8462] __kasan_slab_alloc+0x22/0x80 [ 263.774256][ T8462] __kmalloc_noprof+0x316/0x760 [ 263.779116][ T8462] tomoyo_supervisor+0xc22/0x1570 [ 263.784240][ T8462] tomoyo_path_permission+0x25a/0x380 [ 263.789626][ T8462] tomoyo_path_perm+0x3f3/0x560 [ 263.794855][ T8462] security_inode_getattr+0x12b/0x310 [ 263.800340][ T8462] __x64_sys_newfstat+0x13b/0x270 [ 263.805428][ T8462] do_syscall_64+0x14d/0xf80 [ 263.810419][ T8462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.816358][ T8462] [ 263.818721][ T8462] Memory state around the buggy address: [ 263.824364][ T8462] ffff88807c138680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.832628][ T8462] ffff88807c138700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.840716][ T8462] >ffff88807c138780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.848795][ T8462] ^ [ 263.853394][ T8462] ffff88807c138800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.861492][ T8462] ffff88807c138880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.869669][ T8462] ================================================================== [ 263.883354][ T5890] em28xx 2-1:0.89: Registering snapshot button... [ 263.895722][ T5890] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input21 [ 263.951523][ T5890] em28xx 2-1:0.89: Remote control support is not available for this card. [ 263.956251][ T5490] usb 6-1: f81604_read: reg: 200f failed: -ENODEV [ 263.977165][ T5834] em28xx 2-1:0.89: Closing input extension [ 263.985253][ T5834] em28xx 2-1:0.89: Deregistering snapshot button [ 263.993661][ T8462] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 264.000948][ T8462] CPU: 1 UID: 0 PID: 8462 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 264.011605][ T8462] Tainted: [L]=SOFTLOCKUP [ 264.015979][ T8462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 264.026137][ T8462] Call Trace: [ 264.029730][ T8462] [ 264.032708][ T8462] vpanic+0x56c/0xa60 [ 264.036763][ T8462] ? __pfx_vpanic+0x10/0x10 [ 264.041358][ T8462] panic+0xc5/0xd0 [ 264.045403][ T8462] ? __pfx_panic+0x10/0x10 [ 264.049876][ T8462] ? preempt_schedule_thunk+0x16/0x30 [ 264.055393][ T8462] ? preempt_schedule_thunk+0x16/0x30 [ 264.060904][ T8462] ? v4l2_fh_open+0xac/0x420 [ 264.065570][ T8462] check_panic_on_warn+0x89/0xb0 [ 264.070553][ T8462] ? v4l2_fh_open+0xac/0x420 [ 264.075330][ T8462] end_report+0x73/0x180 [ 264.079723][ T8462] ? v4l2_fh_open+0xac/0x420 [ 264.084376][ T8462] kasan_report+0x128/0x150 [ 264.088962][ T8462] ? v4l2_fh_open+0xac/0x420 [ 264.093713][ T8462] v4l2_fh_open+0xac/0x420 [ 264.098192][ T8462] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 264.104329][ T8462] em28xx_v4l2_open+0x157/0x9a0 [ 264.109237][ T8462] ? do_raw_spin_lock+0x12b/0x2f0 [ 264.114318][ T8462] v4l2_open+0x1bf/0x3a0 [ 264.118624][ T8462] chrdev_open+0x4cd/0x5e0 [ 264.123274][ T8462] ? __pfx_chrdev_open+0x10/0x10 [ 264.128272][ T8462] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 264.134670][ T8462] ? __pfx_chrdev_open+0x10/0x10 [ 264.139870][ T8462] do_dentry_open+0x785/0x14e0 [ 264.144702][ T8462] vfs_open+0x3b/0x340 [ 264.148829][ T8462] ? path_openat+0x2df0/0x3860 [ 264.153741][ T8462] path_openat+0x2e08/0x3860 [ 264.158392][ T8462] ? __pfx_stack_trace_save+0x10/0x10 [ 264.163900][ T8462] ? stack_depot_save_flags+0x33/0x810 [ 264.169428][ T8462] ? __pfx_path_openat+0x10/0x10 [ 264.174487][ T8462] ? __x64_sys_openat+0x138/0x170 [ 264.179577][ T8462] ? do_syscall_64+0x14d/0xf80 [ 264.184400][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.190606][ T8462] ? __lock_acquire+0x6b5/0x2cf0 [ 264.195632][ T8462] do_file_open+0x23e/0x4a0 [ 264.200181][ T8462] ? __pfx_do_file_open+0x10/0x10 [ 264.205266][ T8462] ? _raw_spin_unlock+0x28/0x50 [ 264.210161][ T8462] ? alloc_fd+0x64b/0x6c0 [ 264.214545][ T8462] do_sys_openat2+0x113/0x200 [ 264.219372][ T8462] ? __pfx_do_sys_openat2+0x10/0x10 [ 264.224642][ T8462] ? exc_page_fault+0x6a/0xc0 [ 264.229385][ T8462] ? do_user_addr_fault+0xc6f/0x1340 [ 264.234724][ T8462] __x64_sys_openat+0x138/0x170 [ 264.239655][ T8462] do_syscall_64+0x14d/0xf80 [ 264.244564][ T8462] ? trace_irq_disable+0x3b/0x150 [ 264.249650][ T8462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.255771][ T8462] ? clear_bhb_loop+0x40/0x90 [ 264.260495][ T8462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.266515][ T8462] RIP: 0033:0x7f46808a7407 [ 264.270975][ T8462] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 264.290643][ T8462] RSP: 002b:00007ffc6159f1d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 264.299206][ T8462] RAX: ffffffffffffffda RBX: 00007f468081d880 RCX: 00007f46808a7407 [ 264.307319][ T8462] RDX: 0000000000000000 RSI: 00007ffc615a0f1d RDI: ffffffffffffff9c [ 264.315386][ T8462] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 264.323488][ T8462] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 264.331506][ T8462] R13: 00007ffc6159f420 R14: 00007f46810a1000 R15: 0000557705c8e4d8 [ 264.339532][ T8462] [ 264.343227][ T8462] Kernel Offset: disabled [ 264.347569][ T8462] Rebooting in 86400 seconds..