3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x600000000000000}, 0x0) 04:04:33 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 04:04:33 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:33 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 853.359356][ T1886] usb 1-1: USB disconnect, device number 21 04:04:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x700000000000000}, 0x0) [ 853.441284][T11108] input: syz1 as /devices/virtual/input/input58 04:04:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 04:04:33 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x800000000000000}, 0x0) 04:04:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) [ 853.642754][T11131] input: syz1 as /devices/virtual/input/input59 04:04:34 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 853.723216][ T8639] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 853.768260][T11142] input: syz1 as /devices/virtual/input/input60 [ 853.843061][ T1886] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 854.083173][ T8639] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 854.094612][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 854.107356][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 854.117962][ T8639] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 854.132594][ T8639] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 854.142535][ T8639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.152793][ T8639] usb 3-1: config 0 descriptor?? [ 854.213699][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 854.222675][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 854.236452][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 854.247126][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 854.393155][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 854.402398][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 854.412865][ T1886] usb 1-1: Product: syz [ 854.418231][ T1886] usb 1-1: Manufacturer: syz [ 854.463841][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 854.469256][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 854.487948][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 854.693028][ T8639] usbhid 3-1:0.0: can't add hid device: -71 [ 854.699538][ T8639] usbhid: probe of 3-1:0.0 failed with error -71 [ 854.714043][ T8639] usb 3-1: USB disconnect, device number 41 [ 855.022989][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 855.042987][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:04:36 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000100)=""/110, 0x6e) 04:04:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x900000000000000}, 0x0) 04:04:36 executing program 3: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 04:04:36 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:36 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:36 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 856.583923][ T8639] usb 1-1: USB disconnect, device number 22 04:04:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xa00000000000000}, 0x0) 04:04:37 executing program 3: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) [ 856.679234][T11194] input: syz1 as /devices/virtual/input/input61 04:04:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xb00000000000000}, 0x0) 04:04:37 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:37 executing program 3: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 04:04:37 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 856.938157][T21262] usb 3-1: new high-speed USB device number 42 using dummy_hcd 04:04:37 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000100)=""/110, 0x6e) 04:04:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xc00000000000000}, 0x0) 04:04:37 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:37 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 857.313742][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 857.329105][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 857.346140][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 857.359377][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 857.380601][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 857.391859][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 857.414290][T21262] usb 3-1: config 0 descriptor?? 04:04:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xd00000000000000}, 0x0) [ 857.963124][T21262] usbhid 3-1:0.0: can't add hid device: -71 [ 857.969455][T21262] usbhid: probe of 3-1:0.0 failed with error -71 [ 857.978601][T21262] usb 3-1: USB disconnect, device number 42 04:04:38 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) 04:04:38 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) 04:04:38 executing program 5: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 04:04:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xe00000000000000}, 0x0) 04:04:38 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000100)=""/110, 0x6e) 04:04:38 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:38 executing program 5: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 04:04:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xf00000000000000}, 0x0) 04:04:38 executing program 5: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 04:04:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1000000000000000}, 0x0) 04:04:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1100000000000000}, 0x0) 04:04:39 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 858.743034][ T4901] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 859.143111][ T4901] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 859.154378][ T4901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 859.169051][ T4901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 859.180111][ T4901] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 859.194341][ T4901] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 859.205613][ T4901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.217626][ T4901] usb 3-1: config 0 descriptor?? [ 859.763061][ T4901] usbhid 3-1:0.0: can't add hid device: -71 [ 859.769285][ T4901] usbhid: probe of 3-1:0.0 failed with error -71 [ 859.783128][ T4901] usb 3-1: USB disconnect, device number 43 04:04:40 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) 04:04:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1200000000000000}, 0x0) 04:04:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:40 executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:40 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:40 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) 04:04:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1300000000000000}, 0x0) 04:04:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1400000000000000}, 0x0) 04:04:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1500000000000000}, 0x0) [ 860.528851][ T4901] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 860.574787][T21202] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 860.933610][ T4901] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 860.942616][ T4901] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 860.955327][ T4901] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 860.966325][ T4901] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 860.978817][T21202] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 860.989955][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 861.003437][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 861.015406][T21202] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 861.029664][T21202] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 861.040326][T21202] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.072676][T21202] usb 3-1: config 0 descriptor?? [ 861.135604][ T4901] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 861.154025][ T4901] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 861.170903][ T4901] usb 1-1: Product: syz [ 861.177207][ T4901] usb 1-1: Manufacturer: syz [ 861.243800][ T4901] cdc_wdm 1-1:1.0: skipping garbage [ 861.255225][ T4901] cdc_wdm 1-1:1.0: skipping garbage [ 861.275631][ T4901] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 861.593090][T21202] usbhid 3-1:0.0: can't add hid device: -71 [ 861.599706][T21202] usbhid: probe of 3-1:0.0 failed with error -71 [ 861.613214][T21202] usb 3-1: USB disconnect, device number 44 04:04:42 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) 04:04:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1600000000000000}, 0x0) 04:04:42 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 862.152978][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 862.353063][ T8639] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 862.713089][ T8639] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 862.724635][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 862.736885][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 862.746870][ T8639] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 862.760930][ T8639] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 862.770164][ T8639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.780042][ T8639] usb 3-1: config 0 descriptor?? [ 863.323053][ T8639] usbhid 3-1:0.0: can't add hid device: -71 [ 863.329446][ T8639] usbhid: probe of 3-1:0.0 failed with error -71 [ 863.344762][ T8639] usb 3-1: USB disconnect, device number 45 04:04:44 executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:44 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:44 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) 04:04:44 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1700000000000000}, 0x0) [ 863.696017][ T1881] usb 1-1: USB disconnect, device number 23 04:04:44 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) 04:04:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1800000000000000}, 0x0) 04:04:44 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1900000000000000}, 0x0) 04:04:44 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1a00000000000000}, 0x0) 04:04:44 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 864.133001][T21262] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 864.213132][ T1881] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 864.543063][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 864.554690][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 864.573507][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 864.577901][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 864.594671][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 864.603920][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 864.617970][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 864.627746][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 864.627761][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.645613][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 864.657338][T21262] usb 3-1: config 0 descriptor?? [ 864.773266][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 864.782779][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 864.792066][ T1881] usb 1-1: Product: syz [ 864.796307][ T1881] usb 1-1: Manufacturer: syz [ 864.843935][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 864.849318][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 864.867898][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 865.193108][T21262] usbhid 3-1:0.0: can't add hid device: -71 [ 865.199348][T21262] usbhid: probe of 3-1:0.0 failed with error -71 [ 865.208805][T21262] usb 3-1: USB disconnect, device number 46 [ 865.762982][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:04:47 executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1b00000000000000}, 0x0) 04:04:47 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:47 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:47 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:47 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 867.354827][ T1886] usb 1-1: USB disconnect, device number 24 04:04:47 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1c00000000000000}, 0x0) 04:04:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1d00000000000000}, 0x0) 04:04:47 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1e00000000000000}, 0x0) [ 867.627339][T11495] input: syz1 as /devices/virtual/input/input74 04:04:48 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 867.723087][ T4901] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 867.784382][T11504] input: syz1 as /devices/virtual/input/input75 [ 867.873067][ T1886] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 868.113120][ T4901] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 868.124209][ T4901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 868.136264][ T4901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 868.146253][ T4901] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 868.160169][ T4901] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 868.169418][ T4901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 868.181150][ T4901] usb 3-1: config 0 descriptor?? [ 868.243046][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 868.251848][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 868.263599][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 868.273523][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 868.403089][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 868.412432][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 868.422047][ T1886] usb 1-1: Product: syz [ 868.426856][ T1886] usb 1-1: Manufacturer: syz [ 868.473905][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 868.479313][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 868.494383][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 868.733206][ T4901] usbhid 3-1:0.0: can't add hid device: -71 [ 868.739417][ T4901] usbhid: probe of 3-1:0.0 failed with error -71 [ 868.747827][ T4901] usb 3-1: USB disconnect, device number 47 [ 869.383003][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:04:51 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x1f00000000000000}, 0x0) 04:04:51 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:51 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:51 executing program 0: write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:51 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 870.925681][ T1881] usb 1-1: USB disconnect, device number 25 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2000000000000000}, 0x0) [ 871.038937][T11560] input: syz1 as /devices/virtual/input/input76 04:04:51 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2100000000000000}, 0x0) 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2200000000000000}, 0x0) 04:04:51 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 871.169897][T11574] input: syz1 as /devices/virtual/input/input77 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2300000000000000}, 0x0) [ 871.263082][T21202] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 871.301126][T11585] input: syz1 as /devices/virtual/input/input78 04:04:51 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2400000000000000}, 0x0) [ 871.386660][ T1881] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 871.392069][T11594] input: syz1 as /devices/virtual/input/input79 [ 871.654304][T21202] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 871.666750][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 871.685321][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 871.696420][T21202] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 871.711342][T21202] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 871.721471][T21202] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.734060][T21202] usb 3-1: config 0 descriptor?? 04:04:52 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:52 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 871.753604][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 871.762406][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 871.779425][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 871.789614][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 871.858999][T11611] input: syz1 as /devices/virtual/input/input80 [ 871.933355][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 871.942598][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 871.981078][ T1881] usb 1-1: Product: syz [ 871.987428][ T1881] usb 1-1: Manufacturer: syz [ 872.033994][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 872.039250][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 872.054577][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 872.273044][T21202] usbhid 3-1:0.0: can't add hid device: -71 [ 872.279428][T21202] usbhid: probe of 3-1:0.0 failed with error -71 [ 872.289258][T21202] usb 3-1: USB disconnect, device number 48 [ 872.942983][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:04:54 executing program 0: write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2500000000000000}, 0x0) 04:04:54 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:54 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:54 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 874.483492][ T8639] usb 1-1: USB disconnect, device number 26 04:04:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2600000000000000}, 0x0) [ 874.564825][T11657] input: syz1 as /devices/virtual/input/input81 04:04:54 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2700000000000000}, 0x0) [ 874.607138][T11671] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:04:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2800000000000000}, 0x0) [ 874.665226][T11677] input: syz1 as /devices/virtual/input/input82 04:04:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2900000000000000}, 0x0) [ 874.776189][T11687] input: syz1 as /devices/virtual/input/input83 [ 874.813062][ T1881] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 874.943078][ T8639] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 875.183057][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 875.195140][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 875.207301][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 875.217146][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 875.230610][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 875.240185][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.252580][ T1881] usb 3-1: config 0 descriptor?? [ 875.313521][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 875.322366][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 875.336975][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 875.359285][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 875.483455][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 875.493877][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 875.502095][ T8639] usb 1-1: Product: syz [ 875.510937][ T8639] usb 1-1: Manufacturer: syz [ 875.553886][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 875.559817][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 875.574229][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 875.793045][ T1881] usbhid 3-1:0.0: can't add hid device: -71 [ 875.799840][ T1881] usbhid: probe of 3-1:0.0 failed with error -71 [ 875.813720][ T1881] usb 3-1: USB disconnect, device number 49 [ 876.472986][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:04:58 executing program 0: write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:04:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2a00000000000000}, 0x0) 04:04:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:04:58 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:04:58 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 878.014000][ T1881] usb 1-1: USB disconnect, device number 27 04:04:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2b00000000000000}, 0x0) [ 878.111191][T11746] input: syz1 as /devices/virtual/input/input84 04:04:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 878.156274][T11759] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:04:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2c00000000000000}, 0x0) 04:04:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2d00000000000000}, 0x0) [ 878.216036][T11765] input: syz1 as /devices/virtual/input/input85 04:04:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:04:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2e00000000000000}, 0x0) [ 878.373438][ T1886] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 878.377969][T11778] input: syz1 as /devices/virtual/input/input86 [ 878.453043][ T1881] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 878.743071][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 878.754457][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 878.769604][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 878.781155][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 878.795667][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 878.806328][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 878.816055][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 878.825054][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 878.839406][ T1886] usb 3-1: config 0 descriptor?? [ 878.845096][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 878.861353][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 878.993550][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 879.002789][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 879.014903][ T1881] usb 1-1: Product: syz [ 879.019168][ T1881] usb 1-1: Manufacturer: syz [ 879.063718][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 879.069578][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 879.084059][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 879.383128][ T1886] usbhid 3-1:0.0: can't add hid device: -71 [ 879.389279][ T1886] usbhid: probe of 3-1:0.0 failed with error -71 [ 879.398182][ T1886] usb 3-1: USB disconnect, device number 50 [ 879.972975][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:05:01 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380), 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x2f00000000000000}, 0x0) 04:05:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:01 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:01 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 881.558039][ T1886] usb 1-1: USB disconnect, device number 28 04:05:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3000000000000000}, 0x0) [ 881.637543][T11834] input: syz1 as /devices/virtual/input/input87 04:05:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 881.696871][T11848] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3100000000000000}, 0x0) 04:05:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3200000000000000}, 0x0) 04:05:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 881.784811][T11855] input: syz1 as /devices/virtual/input/input88 04:05:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3300000000000000}, 0x0) [ 881.904500][T11869] input: syz1 as /devices/virtual/input/input89 [ 881.923121][ T1881] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 882.034247][ T1886] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 882.303500][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 882.314744][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 882.326721][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 882.336866][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 882.350537][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 882.360058][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.372488][ T1881] usb 3-1: config 0 descriptor?? [ 882.443277][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 882.452297][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 882.480322][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 882.492310][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 882.623121][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 882.632364][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 882.643549][ T1886] usb 1-1: Product: syz [ 882.647704][ T1886] usb 1-1: Manufacturer: syz [ 882.693828][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 882.699159][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 882.720117][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 882.914227][ T1881] usbhid 3-1:0.0: can't add hid device: -71 [ 882.920510][ T1881] usbhid: probe of 3-1:0.0 failed with error -71 [ 882.928883][ T1881] usb 3-1: USB disconnect, device number 51 [ 883.602997][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:05:05 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380), 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3400000000000000}, 0x0) 04:05:05 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:05 executing program 4: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) 04:05:05 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 885.214192][ T8639] usb 1-1: USB disconnect, device number 29 04:05:05 executing program 4: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) 04:05:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3500000000000000}, 0x0) 04:05:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:05 executing program 4: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) [ 885.324247][T11928] input: syz1 as /devices/virtual/input/input90 04:05:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3600000000000000}, 0x0) 04:05:05 executing program 4: pipe(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) [ 885.444358][T11944] input: syz1 as /devices/virtual/input/input91 [ 885.563265][ T1881] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 885.743097][ T8639] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 885.933150][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 885.946363][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 885.968699][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 885.979875][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 885.993248][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 886.002258][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.014071][ T1881] usb 3-1: config 0 descriptor?? [ 886.113060][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 886.121839][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 886.140425][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 886.149552][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 886.283186][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 886.292426][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 886.300747][ T8639] usb 1-1: Product: syz [ 886.304971][ T8639] usb 1-1: Manufacturer: syz [ 886.343709][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 886.349098][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 886.368182][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 886.753174][ T1881] usbhid 3-1:0.0: can't add hid device: -71 [ 886.759309][ T1881] usbhid: probe of 3-1:0.0 failed with error -71 [ 886.767563][ T1881] usb 3-1: USB disconnect, device number 52 [ 887.252976][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:05:09 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380), 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3700000000000000}, 0x0) 04:05:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:09 executing program 4: pipe(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) 04:05:09 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:09 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 888.795774][ T1881] usb 1-1: USB disconnect, device number 30 04:05:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 888.864547][T12008] input: syz1 as /devices/virtual/input/input92 04:05:09 executing program 4: pipe(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe6, 0x0) 04:05:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3800000000000000}, 0x0) [ 888.979808][T12022] input: syz1 as /devices/virtual/input/input93 04:05:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3900000000000000}, 0x0) [ 889.123190][ T1886] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 889.148577][T12038] input: syz1 as /devices/virtual/input/input94 [ 889.189590][T12046] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 889.273109][ T1881] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 889.493656][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 889.505929][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 889.518095][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 889.528194][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 889.541594][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 889.550687][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.560259][ T1886] usb 3-1: config 0 descriptor?? [ 889.633660][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 889.642491][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 889.659941][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 889.669471][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 889.803220][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 889.812560][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 889.821716][ T1881] usb 1-1: Product: syz [ 889.826327][ T1881] usb 1-1: Manufacturer: syz [ 889.863918][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 889.869314][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 889.877696][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 890.303190][ T1886] usbhid 3-1:0.0: can't add hid device: -71 [ 890.309466][ T1886] usbhid: probe of 3-1:0.0 failed with error -71 [ 890.318306][ T1886] usb 3-1: USB disconnect, device number 53 [ 890.772984][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:05:12 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909", 0x94) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3a00000000000000}, 0x0) 04:05:12 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:12 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 892.315271][T21202] usb 1-1: USB disconnect, device number 31 04:05:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3b00000000000000}, 0x0) 04:05:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3c00000000000000}, 0x0) [ 892.458383][T12102] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3d00000000000000}, 0x0) 04:05:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3e00000000000000}, 0x0) [ 892.663097][ T33] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 892.803058][T21202] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 893.053062][ T33] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 893.064270][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 893.079171][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 893.090119][ T33] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 893.103864][ T33] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 893.112888][ T33] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.128313][ T33] usb 3-1: config 0 descriptor?? [ 893.183644][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 893.213392][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 893.226710][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 893.245404][T21202] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 893.393246][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 893.403152][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 893.411850][T21202] usb 1-1: Product: syz [ 893.420984][T21202] usb 1-1: Manufacturer: syz [ 893.467668][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 893.473019][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 893.488371][T21202] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 893.883129][ T33] usbhid 3-1:0.0: can't add hid device: -71 [ 893.883249][ T33] usbhid: probe of 3-1:0.0 failed with error -71 [ 893.903085][ T33] usb 3-1: USB disconnect, device number 54 [ 894.372979][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 894.392987][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:16 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909", 0x94) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x3f00000000000000}, 0x0) 04:05:16 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0), 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:16 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:16 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 895.948163][ T1886] usb 1-1: USB disconnect, device number 32 04:05:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4000000000000000}, 0x0) 04:05:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 896.049912][T12170] input: syz1 as /devices/virtual/input/input98 [ 896.089038][T12175] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4100000000000000}, 0x0) 04:05:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 896.158227][T12190] input: syz1 as /devices/virtual/input/input99 04:05:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4200000000000000}, 0x0) [ 896.245931][T12201] input: syz1 as /devices/virtual/input/input100 04:05:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 896.293893][ T5990] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 896.349046][T12212] input: syz1 as /devices/virtual/input/input101 [ 896.453103][ T1886] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 896.673066][ T5990] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 896.684675][ T5990] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 896.698888][ T5990] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 896.710180][ T5990] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 896.725890][ T5990] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 896.736903][ T5990] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.750016][ T5990] usb 3-1: config 0 descriptor?? [ 896.823591][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 896.832228][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 896.856375][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 896.867738][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 896.993132][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 897.002679][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 897.014851][ T1886] usb 1-1: Product: syz [ 897.019094][ T1886] usb 1-1: Manufacturer: syz [ 897.063965][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 897.069268][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 897.095250][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 897.493184][ T5990] usbhid 3-1:0.0: can't add hid device: -71 [ 897.499339][ T5990] usbhid: probe of 3-1:0.0 failed with error -71 [ 897.515248][ T5990] usb 3-1: USB disconnect, device number 55 [ 897.992984][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 898.012975][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:19 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909", 0x94) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4300000000000000}, 0x0) 04:05:19 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:19 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0), 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:19 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:19 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 899.534681][ T33] usb 1-1: USB disconnect, device number 33 04:05:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4400000000000000}, 0x0) [ 899.627555][T12274] input: syz1 as /devices/virtual/input/input102 04:05:20 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 899.669248][T12285] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4500000000000000}, 0x0) 04:05:20 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 899.754648][T12294] input: syz1 as /devices/virtual/input/input103 04:05:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4600000000000000}, 0x0) 04:05:20 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 899.866536][T12304] input: syz1 as /devices/virtual/input/input104 [ 899.903004][ T1886] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 899.970173][T12316] input: syz1 as /devices/virtual/input/input105 [ 900.053075][ T33] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 900.273638][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 900.284823][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 900.302994][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 900.312834][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 900.327441][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 900.337236][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.351124][ T1886] usb 3-1: config 0 descriptor?? [ 900.443528][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 900.452247][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 900.463228][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 900.473186][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 900.613158][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 900.622323][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 900.631667][ T33] usb 1-1: Product: syz [ 900.636193][ T33] usb 1-1: Manufacturer: syz [ 900.683983][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 900.689311][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 900.707612][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 901.103142][ T1886] usbhid 3-1:0.0: can't add hid device: -71 [ 901.110200][ T1886] usbhid: probe of 3-1:0.0 failed with error -71 [ 901.128506][ T1886] usb 3-1: USB disconnect, device number 56 [ 901.592983][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 901.612994][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:23 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416a", 0xde) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4700000000000000}, 0x0) 04:05:23 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 04:05:23 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0), 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:23 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:23 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 903.134870][ T8639] usb 1-1: USB disconnect, device number 34 04:05:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4800000000000000}, 0x0) [ 903.226933][T12376] input: syz1 as /devices/virtual/input/input106 04:05:23 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) [ 903.293719][T12388] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4900000000000000}, 0x0) 04:05:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4a00000000000000}, 0x0) [ 903.380034][T12394] input: syz1 as /devices/virtual/input/input107 04:05:23 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 04:05:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4b00000000000000}, 0x0) [ 903.473236][ T1886] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 903.514594][T12408] input: syz1 as /devices/virtual/input/input108 [ 903.597479][ T8639] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 903.843337][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 903.858677][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 903.872644][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 903.889448][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 903.905283][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 903.915784][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.928767][ T1886] usb 3-1: config 0 descriptor?? [ 903.983175][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 903.994868][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 904.032287][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 904.046177][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 904.173108][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 904.182533][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 904.191911][ T8639] usb 1-1: Product: syz [ 904.196544][ T8639] usb 1-1: Manufacturer: syz [ 904.233695][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 904.239038][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 904.259190][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 904.673224][ T1886] usbhid 3-1:0.0: can't add hid device: -71 [ 904.679835][ T1886] usbhid: probe of 3-1:0.0 failed with error -71 [ 904.689075][ T1886] usb 3-1: USB disconnect, device number 57 [ 905.152978][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 905.173045][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:27 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416a", 0xde) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:27 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 04:05:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4c00000000000000}, 0x0) 04:05:27 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:27 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:27 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 906.734637][T21262] usb 1-1: USB disconnect, device number 35 04:05:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4d00000000000000}, 0x0) [ 906.806802][T12463] input: syz1 as /devices/virtual/input/input109 04:05:27 executing program 5: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x4000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0xbe, &(0x7f0000000340)="5cf249b974057c79b0c2ed44c921bf3c0f339e57f4f21016a5b60a00088024c30e4789469190ad0000000000000000ba4ecb40aa073e905834c90761600032a3b88a1f000000970e85a63c9a4b0d8b9aad0100000000000040aa2502df4d70c74f5cd30a0002a7bef7fdffff9f8b01647a0200169c864e1d5f81793f00000012cfb22f021d3c34e36cc95097cccc71d28ea448d8408d7304fd0c47ee856e8f368dbbb4d294227ada5b5f72c4bf907e2df0c68b2b3366d77e681d1630aa6d"}}], 0x1c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) 04:05:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4e00000000000000}, 0x0) [ 906.856629][T12477] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x4f00000000000000}, 0x0) 04:05:27 executing program 5: r0 = syz_open_dev$vim2m(&(0x7f0000000080)='/dev/video#\x00', 0x2000ff, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f00000000c0)={0x3}) 04:05:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5000000000000000}, 0x0) [ 907.073079][T21202] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 907.233088][T21262] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 907.463088][T21202] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 907.474237][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 907.489862][T21202] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 907.501195][T21202] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 907.515806][T21202] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 907.526757][T21202] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.539986][T21202] usb 3-1: config 0 descriptor?? [ 907.643780][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 907.653279][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 907.667625][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 907.679433][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 907.815601][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 907.824872][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 907.832896][T21262] usb 1-1: Product: syz [ 907.842666][T21262] usb 1-1: Manufacturer: syz [ 907.894047][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 907.899544][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 907.907273][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 908.276308][T21202] usbhid 3-1:0.0: can't add hid device: -71 [ 908.282404][T21202] usbhid: probe of 3-1:0.0 failed with error -71 [ 908.292298][T21202] usb 3-1: USB disconnect, device number 58 [ 908.822990][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 908.843049][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:30 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416a", 0xde) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5100000000000000}, 0x0) 04:05:30 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000380)={0x80000000000035d, 0x0, [{0x0, 0xe4, &(0x7f0000000080)=""/228}, {0x0, 0xe1, &(0x7f0000000280)=""/225}, {0x0, 0x0, 0x0}, {0x0, 0x0, &(0x7f0000000000)=""/37}]}) 04:05:30 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:30 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:30 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 910.425615][T21202] usb 1-1: USB disconnect, device number 36 04:05:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5200000000000000}, 0x0) 04:05:30 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000040)="9f8194be5ace602f096d07ff0ccd664f", 0x10}], 0x1) [ 910.561059][T12559] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5300000000000000}, 0x0) 04:05:31 executing program 5: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x4000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x15, &(0x7f0000000140)="8df6dc562183f6c43d138236f11f52f86d20a7ddf2"}}], 0x1c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) 04:05:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5400000000000000}, 0x0) 04:05:31 executing program 5: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'macvtap0\x00'}}, 0x1e) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4100, 0x1004}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x1000000010, 0x80002, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcf", 0x5}], 0x1, 0x1) close(r4) splice(r3, 0x0, r4, 0x0, 0x11300, 0x0) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000001180)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcsu\x00', 0x44800, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000001100)={r5, r1}) [ 910.773060][ T1881] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 910.893113][T21202] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 911.153386][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 911.170284][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 911.185846][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 911.197385][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 911.211760][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 911.222906][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.238078][ T1881] usb 3-1: config 0 descriptor?? [ 911.293139][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 911.302141][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 911.314718][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 911.327091][T21202] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 911.473875][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 911.483303][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 911.491363][T21202] usb 1-1: Product: syz [ 911.501863][T21202] usb 1-1: Manufacturer: syz [ 911.547530][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 911.553165][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 911.577843][T21202] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 911.993170][ T1881] usbhid 3-1:0.0: can't add hid device: -71 [ 911.999922][ T1881] usbhid: probe of 3-1:0.0 failed with error -71 [ 912.013646][ T1881] usb 3-1: USB disconnect, device number 59 [ 912.452977][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 912.472986][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:34 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3", 0x103) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5500000000000000}, 0x0) 04:05:34 executing program 5: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'macvtap0\x00'}}, 0x1e) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4100, 0x1004}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x1000000010, 0x80002, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcf", 0x5}], 0x1, 0x1) close(r4) splice(r3, 0x0, r4, 0x0, 0x11300, 0x0) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000001180)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcsu\x00', 0x44800, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000001100)={r5, r1}) 04:05:34 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:34 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:34 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 913.994752][ T1881] usb 1-1: USB disconnect, device number 37 04:05:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5600000000000000}, 0x0) [ 914.126302][T12637] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:34 executing program 5: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'macvtap0\x00'}}, 0x1e) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4100, 0x1004}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x1000000010, 0x80002, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcf", 0x5}], 0x1, 0x1) close(r4) splice(r3, 0x0, r4, 0x0, 0x11300, 0x0) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000001180)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcsu\x00', 0x44800, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000001100)={r5, r1}) 04:05:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5700000000000000}, 0x0) 04:05:34 executing program 5: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'macvtap0\x00'}}, 0x1e) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4100, 0x1004}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x1000000010, 0x80002, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcf", 0x5}], 0x1, 0x1) close(r4) splice(r3, 0x0, r4, 0x0, 0x11300, 0x0) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000001180)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcsu\x00', 0x44800, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000001100)={r5, r1}) 04:05:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5800000000000000}, 0x0) [ 914.356549][T21262] usb 3-1: new high-speed USB device number 60 using dummy_hcd 04:05:34 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ftruncate(r0, 0x8200) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x0, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0x9) [ 914.475557][ T1881] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 914.773092][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 914.784445][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 914.798470][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 914.810640][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 914.826319][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 914.836722][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 914.843426][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 914.854488][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 914.865081][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 914.869145][T21262] usb 3-1: config 0 descriptor?? [ 914.883190][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 915.023507][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 915.032654][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 915.041409][ T1881] usb 1-1: Product: syz [ 915.045664][ T1881] usb 1-1: Manufacturer: syz [ 915.084354][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 915.089668][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 915.096733][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 915.663096][T21262] usbhid 3-1:0.0: can't add hid device: -71 [ 915.669376][T21262] usbhid: probe of 3-1:0.0 failed with error -71 [ 915.677954][T21262] usb 3-1: USB disconnect, device number 60 [ 915.992986][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 916.012968][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:37 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3", 0x103) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5900000000000000}, 0x0) 04:05:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="047d"], 0x428}}, 0x0) 04:05:37 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:37 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:37 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 917.534592][ T9877] usb 1-1: USB disconnect, device number 38 04:05:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5a00000000000000}, 0x0) 04:05:38 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000000)='hfsplus\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000480), 0x0, &(0x7f0000000680)={[{@nls={'nls', 0x3d, 'macromanian'}}]}) 04:05:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5b00000000000000}, 0x0) [ 917.662654][T12705] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 917.700161][T12711] hfsplus: unable to find HFS+ superblock 04:05:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5c00000000000000}, 0x0) 04:05:38 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0) flock(r0, 0x8) [ 917.762523][T12711] hfsplus: unable to find HFS+ superblock 04:05:38 executing program 5: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) socket$alg(0x26, 0x5, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000180)) [ 917.873493][T21262] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 918.023129][ T9877] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 918.283035][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 918.294739][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 918.306038][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 918.316502][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 918.329715][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 918.339236][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.358542][T21262] usb 3-1: config 0 descriptor?? [ 918.393612][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 918.424947][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 918.437672][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 918.447871][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 918.573625][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 918.583916][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 918.592672][ T9877] usb 1-1: Product: syz [ 918.598262][ T9877] usb 1-1: Manufacturer: syz [ 918.643727][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 918.649146][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 918.661180][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 918.844130][T21262] appleir 0003:05AC:8243.0012: unknown main item tag 0x0 [ 918.851528][T21262] appleir 0003:05AC:8243.0012: No inputs registered, leaving [ 918.872133][T21262] appleir 0003:05AC:8243.0012: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 919.048814][ T1886] usb 3-1: USB disconnect, device number 61 [ 919.553044][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 919.572984][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:41 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3", 0x103) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5d00000000000000}, 0x0) 04:05:41 executing program 5: syz_open_dev$tty1(0xc, 0x4, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000180)) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 04:05:41 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x24}, 0x24}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:41 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:41 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 921.094646][ T1886] usb 1-1: USB disconnect, device number 39 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5e00000000000000}, 0x0) 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x5f00000000000000}, 0x0) 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6000000000000000}, 0x0) [ 921.197505][T12800] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6100000000000000}, 0x0) 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6200000000000000}, 0x0) 04:05:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6300000000000000}, 0x0) [ 921.443103][ T33] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 921.613146][ T1886] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 921.803605][ T33] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 921.815438][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 921.831471][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 921.842833][ T33] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 921.857252][ T33] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 921.868007][ T33] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.879763][ T33] usb 3-1: config 0 descriptor?? [ 921.993508][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 922.002520][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 922.038852][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 922.062232][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 922.213987][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 922.223880][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 922.231899][ T1886] usb 1-1: Product: syz [ 922.237302][ T1886] usb 1-1: Manufacturer: syz [ 922.294047][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 922.299292][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 922.307140][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 922.364294][ T33] appleir 0003:05AC:8243.0013: unknown main item tag 0x0 [ 922.371752][ T33] appleir 0003:05AC:8243.0013: No inputs registered, leaving [ 922.398410][ T33] appleir 0003:05AC:8243.0013: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 922.569011][ T1881] usb 3-1: USB disconnect, device number 62 [ 923.213004][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 923.232984][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:45 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1", 0x116) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6400000000000000}, 0x0) 04:05:45 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)=""/49) io_setup(0x1b, &(0x7f00000001c0)=0x0) io_destroy(r2) 04:05:45 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x24}, 0x24}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:45 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:45 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 924.753497][ T33] usb 1-1: USB disconnect, device number 40 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6500000000000000}, 0x0) 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6558000000000000}, 0x0) 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6600000000000000}, 0x0) [ 924.879271][T12892] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6700000000000000}, 0x0) 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6800000000000000}, 0x0) 04:05:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6900000000000000}, 0x0) [ 925.093129][ T8639] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 925.203088][ T33] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 925.463008][ T8639] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 925.474745][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 925.489381][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 925.501015][ T8639] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 925.515491][ T8639] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 925.526448][ T8639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.540788][ T8639] usb 3-1: config 0 descriptor?? [ 925.613686][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 925.622644][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 925.664622][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 925.674443][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 925.803809][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 925.813783][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 925.821885][ T33] usb 1-1: Product: syz [ 925.835826][ T33] usb 1-1: Manufacturer: syz [ 925.874037][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 925.879518][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 925.898515][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 926.023988][ T8639] appleir 0003:05AC:8243.0014: unknown main item tag 0x0 [ 926.031466][ T8639] appleir 0003:05AC:8243.0014: No inputs registered, leaving [ 926.058538][ T8639] appleir 0003:05AC:8243.0014: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 926.225514][ T1886] usb 3-1: USB disconnect, device number 63 [ 926.792984][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 926.812979][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:48 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1", 0x116) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6a00000000000000}, 0x0) 04:05:48 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x24}, 0x24}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:48 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x80, 0x0, 0x0, 0x0, 0xd7e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x8020003) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r0, 0x8200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x2e}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$IPVS_CMD_GET_DAEMON(r2, 0x0, 0x20000801) sendmmsg(0xffffffffffffffff, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002840)=[{0xa0, 0x0, 0x0, "2e3e9d692e8fe1fe04e74f306a5ec681eabe07058a87c12ec8e583a9fc059a3cfa43f88e4f8d7b2b07d46fc575a28bbaa1ea5ae185a15552426409c8e349a2b7d59bed273924244c831bf54605d4adc09578a6614383f997b626da0d7f4ccaeaa605c789adbcce605f8d7284c245a5a173b554f5e02af652fe995cd56fa1dfa13e43b6a6437f7eb718"}, {0x6a8, 0x0, 0x8, "ab62ea7528513b836e0d8cfc363ccdae49c561681d403689f2daffdc7508cb4b4c09d50fdbe801a643fef329b00243f8a4e7de32b979be18f8fe718f59e0d92fe38a930b40666c56631ddb839d5d1b977ed3011e276a6b231f1e566aa1c3e56bec4b9bf518a5fa9137edd519c2b7339de4b9c27ea18e1360768de21216fd437acac6eed5284dbf420f8f771b6fa08e4182a36d9d3fe64317dfdf358f1de381f799528dca563ba46a5d5009143038147f63d2f1a1b01163d991bd560864beb83945c158c4e06aea280891f0e3e77841558be9c61e5db7f087f3e05dab9bdc66a485bddd5e51b6daf726ed9fa2eadacea38622a260dbbd7c6a52e38260d5d5c178f49319f45aff0485cf88595e54f0ba9cba0fd2771e62859974af8d9a092cec1577938031d5da6de4f7e4d3e5c6a102bc721e989abe706609830a2f8fa607524a258f817907a83aa1619297570f880688f5d64c2a710562919bf0ebb3853996a215408495f7bfa8188e8898c61b9d194e792d739a42c34b3cccf245b67db210030991fbfde752348a53cfb4c6e32594253267da8a66cc0bdc9191b975c9280c70d54ad89939e19964e27d0f44a20ecfe2b6f1b65d3394d2e2503fdacc49fb987c61956089e4aca5aa666d4884470127e6c827bf5cac2f9a5587ce13dba1ee7dcbdd4c178e03e060ed8d8d1d57ee946ab53100e9e532c07b509ab1a8408c45bb5444dc74e5c5e5855fb4f59a57fbc2fcfb9c18e09d0f4f4509597c48efd7fb51fe20b3a6889df97004e53f9a34a0d1b699d145f4e0be485e302a9c86479b1b97e3e6697197341a45d5ab63ab6dd35cad96caa4479a106166899005b71790a560b2eae04c747bad89d19e28ed21f052e7e06876a8a2d62e489bf28e640dcee7e965574e3c4e8243698f3bc01bf6b9c1abb5ebe7c3b577a56a2c88c45e0da6bc5578b0c6721bf0d2226efa6c1457d2e5bf8a43d6690004a405b98239e7b107877abb2e52e6cf022e2609d025599d847d987d3624130218f80c1b38497f5e828b7cf2adb6fce7aa6b71a9e5fee9827b3030006e4be9577547f73fccc31c3a3b708b0408becb3f20d62bd9a0a4c5d879a1c41f26367d25f728bf171d0afdff15b4fb42bcf5ddc007fa784e9a4a6030671850dce7e6d2043f8e8063e543ea361006753b57aea34596993f851ec93e70216abf1e0589c94d54b08498b92dc3814294d5a22ae398a19915e73511e9640b074b421ac2bc586ad70146fd812cc3f64edd685e73e8a77d7c44123f7fc5732aafd1a35b84f0e9fabee94ded996a4fc2fd0c0cd1446c60cb5db146ccbf1f1b6d96ad454a4efcf0e4205363bd5fe5209a906987d4cac86c60bfacbc94411aff034e21d6f3e9a1ed28924e6af3fb15dbd64f9580a10e3222fb544c8260ebec10638317b0ae59874062b4b648033b9f74b3aa87a0054b46e423390eabdabddc08bf490a5342f5be1cfed4f2b97b187b700fd4121d26b587c062d19cd32684658f44013d9ac4697b5289f0a24fff1cad25021fe4e32e28ff74d6e4a07b0ef1029bd9ca7bbca73c4094d50512e9da37c60acbb5ddbe04fa7a6f8e33da10398d5484bf433f8f72bb0a81a8f0df1e40b25ad83b07584962ce6845f66348062c3d1b6063c8047639a467c866c5db743ddc060d0e4647b48ac5f6881d1504bff85045d8221faba2d6758b07712dc33ad6d27637ac13f75f302b9a716b91a92502e64c0710ec7749f04b736a438e0748ae22a528ceea37872e4226f0706cfcdda6b3170b9597fa4a6c88d2e799a1bf790b254afab620d88f6174cca33134d625427050f646986a12e4dcb447e9c73fc82d13a58e1047c3c68195dc8e1e2dfbfc89a07218f48c6c8f544ac889d85adeb80b6f03c311cf7e30477a6663fcf4614c34fe0530a1324fe552791257ea1ddce048d10e3dd6495680c5650780b4ac31eb897efc9f846c7afde43a779f66b7f2f22e438b549a733f814b6798cb89a2682db98b138a405357353148a06d8584e4aceb702852716a3e40cee847ac5fff056092071a762e790565b9138e44dcce9a9c792513c71ab7f44dcdba0e2da18614f94cc036823ff7561121ed8305486cd8a7a62ea94355ed55d6bdd9f3f1e788a147c87495d0d89f8d930b1f2b21af59b9e9771003d909a1a4cb8fd9e99d444be78b382b41b890636523dd5d65b0c4859894842790ea87b01f3fddad4915069683d3094812a8dc311eb7af238305206d98eef89f7c4868890d0e9d866cc4dd25dc3ea4f77f674729802d89cfbbc818b23c6587d472b9da29d35430995e3590f9c8b79e25d9ce86e19c997683810654a765ac0405ee0c74968aa0b26cfbd971038a197793d3d056d70d03ebc7"}, {0x70, 0x0, 0x0, "3209e594ee76db172494ef6b4b764f064bcdeca5f70732fb3e6e556c6964d963563623c61f5de703fda55f0b46969ab290d0b304ffefafde925d86d2bec4098a820ea4503b172b689e26d95bd559b6f8822cb4dc00a6923b34"}, {0x10}], 0x7c8}}], 0x1, 0x0) 04:05:48 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000), 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:48 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(0xffffffffffffffff, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 928.335385][T21262] usb 1-1: USB disconnect, device number 41 04:05:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x6b00000000000000}, 0x0) [ 928.457916][T12980] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:48 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x80, 0x0, 0x0, 0x0, 0xd7e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x8020003) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r0, 0x8200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x2e}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$IPVS_CMD_GET_DAEMON(r2, 0x0, 0x20000801) sendmmsg(0xffffffffffffffff, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002840)=[{0xa0, 0x0, 0x0, "2e3e9d692e8fe1fe04e74f306a5ec681eabe07058a87c12ec8e583a9fc059a3cfa43f88e4f8d7b2b07d46fc575a28bbaa1ea5ae185a15552426409c8e349a2b7d59bed273924244c831bf54605d4adc09578a6614383f997b626da0d7f4ccaeaa605c789adbcce605f8d7284c245a5a173b554f5e02af652fe995cd56fa1dfa13e43b6a6437f7eb718"}, {0x6a8, 0x0, 0x8, "ab62ea7528513b836e0d8cfc363ccdae49c561681d403689f2daffdc7508cb4b4c09d50fdbe801a643fef329b00243f8a4e7de32b979be18f8fe718f59e0d92fe38a930b40666c56631ddb839d5d1b977ed3011e276a6b231f1e566aa1c3e56bec4b9bf518a5fa9137edd519c2b7339de4b9c27ea18e1360768de21216fd437acac6eed5284dbf420f8f771b6fa08e4182a36d9d3fe64317dfdf358f1de381f799528dca563ba46a5d5009143038147f63d2f1a1b01163d991bd560864beb83945c158c4e06aea280891f0e3e77841558be9c61e5db7f087f3e05dab9bdc66a485bddd5e51b6daf726ed9fa2eadacea38622a260dbbd7c6a52e38260d5d5c178f49319f45aff0485cf88595e54f0ba9cba0fd2771e62859974af8d9a092cec1577938031d5da6de4f7e4d3e5c6a102bc721e989abe706609830a2f8fa607524a258f817907a83aa1619297570f880688f5d64c2a710562919bf0ebb3853996a215408495f7bfa8188e8898c61b9d194e792d739a42c34b3cccf245b67db210030991fbfde752348a53cfb4c6e32594253267da8a66cc0bdc9191b975c9280c70d54ad89939e19964e27d0f44a20ecfe2b6f1b65d3394d2e2503fdacc49fb987c61956089e4aca5aa666d4884470127e6c827bf5cac2f9a5587ce13dba1ee7dcbdd4c178e03e060ed8d8d1d57ee946ab53100e9e532c07b509ab1a8408c45bb5444dc74e5c5e5855fb4f59a57fbc2fcfb9c18e09d0f4f4509597c48efd7fb51fe20b3a6889df97004e53f9a34a0d1b699d145f4e0be485e302a9c86479b1b97e3e6697197341a45d5ab63ab6dd35cad96caa4479a106166899005b71790a560b2eae04c747bad89d19e28ed21f052e7e06876a8a2d62e489bf28e640dcee7e965574e3c4e8243698f3bc01bf6b9c1abb5ebe7c3b577a56a2c88c45e0da6bc5578b0c6721bf0d2226efa6c1457d2e5bf8a43d6690004a405b98239e7b107877abb2e52e6cf022e2609d025599d847d987d3624130218f80c1b38497f5e828b7cf2adb6fce7aa6b71a9e5fee9827b3030006e4be9577547f73fccc31c3a3b708b0408becb3f20d62bd9a0a4c5d879a1c41f26367d25f728bf171d0afdff15b4fb42bcf5ddc007fa784e9a4a6030671850dce7e6d2043f8e8063e543ea361006753b57aea34596993f851ec93e70216abf1e0589c94d54b08498b92dc3814294d5a22ae398a19915e73511e9640b074b421ac2bc586ad70146fd812cc3f64edd685e73e8a77d7c44123f7fc5732aafd1a35b84f0e9fabee94ded996a4fc2fd0c0cd1446c60cb5db146ccbf1f1b6d96ad454a4efcf0e4205363bd5fe5209a906987d4cac86c60bfacbc94411aff034e21d6f3e9a1ed28924e6af3fb15dbd64f9580a10e3222fb544c8260ebec10638317b0ae59874062b4b648033b9f74b3aa87a0054b46e423390eabdabddc08bf490a5342f5be1cfed4f2b97b187b700fd4121d26b587c062d19cd32684658f44013d9ac4697b5289f0a24fff1cad25021fe4e32e28ff74d6e4a07b0ef1029bd9ca7bbca73c4094d50512e9da37c60acbb5ddbe04fa7a6f8e33da10398d5484bf433f8f72bb0a81a8f0df1e40b25ad83b07584962ce6845f66348062c3d1b6063c8047639a467c866c5db743ddc060d0e4647b48ac5f6881d1504bff85045d8221faba2d6758b07712dc33ad6d27637ac13f75f302b9a716b91a92502e64c0710ec7749f04b736a438e0748ae22a528ceea37872e4226f0706cfcdda6b3170b9597fa4a6c88d2e799a1bf790b254afab620d88f6174cca33134d625427050f646986a12e4dcb447e9c73fc82d13a58e1047c3c68195dc8e1e2dfbfc89a07218f48c6c8f544ac889d85adeb80b6f03c311cf7e30477a6663fcf4614c34fe0530a1324fe552791257ea1ddce048d10e3dd6495680c5650780b4ac31eb897efc9f846c7afde43a779f66b7f2f22e438b549a733f814b6798cb89a2682db98b138a405357353148a06d8584e4aceb702852716a3e40cee847ac5fff056092071a762e790565b9138e44dcce9a9c792513c71ab7f44dcdba0e2da18614f94cc036823ff7561121ed8305486cd8a7a62ea94355ed55d6bdd9f3f1e788a147c87495d0d89f8d930b1f2b21af59b9e9771003d909a1a4cb8fd9e99d444be78b382b41b890636523dd5d65b0c4859894842790ea87b01f3fddad4915069683d3094812a8dc311eb7af238305206d98eef89f7c4868890d0e9d866cc4dd25dc3ea4f77f674729802d89cfbbc818b23c6587d472b9da29d35430995e3590f9c8b79e25d9ce86e19c997683810654a765ac0405ee0c74968aa0b26cfbd971038a197793d3d056d70d03ebc7"}, {0x70, 0x0, 0x0, "3209e594ee76db172494ef6b4b764f064bcdeca5f70732fb3e6e556c6964d963563623c61f5de703fda55f0b46969ab290d0b304ffefafde925d86d2bec4098a820ea4503b172b689e26d95bd559b6f8822cb4dc00a6923b34"}, {0x10}], 0x7c8}}], 0x1, 0x0) 04:05:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x8100000000000000}, 0x0) 04:05:49 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00') perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000240)) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', 0x0}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS3\x00', 0x802, 0x0) sendfile(r2, r0, 0x0, 0x20000000000000d8) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=""/246) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000140)={0x5, 0x70, 0x5, 0x81, 0xdc, 0x1f, 0x0, 0x0, 0x0, 0xf, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x0, @perf_config_ext={0x3f, 0x4}, 0x12000, 0x10000, 0x7, 0x5, 0x2, 0x80000001, 0x735e}) 04:05:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x88a8ffff00000000}, 0x0) [ 928.663035][ T33] usb 3-1: new high-speed USB device number 64 using dummy_hcd 04:05:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x9d03000000000000}, 0x0) [ 928.803513][T21262] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 929.053155][ T33] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 929.064975][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 929.077449][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 929.087510][ T33] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 929.102139][ T33] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 929.113133][ T33] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 929.130739][ T33] usb 3-1: config 0 descriptor?? [ 929.203089][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 929.211903][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 929.233663][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 929.244717][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 929.403276][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 929.412487][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 929.423677][T21262] usb 1-1: Product: syz [ 929.427820][T21262] usb 1-1: Manufacturer: syz [ 929.506888][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 929.512393][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 929.531255][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 929.624222][ T33] appleir 0003:05AC:8243.0015: unknown main item tag 0x0 [ 929.631713][ T33] appleir 0003:05AC:8243.0015: No inputs registered, leaving [ 929.652180][ T33] appleir 0003:05AC:8243.0015: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 929.826198][ T33] usb 3-1: USB disconnect, device number 64 [ 930.423032][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 930.443007][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:52 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1", 0x116) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:52 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00') perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000240)) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', 0x0}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS3\x00', 0x802, 0x0) sendfile(r2, r0, 0x0, 0x20000000000000d8) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=""/246) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000140)={0x5, 0x70, 0x5, 0x81, 0xdc, 0x1f, 0x0, 0x0, 0x0, 0xf, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x0, @perf_config_ext={0x3f, 0x4}, 0x12000, 0x10000, 0x7, 0x5, 0x2, 0x80000001, 0x735e}) 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x9effffff00000000}, 0x0) 04:05:52 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000), 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:52 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:52 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(0xffffffffffffffff, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) [ 932.025726][T21262] usb 1-1: USB disconnect, device number 42 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xc00e000000000000}, 0x0) 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xff00000000000000}, 0x0) 04:05:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 932.176175][T13073] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xffffff7f00000000}, 0x0) 04:05:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xffffffff00000000}, 0x0) [ 932.353104][ T33] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 932.503085][T21262] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 932.763109][ T33] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 932.774382][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 932.788987][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 932.800245][ T33] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 932.814108][ T33] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 932.826082][ T33] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.839478][ T33] usb 3-1: config 0 descriptor?? [ 932.893558][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 932.902355][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 932.939346][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 932.950796][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 933.133141][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 933.142375][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 933.150467][T21262] usb 1-1: Product: syz [ 933.155206][T21262] usb 1-1: Manufacturer: syz [ 933.197410][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 933.203642][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 933.210479][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 933.314251][ T33] appleir 0003:05AC:8243.0016: unknown main item tag 0x0 [ 933.321712][ T33] appleir 0003:05AC:8243.0016: No inputs registered, leaving [ 933.346217][ T33] appleir 0003:05AC:8243.0016: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 933.539168][ T8639] usb 3-1: USB disconnect, device number 65 [ 934.112970][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 934.132974][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:56 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c6", 0x11f) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0xfffffffffffff000}, 0x0) 04:05:56 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000), 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:56 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(0xffffffffffffffff, 0xc018480d, &(0x7f0000000380)={0x1, 0xffffffff}) 04:05:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 935.653677][ T33] usb 1-1: USB disconnect, device number 43 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) [ 935.773652][T13159] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2}, 0x0) 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3}, 0x0) 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4}, 0x0) 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5}, 0x0) [ 935.983051][ T1886] usb 3-1: new high-speed USB device number 66 using dummy_hcd 04:05:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6}, 0x0) [ 936.178953][ T33] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 936.363337][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 936.378433][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 936.390735][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 936.404486][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 936.421102][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 936.430847][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 936.448220][ T1886] usb 3-1: config 0 descriptor?? [ 936.593168][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 936.602450][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 936.632978][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 936.642109][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 936.773237][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 936.782833][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 936.794471][ T33] usb 1-1: Product: syz [ 936.798810][ T33] usb 1-1: Manufacturer: syz [ 936.853993][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 936.859526][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 936.875109][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 936.934308][ T1886] appleir 0003:05AC:8243.0017: unknown main item tag 0x0 [ 936.941782][ T1886] appleir 0003:05AC:8243.0017: No inputs registered, leaving [ 936.966462][ T1886] appleir 0003:05AC:8243.0017: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 937.143363][ T1886] usb 3-1: USB disconnect, device number 66 [ 937.762984][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 937.782998][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:05:59 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c6", 0x11f) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:05:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x7}, 0x0) 04:05:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:05:59 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:05:59 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0) 04:05:59 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 939.306275][T21262] usb 1-1: USB disconnect, device number 44 04:05:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x8}, 0x0) [ 939.431893][T13253] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 04:05:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x9}, 0x0) 04:05:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xa}, 0x0) 04:06:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xb}, 0x0) [ 939.652988][ T1886] usb 3-1: new high-speed USB device number 67 using dummy_hcd 04:06:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xc}, 0x0) [ 939.793151][T21262] usb 1-1: new high-speed USB device number 45 using dummy_hcd 04:06:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xd}, 0x0) [ 940.023656][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 940.038618][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.056257][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 940.067802][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 940.084150][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 940.094791][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.107091][ T1886] usb 3-1: config 0 descriptor?? [ 940.173708][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 940.192842][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 940.229122][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 940.240668][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.403247][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 940.412459][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 940.426270][T21262] usb 1-1: Product: syz [ 940.430415][T21262] usb 1-1: Manufacturer: syz [ 940.493889][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 940.499307][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 940.518428][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 940.584217][ T1886] appleir 0003:05AC:8243.0018: unknown main item tag 0x0 [ 940.591795][ T1886] appleir 0003:05AC:8243.0018: No inputs registered, leaving [ 940.614735][ T1886] appleir 0003:05AC:8243.0018: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 940.785823][T21262] usb 3-1: USB disconnect, device number 67 [ 941.403029][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 941.422975][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:03 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xe}, 0x0) 04:06:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:03 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0) 04:06:03 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c6", 0x11f) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:03 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 942.943964][T21262] usb 1-1: USB disconnect, device number 45 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf}, 0x0) [ 943.079421][T13346] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x11}, 0x0) 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x12}, 0x0) 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x13}, 0x0) [ 943.283186][ T1886] usb 3-1: new high-speed USB device number 68 using dummy_hcd 04:06:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x14}, 0x0) [ 943.413258][T21262] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 943.653095][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 943.664772][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 943.679270][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 943.691012][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 943.706006][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 943.717358][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.729281][ T1886] usb 3-1: config 0 descriptor?? 04:06:04 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x15}, 0x0) 04:06:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 943.816227][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 943.848732][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 943.882660][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 943.908078][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 943.952232][T13379] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 944.067364][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 944.080856][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 944.097042][T21262] usb 1-1: Product: syz [ 944.101290][T21262] usb 1-1: Manufacturer: syz [ 944.143881][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 944.149280][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 944.167121][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 944.214339][ T1886] appleir 0003:05AC:8243.0019: unknown main item tag 0x0 [ 944.221722][ T1886] appleir 0003:05AC:8243.0019: No inputs registered, leaving [ 944.244005][ T1886] appleir 0003:05AC:8243.0019: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 944.419652][T21262] usb 3-1: USB disconnect, device number 68 04:06:05 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0) [ 945.053028][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 945.083020][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 945.233006][ T1881] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 945.593047][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 945.604243][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 945.615292][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 945.628303][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 945.641766][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 945.650936][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.661443][ T1881] usb 3-1: config 0 descriptor?? [ 946.143972][ T1881] appleir 0003:05AC:8243.001A: unknown main item tag 0x0 [ 946.151455][ T1881] appleir 0003:05AC:8243.001A: No inputs registered, leaving [ 946.174142][ T1881] appleir 0003:05AC:8243.001A: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 946.345984][T21262] usb 3-1: USB disconnect, device number 69 04:06:07 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde", 0x124) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x16}, 0x0) 04:06:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:07 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) [ 946.653953][ T33] usb 1-1: USB disconnect, device number 46 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x17}, 0x0) [ 946.783101][T13474] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x18}, 0x0) 04:06:07 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x0, 0xffffffff}) 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x19}, 0x0) 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1a}, 0x0) 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1b}, 0x0) 04:06:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1c}, 0x0) [ 947.103278][ T33] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 947.232983][T21262] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 947.495481][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 947.513816][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 947.529875][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 947.541288][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 947.660451][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 947.671990][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 947.688576][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 947.700159][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 947.715254][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 947.724665][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 947.737020][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 947.747596][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.757091][ T33] usb 1-1: Product: syz [ 947.761322][ T33] usb 1-1: Manufacturer: syz [ 947.770730][T21262] usb 3-1: config 0 descriptor?? [ 947.833969][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 947.839398][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 947.861543][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 948.293947][T21262] appleir 0003:05AC:8243.001B: unknown main item tag 0x0 [ 948.301382][T21262] appleir 0003:05AC:8243.001B: No inputs registered, leaving [ 948.325847][T21262] appleir 0003:05AC:8243.001B: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 948.498714][T21262] usb 3-1: USB disconnect, device number 70 [ 948.763005][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 948.782976][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:10 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde", 0x124) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1d}, 0x0) 04:06:10 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:10 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x0, 0xffffffff}) 04:06:10 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) [ 950.353526][T21262] usb 1-1: USB disconnect, device number 47 04:06:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1e}, 0x0) 04:06:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x21}, 0x0) 04:06:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x22}, 0x0) 04:06:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x23}, 0x0) [ 950.703157][ T1886] usb 3-1: new high-speed USB device number 71 using dummy_hcd 04:06:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x24}, 0x0) 04:06:11 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) [ 950.847952][T21262] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 951.063092][ T1886] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 951.075569][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 951.090813][ T1886] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 951.102103][ T1886] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 951.115385][ T1886] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 951.126713][ T1886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.138844][ T1886] usb 3-1: config 0 descriptor?? [ 951.248035][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 951.258344][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 951.279498][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 951.298048][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 951.433112][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 951.442290][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 951.454212][T21262] usb 1-1: Product: syz [ 951.458538][T21262] usb 1-1: Manufacturer: syz [ 951.523903][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 951.529304][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 951.548552][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 951.634168][ T1886] appleir 0003:05AC:8243.001C: unknown main item tag 0x0 [ 951.641561][ T1886] appleir 0003:05AC:8243.001C: No inputs registered, leaving [ 951.667907][ T1886] appleir 0003:05AC:8243.001C: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 951.858277][ T1886] usb 3-1: USB disconnect, device number 71 [ 952.432979][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 952.452965][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:14 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde", 0x124) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x25}, 0x0) 04:06:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:14 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:14 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x0, 0xffffffff}) 04:06:14 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 954.026603][ T1886] usb 1-1: USB disconnect, device number 48 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x26}, 0x0) 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x27}, 0x0) 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x28}, 0x0) 04:06:14 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x29}, 0x0) [ 954.367188][ T33] usb 3-1: new high-speed USB device number 72 using dummy_hcd 04:06:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2a}, 0x0) [ 954.478828][ T1886] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 954.793675][ T33] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 954.810819][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 954.825795][ T33] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 954.838706][ T33] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 954.853099][ T33] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 954.856454][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 954.862115][ T33] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.876502][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 954.890595][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 954.906247][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 954.912713][ T33] usb 3-1: config 0 descriptor?? [ 955.063553][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 955.077463][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 955.087193][ T1886] usb 1-1: Product: syz [ 955.091341][ T1886] usb 1-1: Manufacturer: syz [ 955.146625][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 955.152304][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 955.172740][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 955.424222][ T33] appleir 0003:05AC:8243.001D: unknown main item tag 0x0 [ 955.431621][ T33] appleir 0003:05AC:8243.001D: No inputs registered, leaving [ 955.456119][ T33] appleir 0003:05AC:8243.001D: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 955.630995][ T33] usb 3-1: USB disconnect, device number 72 [ 956.052978][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 956.072967][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:17 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8", 0x126) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2b}, 0x0) 04:06:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:17 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:17 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:17 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1}) [ 957.594443][ T1881] usb 1-1: USB disconnect, device number 49 04:06:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2c}, 0x0) 04:06:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2d}, 0x0) 04:06:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2e}, 0x0) 04:06:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2f}, 0x0) [ 957.953043][T21262] usb 3-1: new high-speed USB device number 73 using dummy_hcd 04:06:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x30}, 0x0) [ 958.033062][ T1881] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 958.344090][T21262] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 958.356183][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 958.381361][T21262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 958.399225][T21262] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 958.403143][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 958.416110][T21262] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 958.422599][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 958.439473][T21262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.441959][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 958.458153][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 958.495917][T21262] usb 3-1: config 0 descriptor?? [ 958.583624][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 958.593477][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 958.611193][ T1881] usb 1-1: Product: syz [ 958.615637][ T1881] usb 1-1: Manufacturer: syz [ 958.675826][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 958.681128][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 958.692010][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 958.974183][T21262] appleir 0003:05AC:8243.001E: unknown main item tag 0x0 [ 958.981648][T21262] appleir 0003:05AC:8243.001E: No inputs registered, leaving [ 959.004807][T21262] appleir 0003:05AC:8243.001E: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 959.176182][ T1881] usb 3-1: USB disconnect, device number 73 [ 959.592972][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 959.612990][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:21 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8", 0x126) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x31}, 0x0) 04:06:21 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:21 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:21 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:21 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1}) [ 961.194766][ T33] usb 1-1: USB disconnect, device number 50 04:06:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x32}, 0x0) 04:06:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x33}, 0x0) 04:06:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x34}, 0x0) 04:06:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x35}, 0x0) [ 961.548980][ T8639] usb 3-1: new high-speed USB device number 74 using dummy_hcd 04:06:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x36}, 0x0) [ 961.703052][ T33] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 961.933793][ T8639] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 961.950976][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 961.973161][ T8639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 961.992195][ T8639] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 962.014815][ T8639] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 962.030211][ T8639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.049838][ T8639] usb 3-1: config 0 descriptor?? [ 962.083558][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 962.092259][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 962.134758][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 962.153945][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 962.283166][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 962.292406][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 962.304373][ T33] usb 1-1: Product: syz [ 962.308521][ T33] usb 1-1: Manufacturer: syz [ 962.353683][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 962.359027][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 962.379026][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 962.534116][ T8639] appleir 0003:05AC:8243.001F: unknown main item tag 0x0 [ 962.541464][ T8639] appleir 0003:05AC:8243.001F: No inputs registered, leaving [ 962.566622][ T8639] appleir 0003:05AC:8243.001F: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 962.743611][ T8639] usb 3-1: USB disconnect, device number 74 [ 963.272982][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 963.292970][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:25 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8", 0x126) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x37}, 0x0) 04:06:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:25 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:25 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:25 executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x8243, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001200)={0x2c, &(0x7f0000000ec0)=ANY=[@ANYBLOB="00fa7c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000cc0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000380)={0x1}) [ 964.875380][ T33] usb 1-1: USB disconnect, device number 51 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x38}, 0x0) 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x39}, 0x0) 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3a}, 0x0) 04:06:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3b}, 0x0) [ 965.225298][ T1881] usb 3-1: new high-speed USB device number 75 using dummy_hcd 04:06:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3c}, 0x0) [ 965.333055][ T33] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 965.593495][ T1881] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 965.604846][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 965.617814][ T1881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 965.627990][ T1881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 965.644377][ T1881] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40 [ 965.656225][ T1881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.670667][ T1881] usb 3-1: config 0 descriptor?? [ 965.727499][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 965.756698][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 965.795879][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 965.829159][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 965.973542][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 965.999775][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 966.038625][ T33] usb 1-1: Product: syz [ 966.057789][ T33] usb 1-1: Manufacturer: syz [ 966.113832][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 966.119250][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 966.143938][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 966.155634][ T1881] appleir 0003:05AC:8243.0020: unknown main item tag 0x0 [ 966.167139][ T1881] appleir 0003:05AC:8243.0020: No inputs registered, leaving [ 966.232578][ T1881] appleir 0003:05AC:8243.0020: hiddev1,hidraw0: USB HID v0.00 Device [HID 05ac:8243] on usb-dummy_hcd.2-1/input0 [ 966.358962][ T33] usb 3-1: USB disconnect, device number 75 [ 967.032984][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 967.052969][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:28 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d2", 0x127) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3d}, 0x0) 04:06:28 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:28 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:28 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:28 executing program 2: r0 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x46000) lseek(r1, 0x4200, 0x0) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x10000}]) r4 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) clock_settime(0x0, 0x0) sendfile(r1, r4, 0x0, 0x8400fffffffb) sendfile(r0, r0, 0x0, 0x8080ffffff7e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 968.578774][T21262] usb 1-1: USB disconnect, device number 52 04:06:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3e}, 0x0) [ 968.693915][ T34] audit: type=1804 audit(1606709189.044:37): pid=14020 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1839/bus" dev="sda1" ino=16013 res=1 errno=0 04:06:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x41}, 0x0) 04:06:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x42}, 0x0) 04:06:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x43}, 0x0) 04:06:29 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 969.087168][T21262] usb 1-1: new high-speed USB device number 53 using dummy_hcd 04:06:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x44}, 0x0) [ 969.445388][ T34] audit: type=1804 audit(1606709189.794:38): pid=14030 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1839/bus" dev="sda1" ino=16013 res=1 errno=0 [ 969.489967][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 969.505484][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 969.521430][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 969.531569][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 969.537994][ T34] audit: type=1804 audit(1606709189.794:39): pid=14030 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1839/bus" dev="sda1" ino=16013 res=1 errno=0 [ 969.568286][ T34] audit: type=1804 audit(1606709189.814:40): pid=14020 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1839/bus" dev="sda1" ino=16013 res=1 errno=0 [ 969.695185][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 969.714730][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 969.729051][T21262] usb 1-1: Product: syz [ 969.735867][T21262] usb 1-1: Manufacturer: syz [ 969.773803][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 969.779217][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 969.813589][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 970.692977][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 970.722978][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:32 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d2", 0x127) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x45}, 0x0) 04:06:32 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:32 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:32 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440), 0xfffffc41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) mlockall(0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10003}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={0x0, @qipcrtr={0x2a, 0x2, 0x8000}, @phonet={0x23, 0x6, 0x1f, 0x8}, @generic={0x5, "86f7a866f244b26d899674ea4522"}, 0x3, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000180)='geneve0\x00', 0xaf99, 0xc43, 0x9}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) [ 972.308062][ T8639] usb 1-1: USB disconnect, device number 53 04:06:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x46}, 0x0) 04:06:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x47}, 0x0) 04:06:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x48}, 0x0) 04:06:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x49}, 0x0) [ 972.753080][ T8639] usb 1-1: new high-speed USB device number 54 using dummy_hcd 04:06:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4a}, 0x0) 04:06:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 973.153515][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 973.162176][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 973.218538][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 973.244004][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 973.403253][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 973.414489][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 973.422558][ T8639] usb 1-1: Product: syz [ 973.428467][ T8639] usb 1-1: Manufacturer: syz [ 973.483921][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 973.489366][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 973.504538][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 974.393038][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 974.413014][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:36 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d2", 0x127) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4b}, 0x0) 04:06:36 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440), 0xfffffc41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) mlockall(0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10003}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={0x0, @qipcrtr={0x2a, 0x2, 0x8000}, @phonet={0x23, 0x6, 0x1f, 0x8}, @generic={0x5, "86f7a866f244b26d899674ea4522"}, 0x3, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000180)='geneve0\x00', 0xaf99, 0xc43, 0x9}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) 04:06:36 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:36 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x0, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 975.937941][ T1886] usb 1-1: USB disconnect, device number 54 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4c}, 0x0) 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4d}, 0x0) 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4e}, 0x0) 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4f}, 0x0) [ 976.423004][ T1886] usb 1-1: new high-speed USB device number 55 using dummy_hcd 04:06:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x50}, 0x0) 04:06:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 976.803558][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 976.812396][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 976.856782][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 976.880205][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 977.013229][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 977.029176][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 977.039482][ T1886] usb 1-1: Product: syz [ 977.049905][ T1886] usb 1-1: Manufacturer: syz [ 977.093692][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 977.099092][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 977.106056][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 978.003068][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 978.023013][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:06:39 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x51}, 0x0) 04:06:39 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:39 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440), 0xfffffc41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) mlockall(0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10003}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={0x0, @qipcrtr={0x2a, 0x2, 0x8000}, @phonet={0x23, 0x6, 0x1f, 0x8}, @generic={0x5, "86f7a866f244b26d899674ea4522"}, 0x3, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000180)='geneve0\x00', 0xaf99, 0xc43, 0x9}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) 04:06:39 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 979.575491][ T1886] usb 1-1: USB disconnect, device number 55 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x52}, 0x0) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x53}, 0x0) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x54}, 0x0) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x55}, 0x0) 04:06:40 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x56}, 0x0) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x57}, 0x0) 04:06:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:40 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x58}, 0x0) 04:06:40 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:40 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect(r0, &(0x7f0000000080)=@caif=@dbg, 0x80) 04:06:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x59}, 0x0) 04:06:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:40 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r2, 0x107, 0x13, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 980.580824][T14254] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:41 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5a}, 0x0) 04:06:41 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x10, 0x80002, 0x0) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="24000000190007041dfffd946f6105000a0000e8fe0208010001080008000600fe7f0000280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 980.873406][T14275] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 04:06:41 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:41 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5b}, 0x0) 04:06:41 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0)='cgroup2\x00', 0x0, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) 04:06:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:41 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5c}, 0x0) 04:06:41 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x20, 0x0, 0x8, 0x3, 0x0, 0x0, {}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) 04:06:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 981.509425][T14309] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5d}, 0x0) [ 981.713068][ T1886] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 982.113139][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 982.122088][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 982.135895][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 982.147362][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 04:06:42 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:42 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000140)="39000000130009006900000000000000ab00804803000000c600010700000014190013", 0x23}], 0x2b) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x25cb, 0x0) 04:06:42 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5e}, 0x0) 04:06:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5f}, 0x0) [ 982.304026][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 982.317976][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 982.321854][T14341] netlink: 'syz-executor.2': attribute type 19 has an invalid length. [ 982.334913][ T1886] usb 1-1: Product: syz [ 982.339224][ T1886] usb 1-1: Manufacturer: syz 04:06:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x60}, 0x0) [ 982.357600][T14342] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. [ 982.393944][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 982.399456][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 982.436276][ T1886] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:06:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x61}, 0x0) 04:06:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:44 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x8d, 0x0, 0x0) msgsnd(r0, &(0x7f0000000280)={0x2}, 0x8, 0x0) tkill(0x0, 0x0) 04:06:44 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:44 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:44 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 984.419045][ T9877] usb 1-1: USB disconnect, device number 56 04:06:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x62}, 0x0) 04:06:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x63}, 0x0) 04:06:44 executing program 2: clone(0x1000000000011, &(0x7f0000000000), 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) waitid(0x0, 0x0, 0x0, 0x1000006, &(0x7f0000000280)) [ 984.543674][T14387] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x64}, 0x0) 04:06:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x65}, 0x0) 04:06:45 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpid() sched_setattr(r2, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) r3 = socket(0x8000000000000010, 0x0, 0x0) write(r3, &(0x7f0000002580)="24000000210005fb006b000420ed38200a19", 0x12) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c00090002080101000000f1020084200000050003006a00000006000240004c95aa264d8449f9d2b661a40400000600024088f500000500030011000000"], 0x3c}}, 0x10000000) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8}, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) ppoll(&(0x7f0000000140)=[{}, {r1}], 0x2, &(0x7f00000001c0)={0x0, r4+30000000}, 0x0, 0x0) [ 984.903066][ T9877] usb 1-1: new high-speed USB device number 57 using dummy_hcd 04:06:45 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 985.272998][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 985.282104][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 985.301395][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 985.335348][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 985.403383][T14429] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. [ 985.473186][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 985.482311][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 985.491150][ T9877] usb 1-1: Product: syz [ 985.496030][ T9877] usb 1-1: Manufacturer: syz [ 985.544225][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 985.549832][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 985.556840][ T9877] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:06:47 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x66}, 0x0) 04:06:47 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:47 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:06:47 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 987.492365][ T1881] usb 1-1: USB disconnect, device number 57 04:06:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x67}, 0x0) 04:06:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x68}, 0x0) [ 987.622891][T14462] ptrace attach of "/root/syz-executor.5"[14460] was attempted by "/root/syz-executor.5"[14462] [ 987.650700][T14464] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x69}, 0x0) 04:06:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6a}, 0x0) [ 987.943078][ T1881] usb 1-1: new high-speed USB device number 58 using dummy_hcd 04:06:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6b}, 0x0) 04:06:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 988.228287][T14488] ptrace attach of "/root/syz-executor.5"[14487] was attempted by "/root/syz-executor.5"[14488] [ 988.313644][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 988.326350][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 988.358039][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 988.404173][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 988.543461][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 988.559107][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 988.571872][ T1881] usb 1-1: Product: syz [ 988.583659][ T1881] usb 1-1: Manufacturer: syz [ 988.623668][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 988.629067][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 988.648755][ T1881] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:06:50 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:06:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf0}, 0x0) 04:06:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:06:50 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:50 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:50 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 990.551209][ T1886] usb 1-1: USB disconnect, device number 58 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x300}, 0x0) [ 990.673441][T14522] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 990.691120][T14526] ptrace attach of "/root/syz-executor.5"[14523] was attempted by "/root/syz-executor.5"[14526] 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x39d}, 0x0) 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x500}, 0x0) 04:06:51 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x700}, 0x0) [ 991.062998][ T1886] usb 1-1: new high-speed USB device number 59 using dummy_hcd 04:06:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_int(r0, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x900}, 0x0) 04:06:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 04:06:51 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 991.464073][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 991.479559][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 991.522959][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 991.532167][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 991.601948][T14561] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 991.703473][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 991.712834][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 991.743035][ T1886] usb 1-1: Product: syz [ 991.771949][ T1886] usb 1-1: Manufacturer: syz [ 991.818933][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 991.825850][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 991.831838][ T1886] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:06:53 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:53 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xb00}, 0x0) 04:06:53 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:06:53 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 993.625859][ T8639] usb 1-1: USB disconnect, device number 59 04:06:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xc00}, 0x0) [ 993.754323][T14591] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xd00}, 0x0) 04:06:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xe00}, 0x0) 04:06:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_int(r0, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 04:06:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xec0}, 0x0) 04:06:54 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) [ 994.111375][ T8639] usb 1-1: new high-speed USB device number 60 using dummy_hcd 04:06:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf00}, 0x0) [ 994.503527][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 994.518958][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 994.558043][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 994.603021][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 994.754013][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 994.763861][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 994.772260][ T8639] usb 1-1: Product: syz [ 994.781751][ T8639] usb 1-1: Manufacturer: syz [ 994.823627][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 994.829021][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 994.848091][ T8639] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:06:57 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1100}, 0x0) 04:06:57 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:06:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a000100"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:06:57 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) [ 996.699109][ T8639] usb 1-1: USB disconnect, device number 60 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1200}, 0x0) 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1300}, 0x0) [ 996.860801][T14654] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1400}, 0x0) 04:06:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_int(r0, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1500}, 0x0) 04:06:57 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) [ 997.193014][ T8639] usb 1-1: new high-speed USB device number 61 using dummy_hcd 04:06:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1600}, 0x0) [ 997.563737][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 997.572457][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 997.625855][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 997.640696][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 997.793888][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 997.804313][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 997.812729][ T8639] usb 1-1: Product: syz [ 997.821670][ T8639] usb 1-1: Manufacturer: syz [ 997.864012][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 997.869350][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 997.887598][ T8639] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:00 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB='S'], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1700}, 0x0) 04:07:00 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a000100"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:00 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) [ 999.776429][ T33] usb 1-1: USB disconnect, device number 61 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1800}, 0x0) [ 999.891245][T14708] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1900}, 0x0) 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1a00}, 0x0) 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1b00}, 0x0) 04:07:00 executing program 5: r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:00 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) [ 1000.276580][ T33] usb 1-1: new high-speed USB device number 62 using dummy_hcd 04:07:00 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1c00}, 0x0) [ 1000.643083][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1000.651801][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1000.693219][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1000.702376][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1000.742981][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1000.863158][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1000.873217][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1000.881540][ T33] usb 1-1: Product: syz [ 1000.890434][ T33] usb 1-1: Manufacturer: syz [ 1000.944112][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1000.949452][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1000.970896][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1001.496350][T14754] cdc_wdm 1-1:1.0: Error submitting int urb - -90 04:07:03 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1d00}, 0x0) 04:07:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a000100"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:03 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB='S'], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:03 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) [ 1002.850360][ T8639] usb 1-1: USB disconnect, device number 62 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1e00}, 0x0) [ 1002.984674][T14777] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1f00}, 0x0) 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2000}, 0x0) 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2100}, 0x0) [ 1003.293139][ T8639] usb 1-1: new high-speed USB device number 63 using dummy_hcd 04:07:03 executing program 5: r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:03 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2200}, 0x0) [ 1003.653193][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1003.662717][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.674725][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1003.683962][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 04:07:04 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2300}, 0x0) [ 1003.695118][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 04:07:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1003.823050][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1003.832683][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1003.845634][ T8639] usb 1-1: Product: syz [ 1003.850668][ T8639] usb 1-1: Manufacturer: syz [ 1003.860248][T14816] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1003.903954][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1003.909192][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1003.936508][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1004.455915][T14828] cdc_wdm 1-1:1.0: Error submitting int urb - -90 04:07:06 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB='S'], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:06 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2400}, 0x0) 04:07:06 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1005.917565][ T8639] usb 1-1: USB disconnect, device number 63 04:07:06 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1006.035567][T14853] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:06 executing program 5: r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2500}, 0x0) 04:07:06 executing program 2: setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x0) 04:07:06 executing program 2: setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x0) [ 1006.413005][ T8639] usb 1-1: new high-speed USB device number 64 using dummy_hcd 04:07:06 executing program 2: setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x0) 04:07:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2600}, 0x0) [ 1006.823591][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1006.832404][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1006.862987][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1006.872751][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1006.893204][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1007.033134][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1007.042320][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1007.053913][ T8639] usb 1-1: Product: syz [ 1007.058152][ T8639] usb 1-1: Manufacturer: syz [ 1007.113847][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1007.119160][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1007.140058][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1007.662763][T14894] cdc_wdm 1-1:1.0: Error submitting int urb - -90 04:07:09 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:09 executing program 2: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2700}, 0x0) 04:07:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:09 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1009.008043][ T1881] usb 1-1: USB disconnect, device number 64 04:07:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2800}, 0x0) [ 1009.140839][T14916] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:09 executing program 2: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2900}, 0x0) 04:07:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2a00}, 0x0) [ 1009.483110][ T1881] usb 1-1: new high-speed USB device number 65 using dummy_hcd 04:07:09 executing program 2: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2b00}, 0x0) [ 1009.673076][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1009.943086][ T1881] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1010.163016][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1010.283678][ T1881] usb usb1-port1: attempt power cycle [ 1011.023087][ T1881] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1011.213410][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1011.503076][ T1881] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1011.683679][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1011.803483][ T1881] usb usb1-port1: unable to enumerate USB device 04:07:12 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:12 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2c00}, 0x0) 04:07:12 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c61"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2d00}, 0x0) [ 1012.224074][T14963] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:12 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:12 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2e00}, 0x0) 04:07:12 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:12 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2f00}, 0x0) [ 1012.553003][ T8639] usb 1-1: new high-speed USB device number 69 using dummy_hcd 04:07:13 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1012.753057][ T8639] usb 1-1: device descriptor read/64, error 18 [ 1013.033275][ T8639] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1013.253412][ T8639] usb 1-1: device descriptor read/64, error 18 [ 1013.373581][ T8639] usb usb1-port1: attempt power cycle [ 1014.103088][ T8639] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1014.293174][ T8639] usb 1-1: device descriptor read/8, error -61 [ 1014.562998][ T8639] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 1014.733382][ T8639] usb 1-1: device descriptor read/8, error -61 [ 1014.853157][ T8639] usb usb1-port1: unable to enumerate USB device 04:07:15 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:15 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3000}, 0x0) 04:07:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:15 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c61"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:15 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3100}, 0x0) [ 1015.274529][T15012] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:15 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:15 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3200}, 0x0) 04:07:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x0, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1015.603189][ T1881] usb 1-1: new high-speed USB device number 73 using dummy_hcd 04:07:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3300}, 0x0) 04:07:16 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x0, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1015.803424][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1016.073056][ T1881] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1016.263193][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1016.383142][ T1881] usb usb1-port1: attempt power cycle [ 1017.103111][ T1881] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 1017.293412][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1017.563985][ T1881] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 1017.763113][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1017.883221][ T1881] usb usb1-port1: unable to enumerate USB device 04:07:18 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3400}, 0x0) 04:07:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x0, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:18 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:18 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c61"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3500}, 0x0) [ 1018.309552][T15057] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x0, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3600}, 0x0) 04:07:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3700}, 0x0) 04:07:19 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x0, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1018.673079][T21262] usb 1-1: new high-speed USB device number 77 using dummy_hcd 04:07:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3800}, 0x0) [ 1018.883027][T21262] usb 1-1: device descriptor read/64, error 18 [ 1019.153085][T21262] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 1019.363102][T21262] usb 1-1: device descriptor read/64, error 18 [ 1019.488933][T21262] usb usb1-port1: attempt power cycle [ 1020.203105][T21262] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 1020.373090][T21262] usb 1-1: device descriptor read/8, error -61 [ 1020.653093][T21262] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1020.833142][T21262] usb 1-1: device descriptor read/8, error -61 [ 1020.953225][T21262] usb usb1-port1: unable to enumerate USB device 04:07:21 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:21 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x0, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3900}, 0x0) 04:07:21 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:21 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3a00}, 0x0) [ 1021.348908][T15104] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:22 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x0, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3b00}, 0x0) 04:07:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3c00}, 0x0) 04:07:22 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x0, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1021.703091][ T1881] usb 1-1: new high-speed USB device number 81 using dummy_hcd 04:07:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3d00}, 0x0) [ 1021.893048][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1022.163129][ T1881] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1022.353063][ T1881] usb 1-1: device descriptor read/64, error 18 [ 1022.473552][ T1881] usb usb1-port1: attempt power cycle [ 1023.183046][ T1881] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1023.353100][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1023.623037][ T1881] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1023.793169][ T1881] usb 1-1: device descriptor read/8, error -61 [ 1023.913393][ T1881] usb usb1-port1: unable to enumerate USB device 04:07:24 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:24 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x0, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3e00}, 0x0) 04:07:24 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:24 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:24 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1024.386320][T15148] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3f00}, 0x0) 04:07:25 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:25 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4000}, 0x0) [ 1024.773972][ T33] usb 1-1: new high-speed USB device number 85 using dummy_hcd 04:07:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4100}, 0x0) [ 1024.983126][ T33] usb 1-1: device descriptor read/64, error 18 [ 1025.253117][ T33] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1025.473046][ T33] usb 1-1: device descriptor read/64, error 18 [ 1025.603658][ T33] usb usb1-port1: attempt power cycle [ 1026.343059][ T33] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1026.543082][ T33] usb 1-1: device descriptor read/8, error -61 [ 1026.823037][ T33] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1026.993106][ T33] usb 1-1: device descriptor read/8, error -61 [ 1027.113391][ T33] usb usb1-port1: unable to enumerate USB device 04:07:27 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:27 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4200}, 0x0) 04:07:27 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:27 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4300}, 0x0) [ 1027.451644][T15196] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:28 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4400}, 0x0) 04:07:28 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4500}, 0x0) [ 1027.822141][ T33] usb 1-1: new high-speed USB device number 89 using dummy_hcd 04:07:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4600}, 0x0) 04:07:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4700}, 0x0) [ 1028.211771][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1028.234424][ T33] usb 1-1: config 1 has an invalid descriptor of length 83, skipping remainder of the config [ 1028.251150][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1028.264338][ T33] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1028.403263][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1028.412766][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1028.425993][ T33] usb 1-1: Product: syz [ 1028.430395][ T33] usb 1-1: Manufacturer: syz [ 1028.473859][ T33] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:30 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4800}, 0x0) 04:07:30 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:30 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:30 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1030.390028][ T33] usb 1-1: USB disconnect, device number 89 04:07:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4900}, 0x0) 04:07:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4a00}, 0x0) 04:07:31 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4b00}, 0x0) 04:07:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4c00}, 0x0) [ 1030.853143][ T33] usb 1-1: new high-speed USB device number 90 using dummy_hcd 04:07:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4d00}, 0x0) [ 1031.223728][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1031.238110][ T33] usb 1-1: config 1 has an invalid descriptor of length 83, skipping remainder of the config [ 1031.260328][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1031.274625][ T33] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1031.433611][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1031.444681][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1031.452656][ T33] usb 1-1: Product: syz [ 1031.456885][ T33] usb 1-1: Manufacturer: syz [ 1031.503929][ T33] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:33 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4e00}, 0x0) 04:07:33 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:33 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:33 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1033.465069][ T33] usb 1-1: USB disconnect, device number 90 04:07:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4f00}, 0x0) 04:07:34 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = dup(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:07:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5000}, 0x0) 04:07:34 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5100}, 0x0) [ 1033.933368][ T33] usb 1-1: new high-speed USB device number 91 using dummy_hcd 04:07:34 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1034.323657][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1034.341100][ T33] usb 1-1: config 1 has an invalid descriptor of length 83, skipping remainder of the config [ 1034.363461][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1034.383089][ T33] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1034.533555][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1034.543623][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1034.551898][ T33] usb 1-1: Product: syz [ 1034.561138][ T33] usb 1-1: Manufacturer: syz [ 1034.614165][ T33] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:36 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f0100000400", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5200}, 0x0) 04:07:36 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:36 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:36 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1036.525442][ T8639] usb 1-1: USB disconnect, device number 91 04:07:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5300}, 0x0) 04:07:37 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:37 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5400}, 0x0) 04:07:37 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:37 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5500}, 0x0) [ 1037.033285][ T8639] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1037.393188][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1037.402109][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1037.417958][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1037.436293][ T8639] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1037.573570][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1037.583099][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1037.591116][ T8639] usb 1-1: Product: syz [ 1037.600124][ T8639] usb 1-1: Manufacturer: syz [ 1037.643958][ T8639] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:39 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f0100000400", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:39 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5600}, 0x0) 04:07:39 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:39 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1039.596318][ T33] usb 1-1: USB disconnect, device number 92 04:07:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5700}, 0x0) 04:07:40 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5800}, 0x0) 04:07:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 04:07:40 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5900}, 0x0) [ 1040.096046][ T33] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1040.493629][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1040.502438][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1040.525121][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1040.543008][ T33] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1040.704119][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1040.713484][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1040.721631][ T33] usb 1-1: Product: syz [ 1040.731456][ T33] usb 1-1: Manufacturer: syz [ 1040.794177][ T33] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:43 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f0100000400", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:43 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:43 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(0x0, 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5a00}, 0x0) 04:07:43 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1042.676922][T21262] usb 1-1: USB disconnect, device number 93 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5b00}, 0x0) 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5c00}, 0x0) 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5d00}, 0x0) 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5e00}, 0x0) 04:07:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5f00}, 0x0) 04:07:43 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(0x0, 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1043.163225][T21262] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 1043.533153][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1043.563186][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1043.582300][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1043.600188][T21262] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1043.739631][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1043.749043][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1043.763199][T21262] usb 1-1: Product: syz [ 1043.768835][T21262] usb 1-1: Manufacturer: syz [ 1043.814113][T21262] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:46 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6000}, 0x0) 04:07:46 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(0x0, 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:46 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:46 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1045.761823][T21262] usb 1-1: USB disconnect, device number 94 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6100}, 0x0) 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6200}, 0x0) 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6300}, 0x0) 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6400}, 0x0) 04:07:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6500}, 0x0) 04:07:46 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1046.253128][T21262] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1046.643219][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1046.652388][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1046.684889][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1046.699849][T21262] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1046.836065][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1046.845439][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1046.853534][T21262] usb 1-1: Product: syz [ 1046.857690][T21262] usb 1-1: Manufacturer: syz [ 1046.904387][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1046.909772][T21262] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:49 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6558}, 0x0) 04:07:49 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) 04:07:49 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:49 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1048.835315][T21262] usb 1-1: USB disconnect, device number 95 04:07:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6600}, 0x0) 04:07:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1048.965018][T15605] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6700}, 0x0) 04:07:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6800}, 0x0) 04:07:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6900}, 0x0) 04:07:49 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) [ 1049.313157][T21262] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 1049.723619][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1049.732493][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1049.755225][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1049.783469][T21262] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1049.919073][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1049.928932][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1049.942077][T21262] usb 1-1: Product: syz [ 1049.947358][T21262] usb 1-1: Manufacturer: syz [ 1050.003959][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1050.009421][T21262] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:52 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6a00}, 0x0) 04:07:52 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) 04:07:52 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:52 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1051.904931][T21202] usb 1-1: USB disconnect, device number 96 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6b00}, 0x0) [ 1052.047640][T15666] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x8100}, 0x0) 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x9d03}, 0x0) 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) 04:07:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf000}, 0x0) 04:07:52 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) [ 1052.393164][T21202] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 1052.813643][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1052.822567][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.853131][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1052.862462][T21202] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1053.013351][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1053.023089][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1053.031861][T21202] usb 1-1: Product: syz [ 1053.041806][T21202] usb 1-1: Manufacturer: syz [ 1053.104059][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1053.109420][T21202] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:55 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xff00}, 0x0) 04:07:55 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) 04:07:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:55 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:07:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1054.993672][ T9877] usb 1-1: USB disconnect, device number 97 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x34000}, 0x0) [ 1055.129756][T15722] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x400300}, 0x0) 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 04:07:55 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) 04:07:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 1055.493214][ T9877] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1055.863219][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1055.871945][ T9877] usb 1-1: config 1 has an invalid descriptor of length 243, skipping remainder of the config [ 1055.900667][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1055.914520][ T9877] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1056.043793][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1056.053937][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1056.062012][ T9877] usb 1-1: Product: syz [ 1056.079160][ T9877] usb 1-1: Manufacturer: syz [ 1056.143904][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1056.149224][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1056.155399][ T9877] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:07:58 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:07:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3000000}, 0x0) 04:07:58 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) 04:07:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:07:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b0568000800", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:07:58 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1058.049730][T21262] usb 1-1: USB disconnect, device number 98 04:07:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4000000}, 0x0) 04:07:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1058.165931][T15774] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5000000}, 0x0) 04:07:58 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x8, 0x210000, 0x8}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x34, &(0x7f0000000080), 0x4) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) 04:07:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6000000}, 0x0) 04:07:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x7000000}, 0x0) [ 1058.533275][T21262] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1058.893614][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1058.902780][T21262] usb 1-1: config 1 has an invalid descriptor of length 243, skipping remainder of the config [ 1058.931219][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1058.944263][T21262] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1059.085548][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1059.096078][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1059.115459][T21262] usb 1-1: Product: syz [ 1059.119729][T21262] usb 1-1: Manufacturer: syz [ 1059.173961][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1059.179458][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1059.200043][T21262] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:01 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) 04:08:01 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffc000/0x4000)=nil) 04:08:01 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300), 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:08:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b0568000800", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1061.122555][T21202] usb 1-1: USB disconnect, device number 99 04:08:01 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file1\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000780), 0x102b) open$dir(&(0x7f0000000000)='./file0/file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002840)={0x90, 0x0, 0x2}, 0x90) read$FUSE(r0, &(0x7f00000029c0), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x90) 04:08:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x9000000}, 0x0) [ 1061.215525][T15836] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xa000000}, 0x0) 04:08:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xb000000}, 0x0) 04:08:01 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xc000000}, 0x0) [ 1061.543294][T21202] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1061.963272][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1061.971973][T21202] usb 1-1: config 1 has an invalid descriptor of length 243, skipping remainder of the config [ 1062.006067][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1062.023425][T21202] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1062.173709][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1062.183199][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1062.191240][T21202] usb 1-1: Product: syz [ 1062.204122][T21202] usb 1-1: Manufacturer: syz [ 1062.264118][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1062.269540][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1062.286466][T21202] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:04 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a0000000480020009", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xd000000}, 0x0) 04:08:04 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300), 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:08:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b0568000800", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:04 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$UHID_DESTROY(r0, &(0x7f0000000100), 0x4) 04:08:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1064.188846][ T9877] usb 1-1: USB disconnect, device number 100 04:08:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xe000000}, 0x0) 04:08:04 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') open$dir(0x0, 0x4002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1064.317675][T15896] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf000000}, 0x0) 04:08:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1064.683417][ T9877] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1065.080221][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1065.093599][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1065.115243][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1065.127793][ T9877] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1065.283445][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1065.293909][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1065.301880][ T9877] usb 1-1: Product: syz [ 1065.308380][ T9877] usb 1-1: Manufacturer: syz [ 1065.353896][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1065.359399][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1065.373700][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1065.383460][ T9877] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:07 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a0000000480020009", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x10000000}, 0x0) 04:08:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') open$dir(0x0, 0x4002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:07 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300), 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:08:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1067.276093][ T8639] usb 1-1: USB disconnect, device number 101 04:08:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) 04:08:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x12000000}, 0x0) [ 1067.427118][T15951] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') open$dir(0x0, 0x4002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1067.814830][ T8639] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1068.213708][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1068.222348][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1068.245373][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1068.265644][ T8639] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1068.424222][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1068.434330][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1068.442515][ T8639] usb 1-1: Product: syz [ 1068.446790][ T8639] usb 1-1: Manufacturer: syz [ 1068.483890][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1068.489289][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1068.509797][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1068.515371][ T8639] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:10 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a0000000480020009", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x13000000}, 0x0) 04:08:10 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') open$dir(0x0, 0x4002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:10 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 04:08:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1070.353294][ T8639] usb 1-1: USB disconnect, device number 102 04:08:10 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x14000000}, 0x0) [ 1070.480499][T16004] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:10 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') open$dir(0x0, 0x4002, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:11 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:11 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x15000000}, 0x0) [ 1070.853405][ T8639] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1071.213326][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1071.233160][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.263180][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1071.272764][ T8639] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1071.403323][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1071.413493][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1071.421680][ T8639] usb 1-1: Product: syz [ 1071.426406][ T8639] usb 1-1: Manufacturer: syz [ 1071.474251][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1071.479998][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1071.486694][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1071.492818][ T8639] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:13 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002000905", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:13 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x16000000}, 0x0) 04:08:13 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 04:08:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1073.444485][T21202] usb 1-1: USB disconnect, device number 103 04:08:13 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x17000000}, 0x0) 04:08:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1073.581258][T16057] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:14 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:14 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x18000000}, 0x0) [ 1073.903266][T21202] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1074.263244][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1074.272274][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1074.289155][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1074.298253][T21202] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x53, skipping [ 1074.433342][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1074.447215][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1074.455381][T21202] usb 1-1: Product: syz [ 1074.460215][T21202] usb 1-1: Manufacturer: syz [ 1074.503895][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1074.509228][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1074.528733][T21202] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:16 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002000905", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:16 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x19000000}, 0x0) 04:08:16 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff81", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:16 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) [ 1076.491398][ T1881] usb 1-1: USB disconnect, device number 104 04:08:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1a000000}, 0x0) 04:08:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1076.616105][T16109] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1b000000}, 0x0) 04:08:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1c000000}, 0x0) 04:08:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1076.973224][ T1881] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1077.383906][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1077.393744][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1077.409731][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1077.422400][ T1881] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x53, skipping [ 1077.553770][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1077.563210][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1077.571186][ T1881] usb 1-1: Product: syz [ 1077.577129][ T1881] usb 1-1: Manufacturer: syz [ 1077.634131][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1077.639448][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1077.646985][ T1881] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:19 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a000000048002000905", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1d000000}, 0x0) 04:08:19 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:19 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:19 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, 0x0, 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:08:19 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff81", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1079.541267][ T9877] usb 1-1: USB disconnect, device number 105 04:08:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1e000000}, 0x0) [ 1079.661715][T16160] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x1f000000}, 0x0) 04:08:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x20000000}, 0x0) 04:08:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x21000000}, 0x0) [ 1080.043311][ T9877] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1080.423747][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1080.432560][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1080.443724][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1080.463188][ T9877] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x53, skipping [ 1080.593296][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1080.603464][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1080.611902][ T9877] usb 1-1: Product: syz [ 1080.618279][ T9877] usb 1-1: Manufacturer: syz [ 1080.664116][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1080.669442][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1080.676441][ T9877] cdc_wdm: probe of 1-1:1.0 failed with error -22 04:08:22 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:22 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x22000000}, 0x0) 04:08:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:22 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, 0x0, 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 04:08:22 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff81", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1082.628175][ T8639] usb 1-1: USB disconnect, device number 106 04:08:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x23000000}, 0x0) [ 1082.747404][T16211] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 04:08:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x24000000}, 0x0) 04:08:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x25000000}, 0x0) 04:08:23 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1083.123314][ T8639] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1083.503257][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1083.512419][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1083.528777][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1083.540961][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1083.675245][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1083.684462][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1083.692427][ T8639] usb 1-1: Product: syz [ 1083.702450][ T8639] usb 1-1: Manufacturer: syz [ 1083.743954][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1083.749375][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1083.762641][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1084.303226][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1084.323194][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:08:26 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x26000000}, 0x0) 04:08:26 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:26 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:26 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:26 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, 0x0, 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 1085.865009][ T9877] usb 1-1: USB disconnect, device number 107 04:08:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x27000000}, 0x0) 04:08:26 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x28000000}, 0x0) 04:08:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x29000000}, 0x0) 04:08:26 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2a000000}, 0x0) [ 1086.365107][ T9877] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1086.726285][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1086.741228][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1086.813464][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1086.822843][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1086.973607][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1086.983332][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1086.991389][ T9877] usb 1-1: Product: syz [ 1087.001176][ T9877] usb 1-1: Manufacturer: syz [ 1087.043963][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1087.053466][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1087.063821][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1087.613301][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1087.633210][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:08:29 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:29 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2b000000}, 0x0) 04:08:29 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r0, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) 04:08:29 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:29 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) [ 1089.228923][ T1881] usb 1-1: USB disconnect, device number 108 04:08:29 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2c000000}, 0x0) 04:08:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2d000000}, 0x0) 04:08:29 executing program 2: perf_event_open(&(0x7f0000000480)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2e000000}, 0x0) 04:08:29 executing program 2: perf_event_open(&(0x7f0000000480)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x2f000000}, 0x0) [ 1089.672438][ T1881] usb 1-1: new high-speed USB device number 109 using dummy_hcd 04:08:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:30 executing program 2: perf_event_open(&(0x7f0000000480)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1090.053395][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1090.075729][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config 04:08:30 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r0, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) [ 1090.098034][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1090.123436][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1090.294703][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1090.304134][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1090.312109][ T1881] usb 1-1: Product: syz [ 1090.323404][ T1881] usb 1-1: Manufacturer: syz [ 1090.384150][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1090.389926][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1090.405517][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1090.953216][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1090.983228][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:08:32 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x30000000}, 0x0) 04:08:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:32 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:32 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:32 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r0, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) [ 1092.605693][ T9877] usb 1-1: USB disconnect, device number 109 04:08:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x31000000}, 0x0) 04:08:33 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:33 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x32000000}, 0x0) 04:08:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x33000000}, 0x0) 04:08:33 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:33 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x34000000}, 0x0) [ 1093.093286][ T9877] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1093.473310][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1093.482952][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1093.495455][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1093.505278][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1093.634673][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1093.650006][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1093.663722][ T9877] usb 1-1: Product: syz [ 1093.668080][ T9877] usb 1-1: Manufacturer: syz [ 1093.714176][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1093.719593][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1093.729796][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1094.633227][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1094.653260][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1094.723293][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x35000000}, 0x0) 04:08:36 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:36 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:36 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:08:36 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 04:08:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x36000000}, 0x0) [ 1096.239106][T21262] usb 1-1: USB disconnect, device number 110 04:08:36 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x37000000}, 0x0) 04:08:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x38000000}, 0x0) 04:08:36 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x39000000}, 0x0) 04:08:36 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1096.733434][T21262] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1097.163806][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1097.172920][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1097.185172][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1097.194543][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1097.353782][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1097.363777][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1097.372036][T21262] usb 1-1: Product: syz [ 1097.377236][T21262] usb 1-1: Manufacturer: syz [ 1097.434187][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1097.439501][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1097.447718][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1098.353244][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1098.373234][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1098.433265][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:39 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:40 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3a000000}, 0x0) 04:08:40 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:08:40 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 04:08:40 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1099.894727][ T1881] usb 1-1: USB disconnect, device number 111 04:08:40 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3b000000}, 0x0) 04:08:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3c000000}, 0x0) 04:08:40 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:40 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1100.373277][ T1881] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1100.733778][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1100.763251][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1100.779587][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1100.791847][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1100.923407][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1100.933362][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1100.941612][ T1881] usb 1-1: Product: syz [ 1100.951258][ T1881] usb 1-1: Manufacturer: syz [ 1100.994137][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1100.999443][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1101.019903][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device 04:08:42 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3d000000}, 0x0) [ 1101.933259][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1101.953243][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1102.013249][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:43 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:43 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:43 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 04:08:43 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:08:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3e000000}, 0x0) 04:08:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1103.478087][ T1881] usb 1-1: USB disconnect, device number 112 04:08:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x3f000000}, 0x0) 04:08:43 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x40000000}, 0x0) 04:08:44 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x41000000}, 0x0) 04:08:44 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) [ 1103.953327][ T1881] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1104.333771][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1104.342585][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1104.362138][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1104.374347][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1104.503360][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1104.512622][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1104.522589][ T1881] usb 1-1: Product: syz [ 1104.526820][ T1881] usb 1-1: Manufacturer: syz [ 1104.574515][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1104.579921][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1104.587282][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1105.493273][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1105.513305][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1105.593234][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:47 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x42000000}, 0x0) 04:08:47 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0, 0x0) 04:08:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:47 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, 0x0, 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:47 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) [ 1107.074101][ T1881] usb 1-1: USB disconnect, device number 113 04:08:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x43000000}, 0x0) 04:08:47 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, 0x0, 0x0, 0x0, 0x0) 04:08:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x44000000}, 0x0) 04:08:47 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, 0x0, 0x0, 0x0, 0x0) 04:08:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x45000000}, 0x0) 04:08:47 executing program 2: perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') preadv(r1, 0x0, 0x0, 0x0, 0x0) [ 1107.594496][ T1881] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1107.965144][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1107.974696][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1107.989096][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1108.007274][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1108.164057][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1108.173363][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1108.181327][ T1881] usb 1-1: Product: syz [ 1108.185540][ T1881] usb 1-1: Manufacturer: syz [ 1108.224279][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1108.229516][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1108.250446][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1109.143253][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1109.163373][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1109.233273][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:51 executing program 2: syz_emit_ethernet(0x8a, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "209200", 0x54, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x400000000000007f, 0x0, 0x0, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x5}, @mss={0x2, 0x4, 0x2}, @sack_perm={0x4, 0x2}, @timestamp={0x8, 0xc}, @mptcp=@synack={0x1e, 0x10}, @window={0x3, 0x3}, @sack={0x5, 0x6, [0x0]}, @mptcp=@mp_fclose={0x1e, 0xc}, @exp_fastopen={0xfe, 0x4}]}}}}}}}}, 0x0) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x46000000}, 0x0) 04:08:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:51 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 04:08:51 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, 0x0, 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:51 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) [ 1110.755122][ T1886] usb 1-1: USB disconnect, device number 114 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x47000000}, 0x0) 04:08:51 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x80000002}, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000000)={@private1}, 0x14) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x44804}, 0x20020000) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x48000000}, 0x0) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x49000000}, 0x0) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4a000000}, 0x0) [ 1111.223446][ T1886] usb 1-1: new high-speed USB device number 115 using dummy_hcd 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4b000000}, 0x0) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4c000000}, 0x0) 04:08:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4d000000}, 0x0) [ 1111.593360][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1111.621714][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config 04:08:52 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x0, 0x2088}, 0x14) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xffffff2b) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) [ 1111.706513][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1111.763331][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1111.933936][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1111.947888][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1111.957016][ T1886] usb 1-1: Product: syz [ 1111.962087][ T1886] usb 1-1: Manufacturer: syz [ 1112.008471][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1112.027808][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1112.054200][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1112.933478][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1112.953276][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 [ 1113.033355][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -EPIPE 04:08:54 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, 0x0, 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 04:08:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4e000000}, 0x0) 04:08:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:54 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x80000002}, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000000)={@private1}, 0x14) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x44804}, 0x20020000) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:08:54 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000001300)='/dev/ptmx\x00', 0x202, 0x0) [ 1114.569495][ T33] usb 1-1: USB disconnect, device number 115 04:08:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x4f000000}, 0x0) 04:08:55 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000001300)='/dev/ptmx\x00', 0x202, 0x0) 04:08:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x50000000}, 0x0) 04:08:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x51000000}, 0x0) 04:08:55 executing program 3: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TIOCSERGETLSR(r0, 0x5453, 0x0) 04:08:55 executing program 3: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @random="70de564a6bdf", @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0xc, 0x7, 0x3, 0x0, [{@multicast2}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0) [ 1115.084417][ T33] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1115.464345][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1115.486128][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1115.533268][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1115.572084][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1115.733483][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1115.742739][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1115.794212][ T33] usb 1-1: Product: syz [ 1115.798586][ T33] usb 1-1: Manufacturer: syz [ 1115.874310][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1115.880061][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1115.909820][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1116.783290][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1116.803282][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:08:58 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:08:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x52000000}, 0x0) 04:08:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='net/ip_mr_vif\x00') sendfile(r0, r1, 0x0, 0x800000080004105) 04:08:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:08:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:08:58 executing program 2: sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x185180, 0x87) dup3(r1, r0, 0x0) io_setup(0x40000000008, &(0x7f0000000240)=0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) perf_event_open(&(0x7f0000000480)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 1118.375615][ T1886] usb 1-1: USB disconnect, device number 116 04:08:58 executing program 3: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x0, 0x9fee, 0x0, 0x3, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = open(0x0, 0x0, 0x0) fchdir(r1) open(0x0, 0x20000, 0x334) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xe) [ 1118.480597][ T34] audit: type=1804 audit(1606709338.823:41): pid=16846 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1964/bus" dev="sda1" ino=16315 res=1 errno=0 04:08:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x53000000}, 0x0) [ 1118.531283][ T34] audit: type=1800 audit(1606709338.823:42): pid=16846 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16315 res=0 errno=0 04:08:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x54000000}, 0x0) [ 1118.598951][ T34] audit: type=1804 audit(1606709338.833:43): pid=16846 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1964/bus" dev="sda1" ino=16315 res=1 errno=0 [ 1118.614911][T16860] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 1118.675823][ T34] audit: type=1804 audit(1606709338.933:44): pid=16854 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1964/bus" dev="sda1" ino=16315 res=1 errno=0 [ 1118.689762][T16860] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 04:08:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) [ 1118.750945][ T34] audit: type=1800 audit(1606709338.933:45): pid=16854 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16315 res=0 errno=0 [ 1118.826224][T16860] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 04:08:59 executing program 2: clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = getpid() r3 = gettid() tkill(r3, 0x14) perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace(0x4206, r2) [ 1118.856628][ T34] audit: type=1804 audit(1606709338.933:46): pid=16846 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir748722649/syzkaller.if4VWn/1964/bus" dev="sda1" ino=16315 res=1 errno=0 [ 1118.884064][ T1886] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1118.901812][T16860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 04:08:59 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1118.944336][T16860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1119.139681][T16863] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 1119.155353][T16863] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1119.213127][T16863] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1119.249938][T16863] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1119.288546][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1119.298441][T16863] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1119.303065][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1119.341473][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1119.362503][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1119.533860][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1119.544849][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1119.559134][ T1886] usb 1-1: Product: syz [ 1119.568384][ T1886] usb 1-1: Manufacturer: syz [ 1119.615916][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1119.621340][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1119.644777][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1120.523343][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1120.543321][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:02 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x55000000}, 0x0) 04:09:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:09:02 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000380)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)='./bus\x00') 04:09:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(0x0, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:09:02 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r2, 0x107, 0x13, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 1122.118006][ T8639] usb 1-1: USB disconnect, device number 117 04:09:02 executing program 2: clone(0x10408100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000100)='-vboxneT0\x00]#wb\xac0E@!N%\xf73\xde\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xfe)\xdd\x8f\x98\xe8\xbe\x16\xc5-\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\x03\x00\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8r\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddp>\xd7\x9f\xf8r\xeeE\xa8%K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2(\x8c*\xff\x8aA\xa1\x153\x15\b\x00\x00\xef\xc4\xa6\xc7c@\xb5?\xa2\x1e\xe8\xad\xd9ht\x02~\x05B{\xe2\xb6\xebh\xa2\xdd_{\xdc\xf2\x84\x14s\xfe\xd6\xe8\xb8\x14y\x1cg\xf9\xc0\xc5hv\x00\x00\x00\x00\x00\x00\x00\a~\x9c+\x03\xf1\x01\xaf\xf5g\xf7WfI\xe9\xceg\b\\\xee4\x1aW\xcf\xb9\x85n\xf7/\f\x16Wy', 0x0) ftruncate(r0, 0x1000000) finit_module(r0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000280)="1c0000001a009b8a140000003b9b301f00"/28, 0x32) recvmmsg(r1, &(0x7f0000002ec0), 0x400000000000ec0, 0xa, &(0x7f00000001c0)={0x77359400}) 04:09:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x56000000}, 0x0) 04:09:02 executing program 3: setitimer(0x1, &(0x7f0000000000)={{}, {0x0, 0x2710}}, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000200)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) dup(0xffffffffffffffff) perf_event_open$cgroup(&(0x7f0000000140)={0x3, 0x70, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000000c0)={0x0, 0x375, 0xaa8d}) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9281a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 04:09:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x57000000}, 0x0) 04:09:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x58000000}, 0x0) 04:09:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x59000000}, 0x0) [ 1122.587837][T16927] Module has invalid ELF header [ 1122.606277][ T8639] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1122.973457][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1122.983169][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1122.999920][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1123.012580][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1123.143459][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1123.152999][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1123.163219][ T8639] usb 1-1: Product: syz [ 1123.168104][ T8639] usb 1-1: Manufacturer: syz [ 1123.214135][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1123.219651][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1123.234851][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1124.123365][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1124.143303][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:06 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5a000000}, 0x0) 04:09:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:09:06 executing program 2: clone(0x10408100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000100)='-vboxneT0\x00]#wb\xac0E@!N%\xf73\xde\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xfe)\xdd\x8f\x98\xe8\xbe\x16\xc5-\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\x03\x00\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8r\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddp>\xd7\x9f\xf8r\xeeE\xa8%K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2(\x8c*\xff\x8aA\xa1\x153\x15\b\x00\x00\xef\xc4\xa6\xc7c@\xb5?\xa2\x1e\xe8\xad\xd9ht\x02~\x05B{\xe2\xb6\xebh\xa2\xdd_{\xdc\xf2\x84\x14s\xfe\xd6\xe8\xb8\x14y\x1cg\xf9\xc0\xc5hv\x00\x00\x00\x00\x00\x00\x00\a~\x9c+\x03\xf1\x01\xaf\xf5g\xf7WfI\xe9\xceg\b\\\xee4\x1aW\xcf\xb9\x85n\xf7/\f\x16Wy', 0x0) ftruncate(r0, 0x1000000) finit_module(r0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000280)="1c0000001a009b8a140000003b9b301f00"/28, 0x32) recvmmsg(r1, &(0x7f0000002ec0), 0x400000000000ec0, 0xa, &(0x7f00000001c0)={0x77359400}) 04:09:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe6, 0x0) 04:09:06 executing program 3: r0 = socket(0x2, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000004c0)={&(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x18, 0x0, 0x7, {[@end, @timestamp_addr={0x44, 0x4}]}}}], 0x18}, 0x0) [ 1125.669102][ T8639] usb 1-1: USB disconnect, device number 118 04:09:06 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x6, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='clear_refs\x00') r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') sendfile(r3, r4, 0x0, 0x1) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000001c0)=0x0) perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x6, 0x3, 0x1c, 0x3f, 0x0, 0xffffffff, 0x2000, 0x8, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x8f4, 0x0, @perf_bp={&(0x7f00000000c0), 0xe}, 0x10, 0x8, 0x7962, 0x0, 0xa66, 0x0, 0xd62d}, r5, 0xa, r0, 0x3) keyctl$negate(0xd, r1, 0x3, r2) r6 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sysvipc/sem\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x4000000000010046) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) getsockname$packet(r6, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x12a8}, 0x0) 04:09:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5b000000}, 0x0) 04:09:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5c000000}, 0x0) 04:09:06 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5d000000}, 0x0) [ 1126.087058][T16980] Module has invalid ELF header 04:09:06 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) [ 1126.143502][ T8639] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1126.563522][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1126.583361][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1126.599954][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1126.612615][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1126.777953][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1126.787625][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1126.801618][ T8639] usb 1-1: Product: syz [ 1126.807864][ T8639] usb 1-1: Manufacturer: syz [ 1126.884052][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1126.889682][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1126.904860][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1127.793324][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1127.813317][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:09 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5e000000}, 0x0) 04:09:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:09 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:09:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) [ 1129.388623][ T33] usb 1-1: USB disconnect, device number 119 04:09:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x5f000000}, 0x0) 04:09:09 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x60000000}, 0x0) 04:09:09 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x61000000}, 0x0) 04:09:10 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x62000000}, 0x0) [ 1129.863407][ T33] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1130.294007][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1130.302811][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1130.319315][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1130.332280][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1130.513416][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1130.522625][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1130.533165][ T33] usb 1-1: Product: syz [ 1130.537823][ T33] usb 1-1: Manufacturer: syz [ 1130.594891][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1130.600312][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1130.608567][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1131.513312][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1131.543331][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:13 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:13 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x63000000}, 0x0) 04:09:13 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:09:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) [ 1133.104646][ T8639] usb 1-1: USB disconnect, device number 120 04:09:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x64000000}, 0x0) 04:09:13 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x65000000}, 0x0) 04:09:13 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x65580000}, 0x0) 04:09:13 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) [ 1133.604271][ T8639] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1134.033554][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1134.043229][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1134.059623][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1134.070738][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1134.214938][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1134.224285][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1134.232459][ T8639] usb 1-1: Product: syz [ 1134.242614][ T8639] usb 1-1: Manufacturer: syz [ 1134.294136][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1134.299437][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1134.307636][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1135.223318][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1135.243353][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:17 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x66000000}, 0x0) 04:09:17 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 04:09:17 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) [ 1136.796025][T21262] usb 1-1: USB disconnect, device number 121 04:09:17 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x67000000}, 0x0) 04:09:17 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x68000000}, 0x0) 04:09:17 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x69000000}, 0x0) [ 1137.253495][T21262] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1137.661641][T21262] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1137.677335][T21262] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1137.712869][T21262] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1137.736405][T21262] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1137.934006][T21262] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1137.950889][T21262] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1137.974693][T21262] usb 1-1: Product: syz [ 1138.003227][T21262] usb 1-1: Manufacturer: syz [ 1138.066006][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1138.071399][T21262] cdc_wdm 1-1:1.0: skipping garbage [ 1138.108758][T21262] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1138.973349][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1138.993342][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6a000000}, 0x0) 04:09:20 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:20 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 04:09:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:20 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:20 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 1140.586036][ T9877] usb 1-1: USB disconnect, device number 122 04:09:21 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x6b000000}, 0x0) 04:09:21 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x81000000}, 0x0) 04:09:21 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) 04:09:21 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x9d030000}, 0x0) [ 1141.073337][ T9877] usb 1-1: new high-speed USB device number 123 using dummy_hcd 04:09:21 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) [ 1141.464077][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1141.503470][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1141.560071][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1141.601907][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 04:09:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) [ 1141.796443][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1141.823364][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1141.832346][ T9877] usb 1-1: Product: syz [ 1141.844362][ T9877] usb 1-1: Manufacturer: syz [ 1141.894247][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1141.899480][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1141.934848][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1142.813331][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1142.833324][ C0] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:24 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:24 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000240)={@mcast2}, 0x14) 04:09:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 04:09:24 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0xc, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 04:09:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 04:09:24 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 1144.354874][ T1881] usb 1-1: USB disconnect, device number 123 04:09:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) 04:09:24 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, 0x0, 0x0) 04:09:25 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, 0x0, 0x0) 04:09:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 04:09:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xff000000}, 0x0) 04:09:25 executing program 3: shmat(0x0, &(0x7f0000000000/0x1000)=nil, 0x7000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, 0x0, 0x0) [ 1144.863369][ T1881] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1145.243573][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1145.256762][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1145.280259][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1145.292829][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1145.423520][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1145.433221][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1145.443136][ T1881] usb 1-1: Product: syz [ 1145.448144][ T1881] usb 1-1: Manufacturer: syz [ 1145.494128][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1145.499536][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1145.520580][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1146.403332][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1146.423377][ C1] cdc_wdm 1-1:1.0: unknown notification 140 received: index 42101 len 41787 04:09:28 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 04:09:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000040)) 04:09:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 04:09:28 executing program 4: openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000000240)=""/4102, 0x1006}], 0x1, 0x0, 0x0) r0 = getpid() r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x7cf8bf, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x40000005}) sched_setattr(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, 0x3, 0x8, 0x0, 0x2, 0xc6}, 0x0) rt_sigqueueinfo(r0, 0xf, &(0x7f0000000140)={0x37, 0x6, 0x182}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0xf2, 0x3000000, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x1c) 04:09:28 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) [ 1147.944265][ T1881] usb 1-1: USB disconnect, device number 124 04:09:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 04:09:28 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0) 04:09:28 executing program 4: openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000000240)=""/4102, 0x1006}], 0x1, 0x0, 0x0) r0 = getpid() r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x7cf8bf, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x40000005}) sched_setattr(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, 0x3, 0x8, 0x0, 0x2, 0xc6}, 0x0) rt_sigqueueinfo(r0, 0xf, &(0x7f0000000140)={0x37, 0x6, 0x182}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0xf2, 0x3000000, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x1c) 04:09:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 04:09:28 executing program 3: openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000000240)=""/4102, 0x1006}], 0x1, 0x0, 0x0) r0 = getpid() r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x7cf8bf, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x40000005}) sched_setattr(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, 0x3, 0x8, 0x0, 0x2, 0xc6}, 0x0) rt_sigqueueinfo(r0, 0xf, &(0x7f0000000140)={0x37, 0x6, 0x182}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0xf2, 0x3000000, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x1c) 04:09:28 executing program 4: openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000000240)=""/4102, 0x1006}], 0x1, 0x0, 0x0) r0 = getpid() r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x7cf8bf, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x40000005}) sched_setattr(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, 0x3, 0x8, 0x0, 0x2, 0xc6}, 0x0) rt_sigqueueinfo(r0, 0xf, &(0x7f0000000140)={0x37, 0x6, 0x182}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0xf2, 0x3000000, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x1c) [ 1148.483484][ T1881] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1148.878343][ T1881] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1148.888563][ T1881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1148.911600][ T1881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1148.929517][ T1881] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1149.063466][ T1881] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1149.072692][ T1881] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1149.082628][ T1881] usb 1-1: Product: syz [ 1149.087673][ T1881] usb 1-1: Manufacturer: syz [ 1149.144174][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1149.149415][ T1881] cdc_wdm 1-1:1.0: skipping garbage [ 1149.157679][ T1881] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device 04:09:31 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 04:09:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) clone(0x2000200cbfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/nf_conntrack\x00') read$FUSE(r0, &(0x7f0000000800), 0x1000) 04:09:31 executing program 4: seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xfffffffd}]}) 04:09:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) [ 1151.034263][ T1886] usb 1-1: USB disconnect, device number 125 04:09:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 04:09:31 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x10001, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x2}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x2040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendfile(r5, r4, 0x0, 0x800000080004103) [ 1151.170249][ T34] audit: type=1326 audit(1606709371.513:47): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=17427 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x460d1a code=0xffff0000 04:09:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1, 0x0, 0x0, 0xffffffff}, 0x0) 04:09:31 executing program 4: r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x185180, 0x0) dup3(r1, r0, 0x0) io_setup(0x40000000008, &(0x7f0000000240)=0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 04:09:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2) 04:09:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) clone(0x2000200cbfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/nf_conntrack\x00') read$FUSE(r0, &(0x7f0000000800), 0x1000) [ 1151.493584][ T1886] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 1151.515155][ T34] audit: type=1804 audit(1606709371.863:48): pid=17455 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1462/bus" dev="sda1" ino=16317 res=1 errno=0 [ 1151.620746][ T34] audit: type=1800 audit(1606709371.863:49): pid=17455 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.4" name="bus" dev="sda1" ino=16317 res=0 errno=0 [ 1151.748002][ T34] audit: type=1804 audit(1606709371.883:50): pid=17455 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1462/bus" dev="sda1" ino=16317 res=1 errno=0 [ 1151.790135][ T34] audit: type=1804 audit(1606709371.893:51): pid=17455 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1462/bus" dev="sda1" ino=16317 res=1 errno=0 [ 1151.822833][ T34] audit: type=1800 audit(1606709371.893:52): pid=17455 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.4" name="bus" dev="sda1" ino=16317 res=0 errno=0 [ 1151.852299][ T34] audit: type=1804 audit(1606709371.913:53): pid=17460 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1462/bus" dev="sda1" ino=16317 res=1 errno=0 [ 1151.963453][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1151.972785][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1151.985219][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1151.994586][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1152.129837][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1152.141182][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1152.155464][ T1886] usb 1-1: Product: syz [ 1152.159622][ T1886] usb 1-1: Manufacturer: syz [ 1152.214153][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1152.219473][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1152.263571][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device 04:09:34 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xfffffffffffffe0e, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/157) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3) 04:09:34 executing program 4: r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x185180, 0x0) dup3(r1, r0, 0x0) io_setup(0x40000000008, &(0x7f0000000240)=0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 04:09:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) clone(0x2000200cbfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/nf_conntrack\x00') read$FUSE(r0, &(0x7f0000000800), 0x1000) 04:09:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002008100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1c) wait4(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) [ 1154.137306][ T8639] usb 1-1: USB disconnect, device number 126 04:09:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4) [ 1154.230018][ T34] audit: type=1804 audit(1606709374.573:54): pid=17497 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1463/bus" dev="sda1" ino=16316 res=1 errno=0 [ 1154.301305][ T34] audit: type=1800 audit(1606709374.573:55): pid=17497 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.4" name="bus" dev="sda1" ino=16316 res=0 errno=0 04:09:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x5) 04:09:34 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000400)={0x1, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x7}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)="c0740c719480abb71626e535f14e369408fc7a8d9f9281fb72b457ffe51d04d913a9e7f80dde9c309873", 0x2a, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r1, &(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0) keyctl$negate(0xd, r0, 0x3, r1) r2 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x4000000000010046) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000200)) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) getsockname$packet(r2, 0x0, 0x0) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x12a8}, 0x0) [ 1154.413046][ T34] audit: type=1804 audit(1606709374.573:56): pid=17497 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir432831063/syzkaller.jRQJcD/1463/bus" dev="sda1" ino=16316 res=1 errno=0 04:09:34 executing program 3: syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000000)='./file1\x00', 0x0, 0x1, &(0x7f0000000100)=[{&(0x7f0000000080)="25bca274769e620a2734fa0095e0612687ecb86a548802a902000000edc000004e2f98b579a782d257146d0e0206e73ba8c63cd7dcc6760253ef", 0x3a, 0x400}], 0x2000003, &(0x7f0000000140)) r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) socket$netlink(0x10, 0x3, 0x6) setregid(0xffffffffffffffff, r1) setfsgid(r1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') lstat(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r6) setfsgid(r6) setresgid(r1, r2, r6) 04:09:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x6) [ 1154.602830][T17514] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 1154.643549][ T8639] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 1154.684625][T17514] EXT4-fs (loop3): Invalid log cluster size: 49389 04:09:35 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x68, &(0x7f0000000400)="c4c691019919da070000000000000022addee07bee6333b5cacd893169b618322ff6602022511253508b5a4496728c2a46e1bc240e29b9ab9b71362838350808ffdb2dc4a741357baa16dacdcfac32957d83d8c0b2e3482945fef116371f8c8c0c4db583a208718e"}}], 0x1c) wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = getpid() tkill(r1, 0x2f) [ 1154.825508][T17514] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 1154.845285][T17514] EXT4-fs (loop3): Invalid log cluster size: 49389 [ 1154.906540][T17529] syz-executor.4 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1155.005717][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1155.025388][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1155.053471][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1155.062613][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1155.193601][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1155.202776][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1155.223061][ T8639] usb 1-1: Product: syz [ 1155.231571][ T8639] usb 1-1: Manufacturer: syz [ 1155.286994][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1155.292529][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1155.318788][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device 04:09:37 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x7) 04:09:37 executing program 3: syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000000)='./file1\x00', 0x0, 0x1, &(0x7f0000000100)=[{&(0x7f0000000080)="25bca274769e620a2734fa0095e0612687ecb86a548802a902000000edc000004e2f98b579a782d257146d0e0206e73ba8c63cd7dcc6760253ef", 0x3a, 0x400}], 0x2000003, &(0x7f0000000140)) r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) socket$netlink(0x10, 0x3, 0x6) setregid(0xffffffffffffffff, r1) setfsgid(r1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') lstat(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r6) setfsgid(r6) setresgid(r1, r2, r6) 04:09:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000240)={0x1dc, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xfffff800, @local, 0xdf}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffff800}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x0, @mcast1, 0xffffffce}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010100}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @empty}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010102}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'netpci0\x00'}}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd507}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffff0}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40100000}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x70, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @loopback}}}}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x20001000}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000200)=0x1, 0x4) r3 = syz_open_dev$sg(0x0, 0x101, 0x4000) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000140)) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000040)={0x0, 0x2710}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='vcan0\x00', 0x10) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0x81, 0x1fe}, 0x14) write$binfmt_misc(r1, &(0x7f0000002400)=ANY=[], 0xff01) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 04:09:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:37 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x0, 'team_slave_1\x00', {0x4}}) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000440)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) rmdir(&(0x7f00000000c0)='./bus/file0\x00') socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$NBD_CLEAR_QUE(0xffffffffffffffff, 0xab05) setresgid(0x0, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000680)='system.posix_acl_default\x00', &(0x7f0000000300)={{}, {}, [], {}, [], {}, {0x20, 0x7}}, 0x24, 0x0) mkdir(&(0x7f0000000480)='./bus/file0\x00', 0x34250000fffffff6) socket(0x0, 0x0, 0x0) [ 1157.174184][ T33] usb 1-1: USB disconnect, device number 127 [ 1157.244791][T17566] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 1157.255126][T17566] EXT4-fs (loop3): Invalid log cluster size: 49389 04:09:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x8) 04:09:37 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x0, 0x1}, 0x1c) [ 1157.430800][T17565] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 04:09:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x9) 04:09:37 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='\x00\x04\x00\x00', 0x0) write$binfmt_elf32(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000570035f4c38422a3bc822000050000000402030006000000000020000400b3d7c52ebf31a8b70be85ecb000000090000f8ffffffffffffff03"], 0xd8) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1100) 04:09:38 executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='system.posix_acl_access\x00', &(0x7f0000000a00), 0x24, 0x0) 04:09:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xa) [ 1157.683865][ T33] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1158.079674][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1158.088773][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1158.108434][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1158.120808][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1158.265299][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1158.284784][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1158.293096][ T33] usb 1-1: Product: syz [ 1158.324505][ T33] usb 1-1: Manufacturer: syz [ 1158.384160][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1158.389876][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1158.405414][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1159.163394][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:40 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:40 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x25, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000002, 0x3, 0x2) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000080)={'ah\x00'}, &(0x7f00000000c0)=0x1e) 04:09:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000240)={0x1dc, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xfffff800, @local, 0xdf}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffff800}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x0, @mcast1, 0xffffffce}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010100}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @empty}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010102}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'netpci0\x00'}}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd507}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffff0}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40100000}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x70, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @loopback}}}}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x20001000}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000200)=0x1, 0x4) r3 = syz_open_dev$sg(0x0, 0x101, 0x4000) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000140)) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000040)={0x0, 0x2710}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='vcan0\x00', 0x10) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0x81, 0x1fe}, 0x14) write$binfmt_misc(r1, &(0x7f0000002400)=ANY=[], 0xff01) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 04:09:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xb) 04:09:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:40 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='\x00\x04\x00\x00', 0x0) write$binfmt_elf32(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000570035f4c38422a3bc822000050000000402030006000000000020000400b3d7c52ebf31a8b70be85ecb000000090000f8ffffffffffffff03"], 0xd8) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1100) [ 1160.224454][ T8639] usb 1-1: USB disconnect, device number 2 04:09:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xc) 04:09:40 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f0000000240)={0x1dc, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xfffff800, @local, 0xdf}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffff800}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x0, @mcast1, 0xffffffce}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010100}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @empty}}, {0x14, 0x2, @in={0x2, 0x0, @private=0xa010102}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'netpci0\x00'}}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd507}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffff0}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40100000}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x70, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @loopback}}}}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x20001000}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000200)=0x1, 0x4) r3 = syz_open_dev$sg(0x0, 0x101, 0x4000) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000140)) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000040)={0x0, 0x2710}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='vcan0\x00', 0x10) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0x81, 0x1fe}, 0x14) write$binfmt_misc(r1, &(0x7f0000002400)=ANY=[], 0xff01) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 04:09:40 executing program 5: r0 = socket(0x10, 0x8000000803, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="5500000018007f08b72d1cb2a4a280930206040000a84309c026234d2500080008000200080000006300a378ba2b6ef723a472c728f1c46b7b31afdc13b8d54400009b84136ef55afb83de448daa7227c43ab82200", 0x55}], 0x1}, 0x0) 04:09:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xd) [ 1160.486803][T17651] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$squashfs(&(0x7f0000000000)='squashfs\x00', &(0x7f0000000080)='./file0\x00', 0x1000, 0x1, &(0x7f0000000200)=[{&(0x7f0000000240)="6873717307000000911d675f001000000000000001000c00d10102000400000046010000000000000203000000000000a602000000000000ea020000000000009900000000000000e1010000000000005a02000000000000940200000000000078da2baeacca4eccc9492d2aa61d030085492b1f78da2baeacca4eccc9492d2a1e658c324619a30c1803005565c4a273797a6b613a8565727346810200ed0100000100911d675f0100000060000000ffffffff0000000064000000140000000200ed0100000100911d675f0300000074000000ffffffff000000001a0400001b0000000300ff0100000100911d675f0400000001000000260000002f746d702f73797a2d696d61676567656e3431393737363339322f66696c65302f66696c65300100ed0100000100911d675f02001100000000000200000029000000070000000900ed0100000100911d675f050000008f000000000000000a00000000000000000000000000000001000000ffffffff00000000000000000a0000010900ed0100000100911d675f0604000099000000000000002823000000000000000000000000000002000000ffffffff00000000ffffffff0000000000000000000000000100c00100000100911d675f07000000000000000300000054002600080000007780010000000000000003000000240000000200040066696c6530480001000300040066696c65310400ee000000000001000000000000000200080066696c652e636f6c64860001000100040066696c6530a60004000210040066696c6531e20005000200040066696c6532e20005000200040066696c653338800000000000000000860000000000000024000000000000004800000000000000a600000000000000e70000000000000026010000000000005a0200000000000008805cf90100535f01009c02000000000000288000000600786174747231060000007861747472310000060078617474723206000000786174747232108000000000000000000200000024000000ae0200000000000001", 0x2f3}], 0x0, &(0x7f0000010300)) 04:09:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xe) [ 1160.683685][ T8639] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1160.763704][T17657] SQUASHFS error: Unable to read inode 0x146 [ 1161.043529][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1161.052427][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1161.069734][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1161.082394][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1161.233501][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1161.243199][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1161.259141][ T8639] usb 1-1: Product: syz [ 1161.263291][ T8639] usb 1-1: Manufacturer: syz [ 1161.304170][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1161.309670][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1161.323024][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1162.083377][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:43 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:43 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f00000028c0)=[{{&(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, 0x0, 0x0, 0x0, 0xdf}}], 0x800004d, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='auxv\x00') preadv(r0, &(0x7f00000017c0), 0x315, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9ca3354ef16e29d36ce006651378e7213b"], 0x2}}, 0x0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x17) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = dup(r4) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) r6 = gettid() read$char_usb(r5, &(0x7f00000001c0)=""/157, 0x9d) tkill(r6, 0x39) 04:09:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0xf) 04:09:43 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x20480, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) dup2(r1, r0) 04:09:43 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0xa, 0xa, 0x201}, 0x14}}, 0x0) 04:09:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1163.305307][ T9877] usb 1-1: USB disconnect, device number 3 04:09:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x10) 04:09:43 executing program 5: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000009000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000008000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x400002172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0xe000, 0x3, &(0x7f0000ff2000/0xe000)=nil) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) read$FUSE(r0, 0x0, 0x116) [ 1163.423972][T17704] ptrace attach of "/root/syz-executor.4"[17700] was attempted by "/root/syz-executor.4"[17704] 04:09:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x11) 04:09:43 executing program 3: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 04:09:43 executing program 4: setresuid(0xee01, 0xee00, 0x0) init_module(0x0, 0x0, 0x0) 04:09:43 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x10b382) r1 = memfd_create(&(0x7f0000000380)='.^\xe5\xce\xb2\xc1b\xefHEG\x18\xcb\x15\xc1\x1b\x18\xbd\xb6\x14\xe9G\xa6\xbb*\xdff\xe4{m\x13\x92\x180\x7f#[j\x12U1H2\xd0\x91\x874\xdc(\xa4\xa8?Q\xa6\xee\xb54\xd0\x05.`\xe7\x04@\xff\x83\n\xb9\x12\xaf\x83\x04\x1e\x8b\xca\x17Y\xb6\x94\xa5\x90\x9f\xac\xcf\xc1\xb4\xfb\x9c)\xa0xY4\xaf\xe3\xd5R\x012\xd2R\x03]\x85\x80\x01\x1e>\xf5\xef\xd7\x92a\xb3,\x1e\xca\x92\x1eJ\x95\xf3\x98\x13\x82\a\xe5vn\xb1\xca-H\x03\b\xaaE\x89o\xe0$4\x98\x83r\xff\x0f\xc8\x06m\x16', 0x0) pwritev(r1, &(0x7f00000004c0)=[{&(0x7f0000000440)="813586c3c380fec40dc9", 0xa}, {&(0x7f0000000580)}, {0x0}, {0x0}], 0x4, 0x81805, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x24002d00) [ 1163.586884][T17716] [U]  [ 1163.623954][T17716] [U]  [ 1163.833469][ T9877] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1164.213452][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1164.222473][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1164.238234][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1164.262005][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1164.413888][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1164.423237][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1164.433304][ T9877] usb 1-1: Product: syz [ 1164.438186][ T9877] usb 1-1: Manufacturer: syz [ 1164.484172][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1164.489413][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1164.503292][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1165.253383][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:46 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, &(0x7f00000002c0)) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x12) 04:09:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x40, 0x0, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_MASTER={0x4}]}, 0x40}}, 0x0) 04:09:46 executing program 3: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x8208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14113e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) madvise(&(0x7f000030d000/0x3000)=nil, 0x3000, 0x64) 04:09:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:46 executing program 5: creat(&(0x7f0000006680)='./file0\x00', 0x0) mount$fuseblk(&(0x7f0000002100)='/dev/loop0\x00', &(0x7f0000002140)='./file0\x00', &(0x7f0000002180)='fuseblk\x00', 0x0, &(0x7f0000002340)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0xc00}}]}}) [ 1166.404616][T21202] usb 1-1: USB disconnect, device number 4 04:09:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x13) 04:09:46 executing program 4: r0 = socket$inet(0x2, 0x3, 0x7) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x12) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@empty}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) [ 1166.529090][T17774] fuseblk: Bad value for 'fd' 04:09:46 executing program 5: socket$alg(0x26, 0x5, 0x0) syz_mount_image$tmpfs(&(0x7f0000000200)='tmpfs\x00', &(0x7f0000000240)='./file0\x00', 0x20, 0x1, &(0x7f00000005c0)=[{0x0}], 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB]) 04:09:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x14) 04:09:47 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x8208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14113e, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000200)={{0x2, 0x4e22, @broadcast}, {0x1, @local}, 0x80, {0x2, 0x4e21, @multicast1}, 'bridge_slave_1\x00'}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f000088f000)='b\n\x00', 0x4) ftruncate(r3, 0x200000) pread64(r3, &(0x7f0000000000)=""/42, 0xfffffdef, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 04:09:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x15) [ 1166.953520][T21202] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1167.359526][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1167.383858][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1167.406726][ T34] audit: type=1800 audit(1606709387.753:57): pid=17790 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="sda1" ino=16345 res=0 errno=0 [ 1167.416949][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1167.484700][T21202] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1167.659911][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1167.669584][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1167.689682][T21202] usb 1-1: Product: syz [ 1167.697127][T21202] usb 1-1: Manufacturer: syz [ 1167.764302][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1167.769795][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1167.797269][T21202] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1168.533389][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:49 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, &(0x7f00000002c0)) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:49 executing program 5: write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x12) unshare(0x2c060000) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x25, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x7}, 0x7) semtimedop(0x0, &(0x7f0000000000)=[{}], 0x185, 0x0) 04:09:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x16) 04:09:49 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x8208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14113e, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000200)={{0x2, 0x4e22, @broadcast}, {0x1, @local}, 0x80, {0x2, 0x4e21, @multicast1}, 'bridge_slave_1\x00'}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f000088f000)='b\n\x00', 0x4) ftruncate(r3, 0x200000) pread64(r3, &(0x7f0000000000)=""/42, 0xfffffdef, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 04:09:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:49 executing program 3: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x8208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14113e, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000200)={{0x2, 0x4e22, @broadcast}, {0x1, @local}, 0x80, {0x2, 0x4e21, @multicast1}, 'bridge_slave_1\x00'}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f000088f000)='b\n\x00', 0x4) ftruncate(r3, 0x200000) pread64(r3, &(0x7f0000000000)=""/42, 0xfffffdef, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) [ 1169.554665][ T1886] usb 1-1: USB disconnect, device number 5 04:09:50 executing program 5: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x8208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14113e, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000200)={{0x2, 0x4e22, @broadcast}, {0x1, @local}, 0x80, {0x2, 0x4e21, @multicast1}, 'bridge_slave_1\x00'}) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f000088f000)='b\n\x00', 0x4) ftruncate(r3, 0x200000) pread64(r3, &(0x7f0000000000)=""/42, 0xfffffdef, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 04:09:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x17) 04:09:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x18) 04:09:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x19) [ 1170.083760][ T1886] usb 1-1: new high-speed USB device number 6 using dummy_hcd 04:09:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x1a) 04:09:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x1b) [ 1170.453856][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1170.475302][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1170.511856][ T34] audit: type=1800 audit(1606709390.853:58): pid=17834 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16319 res=0 errno=0 [ 1170.530153][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1170.569753][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1170.729800][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1170.743286][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1170.783255][ T1886] usb 1-1: Product: syz [ 1170.801514][ T1886] usb 1-1: Manufacturer: syz [ 1170.860016][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1170.866686][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1170.891471][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1171.623396][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:52 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x0, &(0x7f00000002c0)) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x1c) 04:09:52 executing program 5: r0 = memfd_create(&(0x7f0000000080)='{\x10', 0x3) fcntl$addseals(r0, 0x409, 0x7) ftruncate(r0, 0x7) 04:09:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x8) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) syz_genetlink_get_family_id$smc(&(0x7f0000000300)='SMC_PNETID\x00') r0 = creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000440)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) rmdir(&(0x7f00000000c0)='./bus/file0\x00') setxattr$system_posix_acl(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000680)='system.posix_acl_default\x00', &(0x7f0000000540)={{}, {}, [], {}, [{}, {0x8, 0x3}, {}, {0x8, 0x4}, {}, {0x8, 0x2}, {0x8, 0x4}, {0x8, 0x4}]}, 0x64, 0x0) mkdir(&(0x7f0000000480)='./bus/file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f00000005c0)='./file0/file0/file0\x00', 0x0, 0x1, &(0x7f0000000980)=[{&(0x7f0000000640)='`', 0x1, 0x6}], 0x5000, &(0x7f0000000a00)={[{@test_dummy_encryption='test_dummy_encryption'}, {@noblock_validity='noblock_validity'}, {@journal_dev={'journal_dev'}}], [{@dont_measure='dont_measure'}, {@fowner_lt={'fowner<', 0xee01}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x0, 0x0, 0x0, 0x34], 0x2d, [0x31, 0x0, 0x39], 0x2d, [0x0, 0x0, 0x34, 0x63], 0x2d, [], 0x2d, [0x0, 0x0, 0x5b, 0x39, 0x66, 0x64, 0x38, 0x61]}}}, {@euid_lt={'euid<'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '*-${-'}}, {@smackfsroot={'smackfsroot', 0x3d, ':$$)]@:+(.#'}}]}) openat(r0, &(0x7f0000000b40)='./file1\x00', 0x0, 0x0) 04:09:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:09:52 executing program 4: ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xf3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000180)={0x0, 0x80, 0x200}) munlockall() ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000009, 0x4ca32, 0xffffffffffffffff, 0x0) [ 1172.628419][ T5990] usb 1-1: USB disconnect, device number 6 04:09:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x1d) 04:09:53 executing program 4: ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xf3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000180)={0x0, 0x80, 0x200}) munlockall() ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000009, 0x4ca32, 0xffffffffffffffff, 0x0) 04:09:53 executing program 5: ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xf3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000180)={0x0, 0x80, 0x200}) munlockall() ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000009, 0x4ca32, 0xffffffffffffffff, 0x0) 04:09:53 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x1e) 04:09:53 executing program 4: ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xf3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000180)={0x0, 0x80, 0x200}) munlockall() ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541d, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000009, 0x4ca32, 0xffffffffffffffff, 0x0) 04:09:53 executing program 5: prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffe000/0x1000)=nil) [ 1173.113546][ T5990] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1173.213750][T17894] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1173.505739][ T5990] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1173.522455][ T5990] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1173.559374][ T5990] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1173.606653][ T5990] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1173.754774][ T5990] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1173.778515][ T5990] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1173.809499][ T5990] usb 1-1: Product: syz [ 1173.828320][ T5990] usb 1-1: Manufacturer: syz [ 1173.887136][ T5990] cdc_wdm 1-1:1.0: skipping garbage [ 1173.892567][ T5990] cdc_wdm 1-1:1.0: skipping garbage [ 1173.941921][ T5990] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1174.683465][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes 04:09:56 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x4f, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x21) 04:09:56 executing program 5: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)) recvmmsg(0xffffffffffffffff, &(0x7f0000006180)=[{{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000001680)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') preadv(r1, &(0x7f00000017c0), 0x333, 0x0, 0x0) 04:09:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x8) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) syz_genetlink_get_family_id$smc(&(0x7f0000000300)='SMC_PNETID\x00') r0 = creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000440)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) rmdir(&(0x7f00000000c0)='./bus/file0\x00') setxattr$system_posix_acl(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000680)='system.posix_acl_default\x00', &(0x7f0000000540)={{}, {}, [], {}, [{}, {0x8, 0x3}, {}, {0x8, 0x4}, {}, {0x8, 0x2}, {0x8, 0x4}, {0x8, 0x4}]}, 0x64, 0x0) mkdir(&(0x7f0000000480)='./bus/file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f00000005c0)='./file0/file0/file0\x00', 0x0, 0x1, &(0x7f0000000980)=[{&(0x7f0000000640)='`', 0x1, 0x6}], 0x5000, &(0x7f0000000a00)={[{@test_dummy_encryption='test_dummy_encryption'}, {@noblock_validity='noblock_validity'}, {@journal_dev={'journal_dev'}}], [{@dont_measure='dont_measure'}, {@fowner_lt={'fowner<', 0xee01}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x0, 0x0, 0x0, 0x34], 0x2d, [0x31, 0x0, 0x39], 0x2d, [0x0, 0x0, 0x34, 0x63], 0x2d, [], 0x2d, [0x0, 0x0, 0x5b, 0x39, 0x66, 0x64, 0x38, 0x61]}}}, {@euid_lt={'euid<'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '*-${-'}}, {@smackfsroot={'smackfsroot', 0x3d, ':$$)]@:+(.#'}}]}) openat(r0, &(0x7f0000000b40)='./file1\x00', 0x0, 0x0) 04:09:56 executing program 4: sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0xc4, 0x0, 0x0, 0x0, 0x0, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8}}]}, 0xc4}}, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 04:09:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1175.703927][ T8639] usb 1-1: USB disconnect, device number 7 04:09:56 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4002) io_setup(0xb, &(0x7f0000000080)=0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x46802) ftruncate(r2, 0x10000) io_setup(0x2e, &(0x7f0000000400)=0x0) io_submit(r3, 0x1b, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffff7f, 0x79000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}]) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x46802) ftruncate(r4, 0x10000) io_setup(0x2e, &(0x7f0000000400)=0x0) io_submit(r5, 0x1b, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffff7f, 0x79000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) syz_mount_image$squashfs(&(0x7f0000000040)='squashfs\x00', &(0x7f0000000100)='./bus\x00', 0x2, 0x4, &(0x7f00000001c0)=[{&(0x7f0000000580)="66e32da7895105b37a3f0de3de672c9b65ceac8f12a34734a2d035f4a834088202b4308fb11b487aec1d45f9e655605b182bb40d0b3148beed354bac05d4611b3f1cbcc153a679e745636f832ab6affd36d2fc346965fdf454297942b76466d0c6ad8b9977e826d22a8a87997e347a27cbaa5419e7bdbfc15d6a6736a033b34e5d75f8c4d3b123521796492dab80c5a53c695312892cd9b97317be70d12a0387947318c94b345e22bea4cdfce4f9c2c4a80f1ae3bc7b8e895e388b7f3a7b4f177f52cd5b5319b100a84bc27dea654ccde90dd5bb53e67091e662c2d0d06ef5dd2153d7b537e56b03707c45eaff6067fa1cbc5c679b1529351cebba72077243d2afa27be4ebb9f37d9b28809a9866a522db640e583d15ad1d9e9ce15f99b24c6b64349d27a345c082ee59d75c49afa28f9da1a071e5c35e1b04f834a1b19099ed718a2420213e9e5ac8a99c90c359b0534058a96c12e182b609704698969903d022c74457e0f33cdda1e483df171fd12610bed493682ad25904e218cd1cfa7cbb04bf08a5e12f6fc47342a7cee675d0c8079fcde1698877530dba649ec35fb2cdd762ce03582ca7688095400f7bdd88df37479cb02d8ef11af83ff04028ec8056bc56f81618ce09df354dc4838f5d155a835cc49565863d3e7d59915b5abc52a4a6810320baa741c7b0ae0e70ef1c489b5af38ffeaab221f1a47eb8bddaafb347528ca38e62a6e1e96dd17c8589a7476ca05ad3bea65a6ac5f12d567758aaa94708aabcf8280ed93e4b5bf19058d80ee2f8c0bf47aa9f11ee07252b63e04ae6750eb4bdbde3adaf84bf7612359fd27ec712e073c57cf052fa5834888567f6e017376d0032be1795fdf5175424ffc334689ece5657fa2728deadd7d82c131fa2d4da404e86aeb1a5be7749dcff237c5594e7b9cc13d729ed5dfabeefada347900fe5c4602088e270bdb67c3e8f54735de89fd49638695520fc92fad7f873e1ae4f8cc3e0139854611ba47fd96e74a3144c001070dfd3d78f674a9c8464b642ac73d07b21974689d854d4c7873ddc1f618e0dfa948c4d9461b5df6e1ee09af2a4dd0e72bddb3309d4e095727b9db79c735c576d6f5f0af12f3f21f851b700d9bfc6bf6eb527d8585b1211b3ab40dda4779255de660fdf98a0c0a00e2cc1fe4db53036cf76f72c15a3826a4c102bc3474403326a1c58d30de2cb7079e91aa7e2a42d6a8dc55f7f6f6eee23d8ce20eb0c19bb7b45c63d476b353499d776edd64c2f999d3bf6fa9cbbaa1638843322dbb6af40757bb133490dcca9b7abeb8e8fbc6ac71f0bd9ed517583b607964fb306549bd0688e3173020a98792efd15d52958437fb0e42b772ca533c2e015d9ef184507be0e6156493e6bae65febd4df569f15e180b09b6510f439c02aaf16b6bda860bb3129d5d8a1fbedde50f39654a9c8eed39f1dcfeecb9f4fce14a207e9abe23d2dc24ab23ea6a2423cd2085b2a48938f22fb34f83872e13d1648ce67ce1141634422383031bad1596d86ba30f05fc2f491e1458fe20b62060506faf7e1bdd47e90f24c5ce20a94e064801230aeada778f9790d5f97ffeb4f64f9dedfe72c1ef4f45883e4c6bb9e9355f1b795027cb94542166383dee4c21aa818f8a68cec6e52e275a5d83a19aadaab13b63e8146cc22bbdf5323995e0f8928b20c9e18a600d847ca892d155dea46fdcea8f1cb6a9e76bd33e68c0ef8b97078e90822215985dc1e24e073b269f5484e099b941ed0eba19e2ff5ce705fae32a25afdabc7072be8645d1d71d8d7bfca196c1999f0fb36a96f07873bde56c8f7b93624ec9babdf9778d0d88156742d9f18fdc2219f17b6c735f9f05bfbb3fcb3fc84cf9f426479d84f340232f575fbe7a1b01104a3223c08904be441a49a5866a6ba0f2e0eb255ebe5718a8e54bb417d53fbf8e90190d8224f882e1a1022a7e2e9cba7cc0c2874ed4e704003503702df41848eea4ff4b81b50eb33d6524c414fc4613c6ba2dcb4327a9ffcc471c87ece24a8fbb4c671c7c1565f7d054afb63d2f15fe4c8eac5cb1c65d28118b0da2c3c4020509e4896d053bee0a6df251c54c9293b4b8b007c3c2a3e71805a5085bc1cca1650770f961c7f75f1e4501d7e2496abc64cddb1da3befb8e5eb1903012c68de1d19a684c2ddc85a551abc56e03ffb3a82d114ca6634e3bfe7fa9e6c0f00509a9917723f2120179287139ff410d759cd1a4b6113137832b81c0f54efe27ed313e859aef5d18a6b68ffdf6753e9bfbc0240d6c7c24b92f749ba11bce3a07826c79a5063d7c7a1297af3417959e40b1f9205f3d284e3ddf5e49a4a5cc0b264d4c4f216c2149fa7a7e873788886316419281fec4cfb91580c3d891b659133a5aed67e922cbb65d15623c02feedfe3de73d51fa0ed72aae068b392bc5f1fefdbd85303809366923eb485633219189c1991361ef047ca678bc4ac42c56d8ac3bfaacae0c04df7b9c17e4091f56f4f12a05425b2ccdd536de90ee51bca2e69b858cfaa51f4de248e0cf7cf0c198467128a552adabb225c95ab1592d382300a31373db9d3749c7f68dcf217a6740987158f894992bb38dbc50d3e4c72fac609e959156368be6a320ec50662adda7fa49e15112e118410a621b9eeb88661a84f03b3c9282beac7b2f8f4f1fec0f5f003bca8316cec76ec0fb75f2a0a538497ed8783141d642782fa3bab03efd4f63610bd766159848169368e77e6dbeaa66dfe721915c949249f7f37a9f84811dac00fe99a4c68e5aca0ef1151b6c7ae5e749a2151327fcdf8a27e4acd3fe0e1accc71b7d2c5a3fadf8cbbdb7f7d34d56682401b7b6b15c509403c7272ecafe02927a9dc13741bf74c632abbfc3c0e4d667737bde0c50d2177835f2b2f3f6e52110519dd9b5a1f9f1aef93ef9a62da4024ca5e834eca757b78f3c92ce96a0639a2a74c6f0a5068f55e8508ab930b63a7f0d48f3322499f9a19cacef834733030c308442e8ff4ebb03670447dee7dfc5db6dd70d106f32e47b818e373fa1433d332b8988efeee4c0930a52df7dcb4e9f95f51ff141d32ca846ea60d3fdef1a11de378a8c4e1403e58c53aa6627e631fff39d6188f909a49a333873ab0e9d0d6ab41fa57ae3e2b56a000e6db022ee3b269dece70881051d6b9498468904accba0927a868a540f34873a07d965c40a1da2b3e7d8ee69c97b7cacce42c537357e0ad5decc3b434a37b021204d1948eb075cb55ba5b4f8ae9f2be2407d8fc12100c2e2c465b1631b5e4be1efa2e3f83e2d21ab120f4f5b5ee6d90228171d2a42fd60c693d66781484e975b3335b44f195accb973d7afc19c5413943564eda29d3ad69074fe73f97580c5c776d38b7f7299efa5f3cc0acee3a56e08e5afe4165bd7a05d21de00b2621cde96a04ae8e998ce7c6034cf9cfcca8b1c0a5b01dfae9f45b5df2e6777e9d56d585bd3a7b1a7e2b74abe3ed61f1ea44a8ecc307396b78d100fa6ede643da0beabcdc3d9a8f4afa2574843810e0b6766574167c3dfdff42da4a859e28b18b98d4e4d95593bc7ca45103e91053febb95e576006aab941503086c0615f2af547e62c4923f372944a5f32970b5c6edcca0dec9f91814c7b8cc6d2409b55a3f59be3dfaf5f13192ab2d9ce5aa2c677ac58b183ed609d44eb7f74c48ed732e8c7cb59e94d2cee6cf14fd9054c8ea958e1d33a49e2c5ffb5de21a175c5e341098e7025cc8d9c6e123b06281103d04efdd7f4948973efc69857e7658ba00f790a5c070dc971c0124a98b4400d9ec020a13ec5abad46dd333197e89fc69a6d5fabf42025ae1045be6ba1065d9c5c328229a9c83cf0ef408c22af9dae5c47b4380bf1f6c5f4ef5d078527d9753ec7d7efbf7b20cf0653e6b75da308e3859a00ec1ffcf9b36f87f695bbac84ee27040a58f6985b8401bcf3a2891ab97b5303b749da113be7b72caaad1d37a4702fb09679debb9f91995fd06ea46c65210a849152fa9d0820adfd767c837b6f3f20a11f0bedc457629d1923c7b353f76ce2e6030b6bb8af9125345af6e9859d499002fc5629755f8314a6214941e04930866329425d8d954e3c5be79784348e976cdb704e90946862e3f095755a245b12563d5a3b553f9de942987e0e061c4ac9704cd0f46eb04a74adfc0341e4fec88a4c66cc3698b5c3bf21607a3878233d856b6dd7d85bb5c9616ee17694888574a3c6a39c29b1b0f1c499685c793429d92c98bb7474d4fa2c5da6734a5b58eae5537b00d5c7eae59cfeb870689545e72ff0a998d70aabdca5bb8415480480a5a0e04c19fa71d793ff2119cef76eccf7362e1746f1294bb455d4d48a23e4189618a56a9e8f0ab78f7a3b5f6d398953541ecc695e159f6e52035f6215c1465c87a903e78a939a24974195b032626f8f8da917ab83fb32f72516f6f13bdf143839c61409f152275b616b7bcc4899a3dd8c3f8bd791bf982f179b71dddded341310fb60e8083124342c7838024313be900d0e196d08f3c1e7ade111c6a325b2f975811f48477fc9bc3a1a33b1cada603334d7cdc6db0025186bf01d91e7502006a9d4a35b5ebee156cbeb95fefb5f88cf9ebd95b7a6e299f1b6557b48793ee4d12b8f54dc98247ed0ebf7f5df768584e40d3ae2e24b2186f6b0913a3585a3aa2d3e76f69b06e882fecc0253dbd9c3a3a596f33d4c7eac141b9fc0e0005a4b2a1e5a959265cb7f0d1b428a4ab42181b90bf20b476d427e4e75d84e709f4624872c6c3794667a3a258c581572e758ab8cf2d165c017e1e38a32702b4352b3e4fb7a48f8fc1b62cdd544231cce13abe8fc5bdcb9e5c4a07b30d2faf2f4cbaca74e0042ad4a1068f4aa353748497f445a60af72402c11f7141ee88b9f1551260ad7128779e10f60046f8a873f165621aa0f3896cf211234ad993f0bbd2ed9e3041c508c755e20f02d6db2adaa2c79898ed4649541418ecb9d4f75cf2edf868470a9bd1aa103c301d247d98f9fa803b68745012be50f91ad8c933f2b5095e1d2b87a73ac877749be71ca4cca6fc2aaafce1bcd5ab3e25462ef4448c83d6145426e4c292a3ab9e0d8985dd50d646a586cd37f53f7772e4dea4043f7479030cdfe8ceaa3f1457648430a593412d706e107db6a7e5c5cd12d3d74d5f2320399882f6d3c3293b1a1da0253cb1e219135124a22a1e2b07710331c8c1999aa07e148478ff1826482148453bb22b05d365261f5260a921f1f169835f8530c3886aa5f408aa6e8487627b6a59138b62a215f57c3859a54bb9f2574faa30b84917e30423545d2490ebac912745c090a9a8779777386e19890184cefd0884c854e2f880a56bd91e56ff63949bfefd17bee073112aa3300b6bb340e0cc6c3b9e5baa1565b396980ba823b2d47117748cd495f0260cc42ebaf5b7a5e4249e39a263cd801a9fadfc4c5a20e1f3103444610345e2c6c94db2ddad6bfe260d3728a042a88acd39741b4aae34c43c66259212fff3d7fa7538360e7ded437c179ca0109c55d0c8c84a20898f542e7e815c073a1f485ef634bd312c325d0fe1086266f6aef11a19f5d7440fc7842ecebb219a75c13e4bc12d9f09bf38dabff66f2a230fb0eddd5a8868c5276d9b37580d25b84bb11ab7e02fadd8d784e089e099a2fc3a8d17d74033cbf0fe35db7ba8842dfe72e915f91dc2b2191bef2f47f799da53ef40d9f53262ec1973445da28a5e48acd83cd87aecc54b75d04358c08205dcec85d1b0368572d71459820ac337e11264e3124d0f777f538a22779a35d61f4baa6547a7838e564d8936814a99b4e6", 0x1000, 0x5}, {&(0x7f0000000140)="b28df346a06e39cdace52ba154f03d4a0dd4e88488bea82f", 0x18, 0x4}, {&(0x7f0000000180)="c536adc52e08fe2edf15305985c70952f425fce071d7f461df6433416cb7987f7bc5aa07f635cd7975", 0x29, 0x1}, {&(0x7f0000001580)="b21c1980c4cfdefb1d6b8d3fb7ccf497a0e72dcc83863a680c72bf610fefc44b2ba9fb4948d4903f442614bd643d205bedd73e0faaed3aae0b305b85dc6cebb33ad6027001139ffe2a06d654df54a168fce35dea1b05a6dfad7145c69912672a7d95c2cb3f6411778d334b0659c3a6ff1584c2963b6435c726eae4786f61a77d6ff56fbafa58a6d42adc18674f27e6a5b2becc7c6013746113e111cbaefbf65133cbdd771a0d242c5c1ce0dc530dbf3efbc7c5671238061997bd6bc3cd47758639848cac49450302d4cca9fcea81c70267ee3edf5337c99f749c7fd0106bb0a2dc5ccfb96d51bbd3a0f689bc2e1bb82f5eb954b7d5287cd9867d9ed6a43937b31f29c2f6611716c08aa9f1d7a3d8a0bc26ffcff72d2fce040955932e826056c2d01503777ab84b77ce3205d26102c6bfc063e00ac635170d56e1c62559ba0de92438f8c79efe1cb82f673795a525cae2e7f7082ea25e2381068c6ccc03d16eba5ed3276db19f33749ace0bba87d85e28581c9e81041a2307e6b7565bb646a000877d4aea03d69b8ed44ca22f2a8a1887ad1ccd463fdbe1876ecdd953f567ff27d87eafcab13b8f1ce540e084b4c3f41314e5e5f96749551cc5376fd01c2c03f1a1e7e038ac70da9077df6943ffa6c1624b85fa5cefa2068608b1b92fce9bb84d753f0397615efb0080870062e35d7b282130e6f130088791f2eca0ee04d59e4786ac438a381fc231c081f60253aace4f66ac1c0897cf50e46d6fd5922b9316ebc9fae8547fecd8fe483a0955c8bf891cf87eda317f79e62a8cff8b8a9a6a55bbe4bc4351e1ba96f7718a2233ddf23a89aecf3feffd6b789164a607ca539b827dff0177ccfe815a41ec94cb2499f7680fa18b9faaf4ec073fe75a301aa94c2389d25466e755945a682dfb75bb98d7a28dd8c68cf4d73d85a7be2fd17e9c163d525eaf8ccf5aded90c8d4422b9a796cffb0a3668cacf571a3c8e2b0679971cee71a9d7b1245d78c0e24f113ec893c22c1876637d1c9ce137017b5c58d9a5a6243057ba3ff4b49576316220180957b4406b0c41bb63aad6bf0ee29252ae5ed9afaef4fea801fe5535e4add3c8f4fcc4149a0e4b1456c33f3959ee2b44c449c93008d3f258664e9ad224b0166cc014f3967ed907d93c8b488b4d9ac70a19c079616678c73748833a4c872015bbb9a55399b4743873197a5e941d751060c66d14a559b270c5a106132b023b557daaa3f357a87dcef8a5fccd8663967fc24d84efb93925a5021a623f64d671ec2c911d700be3edb25e2c1c6da2b049f421cf76a6c0c6c5d08e2bf3f3f5b40ef5c577a367f8254a66de2f2e7d5fe098fa11258a15512ecf31a31a6a03ccb40b9ae68e51f545468e4859b53f817fa79aa56cf40f33c3b495c04e81f238700c4d1d8b8363bd2ed14c25017fcf961ce5fe3c740e7056db18e9bb0b6d9f39f3a54fc317077252edc494d9f80f4b5471fb1b1ca3e521ffb6b581ef83c0c69dcfb139576f446b0b2b7c8dce4e48095421dad56a463a5bcc400bbddd9f3b9a86490cd49b2aee773ca182975fb967500acc3f73c104c08f449a1f61b8c3ac383d8f549e6c12b4703b640c05cf795c7057f7987211e8a93eb9de21a365227892d4cbce9ea0d58b0d0e0bb2b700d682934969f0d6fd77c7fc732bf09f310440e7b365143b6b27fec1b02f6f9505bf8b966c845a5b16c0181326e4f727c133ddb089bf4b75641eaa1cf225f3b96edc97077242b30e3bb590db747f179bf42faf4a99e9ada20f6105ccb1c19b7a22b525be77df2e3b1f9c2899a1108c81d8f45c5da9a2aa2920f51ba54052e54f5186dbc5b97581d1553dae2361c4969b45fe55870c36c00c5ae536a84d172c19ff0b20a2fe9f4a0d923014ea8f3b8337cdc203de808683fbee739def9b374d4c784049125a952c9e274a88c726eb95813f60b7bd86ee79123cb50184a3dea86a750e86eb72977d7fe3305c7da14338fe5e35c7f7427ba8afded1fc9dd437b8297da2aec11d216596a9ba96046e75847aee4859bde0d08a0691b61c1a9527a029134a7f9f7bd0da249b3194126709e2e05ba6c69ec26ec0b0d8c1630c6bce61c620672faa37ec55cb37b2a39ad62c4a98bc893ed66b49b4a03bcdd300e7586dc9f9214b1dec4a32a1c4ded7ab8c78866c094da818b42cee240096408f91c65af3600722d9bd8a3aa43b467f31f66e2117f36cf1de916e801bb7e48fa469a853def5fb3dd706b3d166794ef46a6b02aded6780fe59130aec68991594d2196188a9384c9299fb6584bf6ffde4f4cab4210857e6df830500e4efb52ebddbb4ea7f6e794eab0c2e810a96b621d7003a586097ee36d524bb23d0d5ef279c67a91ed0064da63f1c181d5112f5192dc9dddff495c8b83c350b29f600c09731d2a5f10ce333569963891f444b0b514561b5b48858ecbf83bc2ecf6f46374fa2d076730fb159b8161d965be1d19882ff1ceb8c71c7e998f90376068bf6a1c3bfb2a589e34b6e3e1d88405b1fb11703c9462bd7f79ece3a08ff8200859ec8c2a088dbfc0e8b2b94e4149d0f8804e419a9667489ed1c273db8ac9909ff9fc3e5637256e92790f38a736421457dbcd147bf04248043480ea445d7c1b456e1c87f1ba62b067dd0a28c3f763941460b05c1ae35e3a5e2609d94aa3c3ba58fa5b58aa22446b004738f33ab99f987d13a2c64521e9f4a86c56ccfd6b842ef8d647cedc92518677160a30fd9d3c30630620604122ba22c559ec85084bfa29c1840869308c9002b2c6dd611ca96ca37c81d4a485e57bd3b724c43eb131f52033280010cd6e9405d1ffe6673abf553ac4f527793cc4413af726de721b059993e0bbfa3951fd454a4b5ef69975a1725db9c34b037c82d282903d294c7fcfd59ca62b168341d5f6dcb000ae84dd984cf5c2520cf5dd50891bddc6932f233a7835dbf60c548261535d64f0d8456e7ef99efd53751667f399ea181e4193261deadd5e5b88aa448a65c914a3d695ac13121f3551abfa02aa81eb272861e4ba5f3a3286647a1455140fc3e994268c06e67c67649caec34bb989267c8f7df80113d077aa3881ebc08bbc6f2297bc0aaa6dd6b145607b371573427c655d9e0a169ecdeaf6fc9779ad72b8d2bd68dea5be97f24275c883d6a87d37e22338453b695d096af277e4c072313423da9ec9beff742a15d99e8a1d80d1041a0f50e353b97661923823f7a13fa7662e4b5bf13263dc877ea5000d8d05efdb4483a7ea7a6cd65411bdc5ccce1096e1e340d37282d2b861d9d156d03ae95d213f623edca6c0908543ea35c70722d4c7ba06f3622490fc903642f58e3c56512a2a79d38a67d5a5df624e576fa101925c382ecf02336baa23acd87fdbb54ea737e532f187772594432a7911edc602806a42c3e9e1a036043022b2d4b614bacc5c9e95ac080216d0771c6150caf4fa61282baf8bb8253e53282843774d0ddc02d3c0a3b372006816791c2f51e86ce17833aa496f7661f17a22e24bb748b26d0bad1708c742294972524b3cd1112e08ecd848295c3b7ff4f8f5768e954e29f26c35ec80315bc71a73a322ec115d56bfd2678b300991d0e0f5b6d498688448c3f9da3b7827e0f97e6e065902bd694e19a5f28e0b6118f723d989d093927a52b39c7a9918150223c4d7e89501e177ad997d63033f48a6075615cb5a4911bef3db641fbee0d5657d2a2a9070e24d2ed039ab9b6579607d001947f39925995adc23e414fc65480b81f34136c9d7eef31d9b3573f7f5e186551f728a158c8617cb268b9c4819670904daae3a1c28cf3938760e19c19f7df16681106f746fd67732f8845b3049e11ede3329208673dc11818841cbe8647a492e237a35be6dcb5beb1763535ad2ab4430c13bacb946c5cbadd66ccf86ab3f43591fc5e9b6e7db946ce7821354c7a7444c93c5709faf10710eb5bedb68844c4c0634f134e883675862d9f25eccd8de13a87fbee0bdc13fe231bb8ccc879456dd9f9170a08c11869411bb418815c650ac72542d347c487852ec83e7b05527e1c401a7feedb2238c0ef88ead97626412ac6f8db7a8037e30b2ee9b31926b0ad217d959b1a93580ffda24c004f01f0d53dad9e66d59a15ef2577b7305d765cfe7daee3a551b1820b819dc7acc74e626c28846f5a4b6744b438d4a9fee45a33b7b8b9a016ad48d01a6fb8f89a03883a519e5d71c6072adcbdf8778d554cc7a0f4c148a8866d608f65f815028c0270ee9fbf16eb266a4aed05b915e7b71b61734b45b7a34f16e5f8e0cda866a330b6532b3316a2996d24b17b2d08ece1fbdc2d08fcc729fbbedc406ec1e5d01897f7f1c064ca41cae0d544a7bc449eb0dac983c5f30152292913c6509f24f4d58a3c54ed6701711f3bbed5d32a49d0e9389b161f1c0917b49a3c30186925558c9d4409683a8ee854b11d9d380e2bedae628d77bf5f38d55448c407c028986e8756d0a82fbdb8637500aabf2ea3de3dab2930b80165b0ea3603dfd33d9451b07fdaeff7ad20bafc612ea2cf99865b359ddcfa43edcd9de6cc0ff0f85fa4768aebf9d2688a0f8b5c491ebb6ca2087253b1505a1e41229ff2f0ff9983726abbb6cea4121c21ace17cbcf20ade7e96d2c85acb82ce0705110d13c7c3124f816b7da17c9cf8e4dc936287f0d872eb735509483f49ae32429b27a890b32218ee5d913295ff7b3ff5e0fabc0426190286da6aecd61d3f95524602e426c7b2f9666dbbd3e587f43708ff140df5be7f230b7c8bc0cdf4ef4922f8fdcfbbaa3c8e19f9c1f11e84158b64e6456fbe942d3828558042422588cd289dddfba3395312bf3cca129a301a59fae634c35f25d805e443513b4fcf161509b7d06e7dc2c22870be92552d8595c2c98bf3be7ec867596b5d8f2b842c6d14ee3b39eb3c51da8f890e450e14033b6db3c679614c46d4048e8e29a411aa808908a42776dd76ca6a455473a2b341305cefc106c88b1588a9e922ec134401119acf9086ce6e7516601c5d7e8fa82eeff68c746b597b0c774b232b6961fbaf54b09d7caa10cfc0f3e1a46cef0cd0799b4c8fb3612ed26c711a907cb2ddfa35f33d879e66671c938b121889676d5cc5bdfeac3d6d6c2f14cc6c0f4d25d63559d23aefac4f2af3ed9e4dcb711fbc772020235fc4926bf46c256a9706dabdce4c8c11538de1044bff03ef1ef86d173a34e5ed976a68bdd1e7e010565deca4dc1df50e5a4c105dd62576782ad818db78a4bd7d177ad60c2c5395ed7140a7cbf044a5b2cce0408dfaafe0d17ec1e92c6f8d95a7a2d68feb09da8ae9bb76bca89b8cc29ba5881ac2265407fc9cfd158074bad93d426b1a27209ca56e4882009cd26c43960cd9f70aa75f521cfa99a1c6023cae3254cbf1b5703d0f9cbc51fb5b8aeb1bbd9472407a49736c1bc1ae166334643a633cf9c5c8cb3c63fb54f71e4067efbabeec81a461c856dedbd5464a57f01656a01e045a5971fb1222e5e0e433ef2bccc210ba51343042644ed78ceea1732d3dafcd5233400365d812a2d5b95e05265362be866c221e168514c7283870bc498b82f24d49e62a65028ac988e5443579c93734994e8f8584e1467d1231d22cd155fe0e6f59051c564881f4b699e6cf68eddf76154a91b668e2afe63332c65006d009981150fe2227e70926fe032b51f85abd457fd233255dec4925858857d9b6e5bc81d94c7ae7fe59eb3fed3864508bd0e2f512da98eae3c5152cdbd72e21682f0c22009875d20eb9be7a8ac426f36f509c6d8eb72e074bcd98aa015f0f5ec559ce", 0x1000, 0x8000}], 0x80c0, &(0x7f0000000240)={[], [{@audit='audit'}]}) timerfd_settime(r0, 0x1, &(0x7f00000002c0)={{0x0, 0x989680}}, &(0x7f0000000300)) 04:09:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x22) [ 1175.782123][T17967] ptrace attach of "/root/syz-executor.4"[17963] was attempted by "/root/syz-executor.4"[17967] 04:09:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x23) 04:09:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x24) 04:09:56 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000080)="f60d148b7a48", 0x6}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x33) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 04:09:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x25) [ 1176.071200][T17981] squashfs: Unknown parameter 'audit' [ 1176.193493][ T8639] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1176.565810][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1176.582748][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1176.619937][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1176.651828][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1176.793931][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1176.818013][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1176.862530][ T8639] usb 1-1: Product: syz [ 1176.880432][ T8639] usb 1-1: Manufacturer: syz [ 1176.948053][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1176.983832][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1177.032504][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1177.863454][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:09:59 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x4f, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:09:59 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha224-generic)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) 04:09:59 executing program 5: r0 = syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0xffffffffffff0000, 0x1, &(0x7f0000000080)=[{&(0x7f0000000000)="14004a1a17a3dc451f2074000404090a1000027400f801", 0x17}], 0x2000000, &(0x7f0000000180)={[{@fat=@nocase='nocase'}, {@fat=@sys_immutable='sys_immutable'}]}) mkdirat(r0, &(0x7f0000000040)='./file1\x00', 0x0) r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000000)=""/50, 0x32) 04:09:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x26) 04:09:59 executing program 4: io_setup(0x8, &(0x7f00000001c0)=0x0) io_pgetevents(r0, 0x1, 0x1, &(0x7f0000000140)=[{}], 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) io_submit(r0, 0x1, &(0x7f0000001300)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) 04:09:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1179.084725][ T8639] usb 1-1: USB disconnect, device number 8 04:09:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x27) 04:09:59 executing program 3: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) getpgid(0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) write(r2, &(0x7f00000001c0), 0xfffffef3) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x22, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) sendfile(r4, r4, 0x0, 0x8080fffffffe) 04:09:59 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x25, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='.', 0x1, 0xffffffffffffffff) keyctl$revoke(0x3, r0) 04:09:59 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./bus\x00', 0x0, &(0x7f0000000100)={'L-', 0x80000000}, 0x16, 0x0) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x10041, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb20e, 0x7}, 0x2, 0x0, 0x7, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0x22) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) semctl$GETVAL(0x0, 0x4, 0xc, &(0x7f0000000340)=""/181) fallocate(r0, 0x10, 0x8003, 0x8020001) kexec_load(0xf5, 0x1, &(0x7f0000000240)=[{&(0x7f00000000c0)="3d6d46f7862c65133251fbba", 0xc, 0x2}], 0x150000) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x8) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, "d8621e9aa7db58d8b30fadcde0787bfa41c7c64d50715f904ff390dbe5f131a5594b5ef033620ec7203cb68cd0ddb2bac12af0e831e886db7d2ea52ee94a593f", "e549aa8a76a2d17524b5b3f248933b9e95a1b9cdf238042d3a18f4555c4f1c30f7637c7eccbe7a9227af21efc02ee1d47fdd4c441a4e482a3419b391abb14f00", "464b98543242259519968bee1dcb333e0ae84016b1f1ae36bd27480edda473a4"}) sendmsg$NL80211_CMD_SET_MAC_ACL(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)={0x90, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x58, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa, 0x6, @broadcast}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x11d) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r3, 0x8028}) creat(&(0x7f0000000040)='./bus\x00', 0x0) 04:09:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x28) 04:09:59 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) signalfd4(r0, 0x0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000280)=0x1, 0x4) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x0, &(0x7f00007fc000/0x600000)=nil) r1 = syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000000)='./file0\x00', 0xffc0000b, 0x2, &(0x7f0000000180)=[{&(0x7f0000000040)="040800090000ff01e66174000410090a0200027400f8", 0x16}, {&(0x7f00000004c0)="dbed7d4cac17", 0x6, 0x1f}], 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB]) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/btrfs-control\x00', 0x18000, 0x0) msgctl$IPC_SET(0x0, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0x4, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x24000850) msgctl$MSG_INFO(0x0, 0xc, &(0x7f00000001c0)=""/120) mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x0) unlinkat(r1, &(0x7f0000001580)='./file0\x00', 0x200) [ 1179.573527][ T8639] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1179.788397][T18068] EXT4-fs error (device sda1): mb_free_blocks:1506: group 7, inode 16384: block 229408:freeing already freed block (bit 32); block bitmap corrupt. [ 1179.804595][T18068] EXT4-fs error (device sda1): ext4_mb_generate_buddy:802: group 7, block bitmap and bg descriptor inconsistent: 32734 vs 32735 free clusters [ 1179.819767][T18068] EXT4-fs (sda1): pa 000000006e4d2925: logic 0, phys. 229408, len 32 [ 1179.828493][T18068] EXT4-fs error (device sda1): ext4_mb_release_inode_pa:4186: group 7, free 16, pa_free 15 [ 1179.871700][T18073] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 1179.969918][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1179.994792][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1180.039166][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1180.048777][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1180.068307][T18068] EXT4-fs error (device sda1): mb_free_blocks:1506: group 9, inode 16384: block 294944:freeing already freed block (bit 32); block bitmap corrupt. [ 1180.083625][T18068] EXT4-fs error (device sda1): ext4_mb_generate_buddy:802: group 9, block bitmap and bg descriptor inconsistent: 32734 vs 32735 free clusters [ 1180.098126][T18068] EXT4-fs (sda1): pa 00000000453b3963: logic 0, phys. 294944, len 32 [ 1180.107339][T18068] EXT4-fs error (device sda1): ext4_mb_release_inode_pa:4186: group 9, free 16, pa_free 15 [ 1180.244170][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1180.259491][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1180.269749][ T8639] usb 1-1: Product: syz [ 1180.280999][ T8639] usb 1-1: Manufacturer: syz [ 1180.324267][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1180.329846][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1180.357684][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1181.233440][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:02 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x4f, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:02 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x29) 04:10:02 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) signalfd4(r0, 0x0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000280)=0x1, 0x4) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x0, &(0x7f00007fc000/0x600000)=nil) r1 = syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000000)='./file0\x00', 0xffc0000b, 0x2, &(0x7f0000000180)=[{&(0x7f0000000040)="040800090000ff01e66174000410090a0200027400f8", 0x16}, {&(0x7f00000004c0)="dbed7d4cac17", 0x6, 0x1f}], 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB]) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/btrfs-control\x00', 0x18000, 0x0) msgctl$IPC_SET(0x0, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0x4, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x24000850) msgctl$MSG_INFO(0x0, 0xc, &(0x7f00000001c0)=""/120) mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x0) unlinkat(r1, &(0x7f0000001580)='./file0\x00', 0x200) 04:10:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:02 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./bus\x00', 0x0, &(0x7f0000000100)={'L-', 0x80000000}, 0x16, 0x0) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x10041, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb20e, 0x7}, 0x2, 0x0, 0x7, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0x22) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) semctl$GETVAL(0x0, 0x4, 0xc, &(0x7f0000000340)=""/181) fallocate(r0, 0x10, 0x8003, 0x8020001) kexec_load(0xf5, 0x1, &(0x7f0000000240)=[{&(0x7f00000000c0)="3d6d46f7862c65133251fbba", 0xc, 0x2}], 0x150000) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x8) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, "d8621e9aa7db58d8b30fadcde0787bfa41c7c64d50715f904ff390dbe5f131a5594b5ef033620ec7203cb68cd0ddb2bac12af0e831e886db7d2ea52ee94a593f", "e549aa8a76a2d17524b5b3f248933b9e95a1b9cdf238042d3a18f4555c4f1c30f7637c7eccbe7a9227af21efc02ee1d47fdd4c441a4e482a3419b391abb14f00", "464b98543242259519968bee1dcb333e0ae84016b1f1ae36bd27480edda473a4"}) sendmsg$NL80211_CMD_SET_MAC_ACL(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)={0x90, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x58, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa, 0x6, @broadcast}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x11d) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r3, 0x8028}) creat(&(0x7f0000000040)='./bus\x00', 0x0) 04:10:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./bus\x00', 0x0, &(0x7f0000000100)={'L-', 0x80000000}, 0x16, 0x0) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x10041, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb20e, 0x7}, 0x2, 0x0, 0x7, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0x22) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) semctl$GETVAL(0x0, 0x4, 0xc, &(0x7f0000000340)=""/181) fallocate(r0, 0x10, 0x8003, 0x8020001) kexec_load(0xf5, 0x1, &(0x7f0000000240)=[{&(0x7f00000000c0)="3d6d46f7862c65133251fbba", 0xc, 0x2}], 0x150000) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x8) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, "d8621e9aa7db58d8b30fadcde0787bfa41c7c64d50715f904ff390dbe5f131a5594b5ef033620ec7203cb68cd0ddb2bac12af0e831e886db7d2ea52ee94a593f", "e549aa8a76a2d17524b5b3f248933b9e95a1b9cdf238042d3a18f4555c4f1c30f7637c7eccbe7a9227af21efc02ee1d47fdd4c441a4e482a3419b391abb14f00", "464b98543242259519968bee1dcb333e0ae84016b1f1ae36bd27480edda473a4"}) sendmsg$NL80211_CMD_SET_MAC_ACL(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)={0x90, 0x0, 0x8, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x58, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa, 0x6, @broadcast}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x11d) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r3, 0x8028}) creat(&(0x7f0000000040)='./bus\x00', 0x0) [ 1182.467791][T21202] usb 1-1: USB disconnect, device number 9 04:10:02 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) signalfd4(r0, 0x0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000280)=0x1, 0x4) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x0, &(0x7f00007fc000/0x600000)=nil) r1 = syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000000)='./file0\x00', 0xffc0000b, 0x2, &(0x7f0000000180)=[{&(0x7f0000000040)="040800090000ff01e66174000410090a0200027400f8", 0x16}, {&(0x7f00000004c0)="dbed7d4cac17", 0x6, 0x1f}], 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB]) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/btrfs-control\x00', 0x18000, 0x0) msgctl$IPC_SET(0x0, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0x4, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x24000850) msgctl$MSG_INFO(0x0, 0xc, &(0x7f00000001c0)=""/120) mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x0) unlinkat(r1, &(0x7f0000001580)='./file0\x00', 0x200) 04:10:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2a) [ 1182.802835][T18103] EXT4-fs error (device sda1): mb_free_blocks:1506: group 12, inode 16333: block 397312:freeing already freed block (bit 4096); block bitmap corrupt. [ 1182.820324][T18103] EXT4-fs error (device sda1): ext4_mb_generate_buddy:802: group 12, block bitmap and bg descriptor inconsistent: 32705 vs 32706 free clusters [ 1182.835323][T18103] EXT4-fs (sda1): pa 00000000e4e7c607: logic 0, phys. 397312, len 32 04:10:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2b) [ 1182.843598][T18103] EXT4-fs error (device sda1): ext4_mb_release_inode_pa:4186: group 12, free 16, pa_free 15 [ 1182.909626][T18104] EXT4-fs (sda1): pa 000000008512429f: logic 0, phys. 397344, len 32 [ 1182.918244][T18104] EXT4-fs error (device sda1): ext4_mb_release_inode_pa:4186: group 12, free 16, pa_free 15 [ 1182.963442][T21202] usb 1-1: new high-speed USB device number 10 using dummy_hcd 04:10:03 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000400), 0x12) 04:10:03 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001500)='/dev/nvram\x00', 0x2c8943, 0x0) signalfd4(r0, &(0x7f0000000000), 0x8, 0x0) [ 1183.029379][T18128] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 04:10:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2c) [ 1183.363652][T21202] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1183.372381][T21202] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1183.439699][T21202] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1183.477998][T21202] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1183.644022][T21202] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1183.653162][T21202] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1183.707761][T21202] usb 1-1: Product: syz [ 1183.711956][T21202] usb 1-1: Manufacturer: syz [ 1183.774295][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1183.779633][T21202] cdc_wdm 1-1:1.0: skipping garbage [ 1183.822867][T21202] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1184.683445][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:06 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x76, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:06 executing program 3: clone(0x80000500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x75, 0x0}) wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xe4, 0x4}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() tkill(r3, 0x25) 04:10:06 executing program 4: clock_gettime(0x4, &(0x7f0000000b80)) 04:10:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2d) 04:10:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000400)={r2, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x2, &(0x7f00000003c0)={r2, 0x3, 0x6, @broadcast}, 0x10) accept4$packet(0xffffffffffffffff, &(0x7f0000000a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) 04:10:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1185.904834][ T9877] usb 1-1: USB disconnect, device number 10 [ 1185.965898][T18182] device lo entered promiscuous mode [ 1186.003042][T18187] ptrace attach of "/root/syz-executor.3"[18185] was attempted by "/root/syz-executor.3"[18187] 04:10:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2e) 04:10:06 executing program 4: write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x0) mlockall(0x1) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) [ 1186.004781][T18182] device lo left promiscuous mode 04:10:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x2f) 04:10:06 executing program 3: mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) munlockall() [ 1186.072549][T18182] device lo entered promiscuous mode [ 1186.081046][T18182] device lo left promiscuous mode 04:10:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000400)={r2, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x2, &(0x7f00000003c0)={r2, 0x3, 0x6, @broadcast}, 0x10) accept4$packet(0xffffffffffffffff, &(0x7f0000000a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) 04:10:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x30) [ 1186.207246][T18207] device lo entered promiscuous mode [ 1186.235527][T18207] device lo left promiscuous mode [ 1186.427589][ T9877] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1186.813742][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1186.832835][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1186.903714][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1186.962547][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1187.153632][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1187.162971][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1187.172148][ T9877] usb 1-1: Product: syz [ 1187.177004][ T9877] usb 1-1: Manufacturer: syz [ 1187.224387][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1187.229785][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1187.247666][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1188.133440][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:09 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x76, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:09 executing program 3: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x5415, 0x74b000) 04:10:09 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000400)={r2, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x2, &(0x7f00000003c0)={r2, 0x3, 0x6, @broadcast}, 0x10) accept4$packet(0xffffffffffffffff, &(0x7f0000000a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) 04:10:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x31) 04:10:09 executing program 4: write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x0) mlockall(0x1) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 04:10:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1189.354606][ T9877] usb 1-1: USB disconnect, device number 11 04:10:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x32) 04:10:09 executing program 3: r0 = open(&(0x7f0000000000)='./file0\x00', 0xa940, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x20000) [ 1189.467096][T18255] device lo entered promiscuous mode [ 1189.478786][T18255] device lo left promiscuous mode 04:10:09 executing program 5: get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0xd4ebfbce4d8660ed) 04:10:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x33) 04:10:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r3 = fanotify_init(0x0, 0x0) fanotify_mark(r3, 0x61, 0x8, r2, 0x0) fanotify_mark(r3, 0x80, 0x0, 0xffffffffffffffff, 0x0) 04:10:09 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x34) [ 1189.923654][ T9877] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1190.333516][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1190.342502][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1190.352668][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1190.362368][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1190.513512][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1190.523006][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1190.533138][ T9877] usb 1-1: Product: syz [ 1190.538142][ T9877] usb 1-1: Manufacturer: syz [ 1190.594443][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1190.599694][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1190.611937][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1191.513441][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:13 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x76, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:13 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="66530700ae897094e71b0fb1f147a825d86800278dcff47d01000067dd32378f364602812c66538d750f6ee1d001f43f0500bb9fb045f2d1eaa302ab6c2fef", 0x3f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r4 = gettid() tkill(r4, 0x40) 04:10:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x35) 04:10:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000380)='vfat\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000600), 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='shortname=lower,dos1xfloppy']) 04:10:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:13 executing program 4: syslog(0x4, &(0x7f0000000280)=""/4096, 0x1000) [ 1192.755458][ T8639] usb 1-1: USB disconnect, device number 12 [ 1192.868684][T18315] FAT-fs (loop3): bogus number of reserved sectors [ 1192.877998][T18315] FAT-fs (loop3): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 1192.890728][T18315] FAT-fs (loop3): Can't find a valid FAT filesystem 04:10:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x36) 04:10:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:13 executing program 4: getdents64(0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff) 04:10:13 executing program 5: openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000000), 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) [ 1192.912014][T18316] ptrace attach of "/root/syz-executor.5"[18311] was attempted by "/root/syz-executor.5"[18316] [ 1192.981286][T18315] FAT-fs (loop3): bogus number of reserved sectors [ 1193.011574][T18315] FAT-fs (loop3): This doesn't look like a DOS 1.x volume; no bootstrapping code 04:10:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_init() r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:13 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x181) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYRES16=0x0], 0x360}, 0x1, 0x0, 0x0, 0x404c000}, 0x10000) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936", 0x18}], 0x1, 0x0, 0x60}], 0x1, 0x8001) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0xd4}, 0x4000048) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\trust\xe3c*sgrVex:De', 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000240)={0x0, 0x0, 0x1}) dup(0xffffffffffffffff) socket(0x0, 0x800000003, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score_adj\x00') sendfile(r3, r3, 0x0, 0x0) [ 1193.081011][T18315] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1193.327179][ T8639] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1193.719296][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1193.736009][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1193.771347][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1193.800628][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1193.944051][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1193.953130][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1193.992620][ T8639] usb 1-1: Product: syz [ 1194.000470][ T8639] usb 1-1: Manufacturer: syz [ 1194.104239][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1194.109657][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1194.153116][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1195.023456][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:16 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x8a, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x37) 04:10:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:16 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x181) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYRES16=0x0], 0x360}, 0x1, 0x0, 0x0, 0x404c000}, 0x10000) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936", 0x18}], 0x1, 0x0, 0x60}], 0x1, 0x8001) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0xd4}, 0x4000048) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\trust\xe3c*sgrVex:De', 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000240)={0x0, 0x0, 0x1}) dup(0xffffffffffffffff) socket(0x0, 0x800000003, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score_adj\x00') sendfile(r3, r3, 0x0, 0x0) 04:10:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x181) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYRES16=0x0], 0x360}, 0x1, 0x0, 0x0, 0x404c000}, 0x10000) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936", 0x18}], 0x1, 0x0, 0x60}], 0x1, 0x8001) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0xd4}, 0x4000048) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\trust\xe3c*sgrVex:De', 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000240)={0x0, 0x0, 0x1}) dup(0xffffffffffffffff) socket(0x0, 0x800000003, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score_adj\x00') sendfile(r3, r3, 0x0, 0x0) 04:10:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_init() r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1196.268333][ T33] usb 1-1: USB disconnect, device number 13 04:10:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x181) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYRES16=0x0], 0x360}, 0x1, 0x0, 0x0, 0x404c000}, 0x10000) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936", 0x18}], 0x1, 0x0, 0x60}], 0x1, 0x8001) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0xd4}, 0x4000048) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\trust\xe3c*sgrVex:De', 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000240)={0x0, 0x0, 0x1}) dup(0xffffffffffffffff) socket(0x0, 0x800000003, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_score_adj\x00') sendfile(r3, r3, 0x0, 0x0) 04:10:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x38) 04:10:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x39) 04:10:16 executing program 5: syz_open_dev$loop(&(0x7f0000001e00)='/dev/loop#\x00', 0x1, 0x0) 04:10:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1196.773542][ T33] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1197.144056][ T33] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1197.163035][ T33] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1197.206876][ T33] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1197.252289][ T33] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1197.414878][ T33] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1197.439155][ T33] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1197.480657][ T33] usb 1-1: Product: syz [ 1197.503262][ T33] usb 1-1: Manufacturer: syz [ 1197.574259][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1197.579755][ T33] cdc_wdm 1-1:1.0: skipping garbage [ 1197.621934][ T33] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1198.483467][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:20 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x8a, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3a) 04:10:20 executing program 5: eventfd2(0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100), 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet(0x2, 0x3, 0x14) setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f0000000400)=ANY=[], 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000340)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendto$packet(r0, &(0x7f00000000c0)="b23d921378e9a83f1254ccf05513784d88a8", 0x1016, 0x1000000, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 04:10:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_init() r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1199.717423][ T9877] usb 1-1: USB disconnect, device number 14 04:10:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3b) 04:10:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3c) 04:10:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1200.293506][ T9877] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1200.705670][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1200.729739][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1200.764727][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1200.792985][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1200.971863][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1200.981575][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1201.006462][ T9877] usb 1-1: Product: syz [ 1201.010947][ T9877] usb 1-1: Manufacturer: syz [ 1201.074402][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1201.079655][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1201.088709][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1201.993464][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:23 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x8a, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace2") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3d) 04:10:23 executing program 5: eventfd2(0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100), 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet(0x2, 0x3, 0x14) setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f0000000400)=ANY=[], 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000340)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendto$packet(r0, &(0x7f00000000c0)="b23d921378e9a83f1254ccf05513784d88a8", 0x1016, 0x1000000, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 04:10:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1203.235129][ T9877] usb 1-1: USB disconnect, device number 15 04:10:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x3e) 04:10:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x41) 04:10:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x42) 04:10:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1203.743535][ T9877] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1204.154070][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1204.162877][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1204.222820][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1204.266718][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1204.444633][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1204.465799][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1204.504603][ T9877] usb 1-1: Product: syz [ 1204.522599][ T9877] usb 1-1: Manufacturer: syz [ 1204.584367][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1204.590904][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1204.619096][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1205.503472][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:27 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x94, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede4160000000000") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x43) 04:10:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:27 executing program 5: eventfd2(0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100), 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet(0x2, 0x3, 0x14) setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f0000000400)=ANY=[], 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000340)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendto$packet(r0, &(0x7f00000000c0)="b23d921378e9a83f1254ccf05513784d88a8", 0x1016, 0x1000000, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 04:10:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1206.726425][ T4901] usb 1-1: USB disconnect, device number 16 04:10:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x44) 04:10:27 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r0, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:27 executing program 5: eventfd2(0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100), 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet(0x2, 0x3, 0x14) setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f0000000400)=ANY=[], 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000340)={0x0, @local, @local}, &(0x7f0000000080)=0xc) sendto$packet(r0, &(0x7f00000000c0)="b23d921378e9a83f1254ccf05513784d88a8", 0x1016, 0x1000000, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 04:10:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x45) 04:10:27 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r0, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x46) [ 1207.233559][ T4901] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1207.626246][ T4901] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1207.668578][ T4901] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1207.718913][ T4901] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1207.773548][ T4901] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1207.944076][ T4901] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1207.953324][ T4901] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1207.993538][ T4901] usb 1-1: Product: syz [ 1207.998095][ T4901] usb 1-1: Manufacturer: syz [ 1208.064420][ T4901] cdc_wdm 1-1:1.0: skipping garbage [ 1208.070179][ T4901] cdc_wdm 1-1:1.0: skipping garbage [ 1208.120860][ T4901] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1208.973476][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:30 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x94, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede4160000000000") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:30 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r0, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x47) 04:10:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x5, &(0x7f0000000000), &(0x7f00000012c0)=0x4) 04:10:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1210.214932][ T1886] usb 1-1: USB disconnect, device number 17 04:10:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x48) 04:10:30 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:30 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$can_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'veth1_to_bond\x00'}) ioctl$TUNGETFILTER(r0, 0x401054d5, 0x0) 04:10:30 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1210.743572][ T1886] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1211.164339][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1211.173039][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1211.190139][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1211.202698][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1211.363861][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1211.373230][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1211.383730][ T1886] usb 1-1: Product: syz [ 1211.388260][ T1886] usb 1-1: Manufacturer: syz [ 1211.434408][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1211.439833][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1211.463884][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1212.343528][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:33 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x94, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede4160000000000") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:33 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x49) 04:10:33 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:33 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x2, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 04:10:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) [ 1213.574900][ T9877] usb 1-1: USB disconnect, device number 18 04:10:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4a) 04:10:34 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4b) 04:10:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:34 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:34 executing program 5: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x4000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffc}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 1214.036057][T18733] ptrace attach of "/root/syz-executor.5"[18732] was attempted by "/root/syz-executor.5"[18733] [ 1214.096706][ T9877] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1214.499435][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1214.513081][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1214.556308][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1214.588556][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1214.759973][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1214.786242][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1214.804472][ T9877] usb 1-1: Product: syz [ 1214.809021][ T9877] usb 1-1: Manufacturer: syz [ 1214.854394][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1214.866398][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1214.893901][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1215.763491][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:37 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x99, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/153) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4c) 04:10:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:37 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000001c0)={0x0, 0x252a, 0x8ad6, 0x3000000, [], [{}, {0x801, 0x0, 0x80000001}]}) clone(0x4c20a700, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000080)={0x2, {0x2, 0x6, 0x20, 0x5, 0x1, 0x10}}) syz_genetlink_get_family_id$netlbl_unlabel(0x0) syz_mount_image$squashfs(&(0x7f0000000000)='squashfs\x00', &(0x7f0000000100)='./file0\x00', 0x1005, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000340)={[], [{@fsname={'fsname', 0x3d, 'euid>'}}, {@fowner_lt={'fowner<'}}, {@hash='hash'}, {@fsname={'fsname', 0x3d, '-^(.&)'}}, {@measure='measure'}, {@hash='hash'}, {@obj_type={'obj_type', 0x3d, '\xf1,*]}'}}, {@uid_lt={'uid<'}}]}) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000040)={0xfffffffffffffff9}) r1 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f00000000c0)) 04:10:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1217.009158][ T9877] usb 1-1: USB disconnect, device number 19 04:10:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4d) 04:10:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1217.185094][T18774] IPVS: ftp: loaded support on port[0] = 21 04:10:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f00000001c0)) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1217.254558][T18769] squashfs: Unknown parameter 'fsname' 04:10:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4e) 04:10:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r1, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1217.425142][T18789] squashfs: Unknown parameter 'fsname' [ 1217.471438][T18769] IPVS: ftp: loaded support on port[0] = 21 04:10:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x4f) [ 1217.573502][ T9877] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1217.970493][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1217.988004][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1218.017815][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1218.032327][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1218.174036][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1218.183200][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1218.213475][ T9877] usb 1-1: Product: syz [ 1218.219309][ T9877] usb 1-1: Manufacturer: syz [ 1218.274258][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1218.279871][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1218.332689][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1219.203486][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:40 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x99, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/153) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x50) 04:10:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f00000001c0)) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:40 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) fcntl$dupfd(r1, 0x406, r2) [ 1220.445351][ T9877] usb 1-1: USB disconnect, device number 20 04:10:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x51) 04:10:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:40 executing program 5: timerfd_settime(0xffffffffffffffff, 0x7, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) 04:10:41 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x52) 04:10:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:41 executing program 5: mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) mincore(&(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f0000000000)=""/219) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) [ 1220.988626][ T9877] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1221.383583][ T9877] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1221.393090][ T9877] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1221.405605][ T9877] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1221.415215][ T9877] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1221.544115][ T9877] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1221.553347][ T9877] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1221.567065][ T9877] usb 1-1: Product: syz [ 1221.571591][ T9877] usb 1-1: Manufacturer: syz [ 1221.624327][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1221.629557][ T9877] cdc_wdm 1-1:1.0: skipping garbage [ 1221.650603][ T9877] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1222.533511][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:44 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x99, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/153) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x53) 04:10:44 executing program 5: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pselect6(0x40, &(0x7f0000000080)={0xeb, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0x0, 0xac, 0x0}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r3 = gettid() tkill(r3, 0x36) 04:10:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f00000001c0)) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x400017e) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) [ 1223.754979][ T1886] usb 1-1: USB disconnect, device number 21 04:10:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x54) [ 1223.827512][T18952] ptrace attach of "/root/syz-executor.5"[18951] was attempted by "/root/syz-executor.5"[18952] 04:10:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:44 executing program 5: syz_mount_image$tmpfs(&(0x7f00000001c0)='tmpfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000380), 0x1040, &(0x7f00000003c0)) 04:10:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x55) 04:10:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) [ 1224.223623][ T1886] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1224.584076][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1224.592929][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1224.603109][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1224.612454][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1224.743614][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1224.752733][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1224.763086][ T1886] usb 1-1: Product: syz [ 1224.768752][ T1886] usb 1-1: Manufacturer: syz [ 1224.814367][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1224.819789][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1224.840338][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1225.733531][ C1] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:47 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x9b, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/155) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x56) 04:10:47 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGBITSW(r0, 0x40049409, &(0x7f0000000200)=""/4096) 04:10:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, 0x0, 0x0) 04:10:47 executing program 2: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) 04:10:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) [ 1226.966880][ T8639] usb 1-1: USB disconnect, device number 22 04:10:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x57) 04:10:47 executing program 5: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$search(0xa, r0, &(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0) 04:10:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, 0x0, 0x0) 04:10:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x58) 04:10:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, 0x0, 0x0) 04:10:47 executing program 5: openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000140)='fuse\x00', 0x0, &(0x7f0000000200)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, 0x0, 0x240040c0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext, 0x528}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000100), 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r1+30000000}, 0x0) [ 1227.468412][ T8639] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1228.214036][ T8639] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1228.226417][ T8639] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1228.253037][ T8639] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1228.271794][ T8639] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1228.407593][ T8639] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1228.419015][ T8639] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1228.441990][ T8639] usb 1-1: Product: syz [ 1228.449751][ T8639] usb 1-1: Manufacturer: syz [ 1228.514884][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1228.543595][ T8639] cdc_wdm 1-1:1.0: skipping garbage [ 1228.567436][ T8639] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1229.433507][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 04:10:51 executing program 0: write$char_usb(0xffffffffffffffff, &(0x7f0000000380)="1df73919a91b9fbd35c77e7881dcd4cb2eb55d1e07bc785063c5719605eeca07805f4133834d6e5f5c29dc7bea62454ed68b04038c3b7d75a43ba3f254f22df52110d6e21f7ba56b386f3b6b655e89d45037a93a4ebb48dd052f6ca7aaae8b6e145c760ebede3d6b686e72e57b46e070c1893bb71fb22dd6bdd2eb408d146a1925ce7579909b254d248fefce67729961c31b7909b48f594e1a820977e858b9d24e0014871d26945e9e7d30f8a871aab7c10366a5a549d5067c36670e47895e961af76d0f18c4e02e04e434d668c13cf5f3b97429b56ec3ad06ad08a1416aca6f655e16396f7c1b11c32c906aa6c84ca78f1983e39942b6c49c4159577d64d9a2715da3eac386c1aa7470689d3c76b0170d393f19d1b1d979a9fd323ab989c658592badde3cf8d201", 0x128) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004000000001f0006031a00000004800200090581", @ANYBLOB="53f3"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB="4417f3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x0, 0x9b, &(0x7f00000002c0)="333d8e3d7ab74e963e724e24ffdf8ab57d41ae54cadbe267614cedff2df002303fc3268c2ccc9deb1699f7445b9b04fdb30c2af7b772f9471ac3f3a71bad882e499eba67c6e348be59ad61b6c857d28ed5a90067aa5d0bbc03abf5aca9cfce6b8b7ff9b73f67faa4c9d8f6bf59d6f3533ebc53f1c5f1728ea3d527ed1e1834c8d278800c2a13b84aace22e14ede41600"/155) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000100)=""/110, 0x6e) 04:10:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x59) 04:10:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x0, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffff78) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000200)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000300)="ca", 0x1}], 0x1) 04:10:51 executing program 2: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) sched_setattr(r0, &(0x7f00000002c0)={0x38, 0x1, 0x4, 0x1, 0x1c89, 0x800, 0xfff, 0x0, 0x3}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') write$binfmt_elf64(r2, &(0x7f00000002c0)=ANY=[], 0x8) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x8027e, 0x0) [ 1230.679837][ T1886] usb 1-1: USB disconnect, device number 23 04:10:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x0, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x5a) 04:10:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x0, 0x0, 0x30, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x5b) [ 1231.273590][ T1886] usb 1-1: new high-speed USB device number 24 using dummy_hcd 04:10:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000080)={{0xe, 0x9b, 0x7, 0x3b, 0x0, 0x31, 0x0, 0x0, 0x46d, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x40) 04:10:51 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000006dc0)={0x0, 0x0, &(0x7f0000006d00)=[{&(0x7f0000000000)={0x14, 0x1a, 0x315, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x5c) [ 1231.634043][ T1886] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1231.659670][ T1886] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1231.714526][ T1886] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1231.773999][ T1886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1231.956801][ T1886] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1231.978549][ T1886] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1232.007667][ T1886] usb 1-1: Product: syz [ 1232.027019][ T1886] usb 1-1: Manufacturer: syz [ 1232.084373][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1232.089696][ T1886] cdc_wdm 1-1:1.0: skipping garbage [ 1232.136461][ T1886] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1233.003587][ C0] cdc_wdm 1-1:1.0: unknown notification 61 received: index 46970 len 38478 [ 1234.277793][T21202] usb 1-1: USB disconnect, device number 24 [ 1355.483616][ C1] rcu: INFO: rcu_preempt self-detected stall on CPU [ 1355.491276][ C1] rcu: 1-....: (1349 ticks this GP) idle=1ce/1/0x4000000000000000 softirq=116354/116354 fqs=5220 [ 1355.503175][ C1] (t=10502 jiffies g=188657 q=777) [ 1355.508406][ C1] NMI backtrace for cpu 1 [ 1355.512710][ C1] CPU: 1 PID: 19056 Comm: syz-executor.5 Not tainted 5.10.0-rc5-syzkaller #0 [ 1355.521438][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1355.531468][ C1] Call Trace: [ 1355.534743][ C1] [ 1355.537579][ C1] dump_stack+0x107/0x163 [ 1355.542060][ C1] nmi_cpu_backtrace.cold+0x44/0xd7 [ 1355.547321][ C1] ? lapic_can_unplug_cpu+0x80/0x80 [ 1355.552511][ C1] nmi_trigger_cpumask_backtrace+0x1b3/0x230 [ 1355.558469][ C1] rcu_dump_cpu_stacks+0x1e3/0x21e [ 1355.563556][ C1] rcu_sched_clock_irq.cold+0x472/0xee8 [ 1355.569166][ C1] ? rcutree_dead_cpu+0x40/0x40 [ 1355.574007][ C1] ? lock_downgrade+0x6d0/0x6d0 [ 1355.578839][ C1] ? __raise_softirq_irqoff+0x93/0x1d0 [ 1355.584274][ C1] update_process_times+0x77/0xd0 [ 1355.589272][ C1] tick_sched_handle+0x9b/0x180 [ 1355.594095][ C1] tick_sched_timer+0x1d1/0x2a0 [ 1355.598918][ C1] ? can_stop_idle_tick+0x290/0x290 [ 1355.604089][ C1] __hrtimer_run_queues+0x1ce/0xea0 [ 1355.609283][ C1] ? hrtimer_sleeper_start_expires+0x80/0x80 [ 1355.615237][ C1] ? ktime_get_update_offsets_now+0x249/0x320 [ 1355.621293][ C1] hrtimer_interrupt+0x334/0x940 [ 1355.626227][ C1] __sysvec_apic_timer_interrupt+0x146/0x540 [ 1355.632442][ C1] sysvec_apic_timer_interrupt+0x48/0x100 [ 1355.638235][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1355.644188][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 [ 1355.650401][ C1] Code: fc ff ff 48 c7 c7 00 d5 38 8b 48 89 54 24 08 48 89 34 24 e8 a2 aa 5e 02 48 8b 54 24 08 48 8b 34 24 e9 a1 fd ff ff 0f 1f 40 00 <65> 48 8b 14 25 00 f0 01 00 65 8b 05 20 eb 91 7e a9 00 01 ff 00 48 [ 1355.670078][ C1] RSP: 0018:ffffc90000d90a40 EFLAGS: 00000246 [ 1355.676204][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8843d58e [ 1355.684149][ C1] RDX: 0000000000000000 RSI: ffff88801462cec0 RDI: 0000000000000001 [ 1355.692181][ C1] RBP: ffff88801b658c00 R08: 0000000000000000 R09: ffffffff8ebad667 [ 1355.700227][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 1355.708258][ C1] R13: ffff88806b620c80 R14: 1ffff920001b2180 R15: ffff88801c7ed900 [ 1355.716316][ C1] ? __rhashtable_lookup+0x16e/0x780 [ 1355.721576][ C1] __rhashtable_lookup+0x591/0x780 [ 1355.726749][ C1] ? sched_clock+0x2a/0x40 [ 1355.731159][ C1] ? sched_clock_cpu+0x18/0x1f0 [ 1355.735984][ C1] ? mark_held_locks+0x9f/0xe0 [ 1355.740720][ C1] ? rht_key_get_hash.isra.0+0x80/0x80 [ 1355.746513][ C1] sta_info_get_bss+0x144/0x3f0 [ 1355.751340][ C1] ? sta_info_get+0x380/0x380 [ 1355.756092][ C1] ? ieee80211_scan_rx+0x237/0x7c0 [ 1355.761306][ C1] ? ieee80211_rx_list+0x1bd5/0x23d0 [ 1355.766571][ C1] ieee80211_rx_list+0xdd3/0x23d0 [ 1355.771815][ C1] ? ieee80211_prepare_and_rx_handle+0x6360/0x6360 [ 1355.778347][ C1] ? find_held_lock+0x2d/0x110 [ 1355.783086][ C1] ? skb_dequeue+0x125/0x180 [ 1355.787652][ C1] ieee80211_rx_napi+0xf7/0x3d0 [ 1355.792474][ C1] ? ieee80211_rx_list+0x23d0/0x23d0 [ 1355.797730][ C1] ? lockdep_hardirqs_on+0x79/0x100 [ 1355.802907][ C1] ? _raw_spin_unlock_irqrestore+0x2f/0x50 [ 1355.808694][ C1] ieee80211_tasklet_handler+0xd3/0x130 [ 1355.814304][ C1] tasklet_action_common.constprop.0+0x22f/0x2d0 [ 1355.820779][ C1] __do_softirq+0x2a0/0x9f6 [ 1355.825257][ C1] asm_call_irq_on_stack+0xf/0x20 [ 1355.830252][ C1] [ 1355.833168][ C1] do_softirq_own_stack+0xaa/0xd0 [ 1355.838164][ C1] irq_exit_rcu+0x132/0x200 [ 1355.842639][ C1] sysvec_apic_timer_interrupt+0x4d/0x100 [ 1355.848331][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1355.854283][ C1] RIP: 0010:unmap_page_range+0x9db/0x2640 [ 1355.859990][ C1] Code: 00 00 4c 39 fb 0f 84 39 0e 00 00 49 89 c7 49 8d 87 00 f0 ff ff 48 89 04 24 e8 01 c1 ce ff 4c 89 e8 48 c1 e8 03 42 80 3c 30 00 <0f> 85 d1 17 00 00 4d 8b 65 00 31 ff 4c 89 e3 48 83 e3 9f 48 89 de [ 1355.879829][ C1] RSP: 0018:ffffc90009c0f798 EFLAGS: 00000246 [ 1355.885870][ C1] RAX: 1ffff1100fedfa3a RBX: 000000007f6fd000 RCX: ffffffff81a5f06e [ 1355.894004][ C1] RDX: ffff88801462cec0 RSI: ffffffff81a1438f RDI: 0000000000000001 [ 1355.902051][ C1] RBP: 000000007f6fd067 R08: 0000000000000001 R09: 0000000000000003 [ 1355.910084][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 000000000007f6fd [ 1355.918047][ C1] R13: ffff88807f6fd1d0 R14: dffffc0000000000 R15: 000000000103b000 [ 1355.926003][ C1] ? flush_tlb_batched_pending+0x3e/0xb0 [ 1355.931609][ C1] ? unmap_page_range+0x9cf/0x2640 [ 1355.936694][ C1] ? unmap_page_range+0x9cf/0x2640 [ 1355.941788][ C1] ? vm_normal_page_pmd+0x510/0x510 [ 1355.946959][ C1] ? lock_downgrade+0x6d0/0x6d0 [ 1355.951783][ C1] ? uprobe_munmap+0x1c/0x560 [ 1355.956433][ C1] unmap_single_vma+0x198/0x300 [ 1355.961258][ C1] unmap_vmas+0x168/0x2e0 [ 1355.965648][ C1] ? zap_vma_ptes+0x100/0x100 [ 1355.970301][ C1] ? write_comp_data+0x2f/0x80 [ 1355.975039][ C1] exit_mmap+0x2b1/0x530 [ 1355.979270][ C1] ? __ia32_sys_remap_file_pages+0x150/0x150 [ 1355.985228][ C1] ? __khugepaged_exit+0x2cd/0x3f0 [ 1355.990311][ C1] ? __khugepaged_exit+0x2d9/0x3f0 [ 1355.995394][ C1] __mmput+0x122/0x470 [ 1355.999453][ C1] mmput+0x53/0x60 [ 1356.003146][ C1] do_exit+0xa72/0x29b0 [ 1356.007291][ C1] ? asm_sysvec_irq_work+0x12/0x20 [ 1356.012374][ C1] ? mm_update_next_owner+0x7a0/0x7a0 [ 1356.017813][ C1] ? asm_sysvec_irq_work+0x12/0x20 [ 1356.023073][ C1] ? do_group_exit+0x57/0x310 [ 1356.027724][ C1] do_group_exit+0x125/0x310 [ 1356.032288][ C1] get_signal+0x42a/0x1f10 [ 1356.036686][ C1] arch_do_signal+0x82/0x2390 [ 1356.041350][ C1] ? asm_sysvec_irq_work+0x12/0x20 [ 1356.046452][ C1] ? copy_siginfo_to_user32+0xa0/0xa0 [ 1356.051798][ C1] ? __do_sys_futex+0x2a2/0x470 [ 1356.056622][ C1] ? do_futex+0x1a60/0x1a60 [ 1356.061104][ C1] exit_to_user_mode_prepare+0x100/0x1a0 [ 1356.066883][ C1] syscall_exit_to_user_mode+0x38/0x260 [ 1356.072494][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1356.078459][ C1] RIP: 0033:0x45deb9 [ 1356.082323][ C1] Code: Unable to access opcode bytes at RIP 0x45de8f. [ 1356.089139][ C1] RSP: 002b:00007f5dfb0edcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1356.097542][ C1] RAX: fffffffffffffe00 RBX: 000000000118c120 RCX: 000000000045deb9 [ 1356.105486][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000118c120 [ 1356.113431][ C1] RBP: 000000000118c118 R08: 0000000000000000 R09: 0000000000000000 [ 1356.121376][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118c124 [ 1356.129321][ C1] R13: 00007fffb90f45df R14: 00007f5dfb0ee9c0 R15: 000000000118c124