last executing test programs:

2m32.653348798s ago: executing program 2 (id=442):
msgget(0x3, 0x208)
msgget(0x3, 0x4)
write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x0, {0x0, 0x0, 0x0, 0x1, 0x2}}, 0x48)
r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
write$vhost_msg_v2(0xffffffffffffffff, 0x0, 0x0)
set_mempolicy(0x1, &(0x7f0000001080)=0xfff, 0xfff)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
socket$inet6(0xa, 0x805, 0x0)
getsockopt$bt_hci(r0, 0x84, 0x2, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0)
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x8010, 0xffffffffffffffff, 0xffffc000)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0)
socket(0x10, 0x803, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r1, 0x5708e000)
msgget(0x3, 0x208) (async)
msgget(0x3, 0x4) (async)
write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x0, {0x0, 0x0, 0x0, 0x1, 0x2}}, 0x48) (async)
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async)
write$vhost_msg_v2(0xffffffffffffffff, 0x0, 0x0) (async)
set_mempolicy(0x1, &(0x7f0000001080)=0xfff, 0xfff) (async)
syz_usb_connect(0x0, 0x24, 0x0, 0x0) (async)
socket$inet6(0xa, 0x805, 0x0) (async)
getsockopt$bt_hci(r0, 0x84, 0x2, 0x0, 0x0) (async)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) (async)
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x8010, 0xffffffffffffffff, 0xffffc000) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r1, 0x5708e000) (async)

2m32.566384918s ago: executing program 2 (id=443):
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x200080, 0x0)
ioctl$SNAPSHOT_ATOMIC_RESTORE(r0, 0x3304)
ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000040)={0x0, 0x1, <r1=>0xffffffffffffffff})
ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f00000002c0)={""/32, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}]})
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000340)=0x2)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000380), 0x400000, 0x0)
ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f00000003c0)=0x3)
ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000400)=0x4000000)
r4 = syz_open_dev$loop(&(0x7f0000000440), 0x100000001, 0x12000)
ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r1)
socket$nl_rdma(0x10, 0x3, 0x14)
statx(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0x0, 0x8, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f00000005c0)={0xb8, 0x0, 0x0, [{{0x6, 0x3, 0x24d1, 0x3, 0x4, 0x64ed9297, {0x1, 0x4, 0xc, 0x0, 0x4, 0x6, 0xb, 0x9, 0x10, 0x1000, 0xffffffff, 0xee00, r5, 0x101, 0x2}}, {0x6, 0x5, 0xb, 0xdc, '/dev/loop#\x00'}}]}, 0xb8)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000680), &(0x7f00000006c0)=0x14)
ioctl$KIOCSOUND(r3, 0x4b2f, 0xfffffffffffff801)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000700)={0x100000001, 0x5})
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0)
r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000780), 0x51800, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r6, 0xc0045009, &(0x7f00000007c0)=0x40)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x70, r8, 0x4, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x1e9f, 0x28}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0xf21}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_FRAME={0x34, 0x33, @disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1}, {0xf3}, @device_a, @device_b, @from_mac, {0x3, 0x2}, @value=@ver_80211n={0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, 0x41, @val={0x8c, 0x10, {0x755, "d6987d7482e7", @short="1c818eca868fed47"}}}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x70}, 0x1, 0x0, 0x0, 0x22000000}, 0x5)
flistxattr(r0, &(0x7f0000000980)=""/37, 0x25)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000a00)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_REGISTER_BEACONS(r9, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x30, r8, 0x100, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x3a}, @val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x0, 0x24}}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x10)
r11 = accept4$unix(0xffffffffffffffff, &(0x7f0000000b00)=@abs, &(0x7f0000000b80)=0x6e, 0x80800)
connect$unix(r11, &(0x7f0000000bc0)=@file={0x1, './file0\x00'}, 0x6e)

2m32.558895785s ago: executing program 2 (id=444):
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000300)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000780)={0xfc78, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) (async)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0) (async)
ioctl$EVIOCGMASK(r1, 0x5b03, 0x0) (async)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) (async)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000080000080000000a90000000030a0300000000000000000002e000000c00020000000000000000010900010073797a30"], 0xb8}}, 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r2, 0x5708e000)

2m32.49329257s ago: executing program 2 (id=445):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vxfs\x00', 0x20080c4, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0)
mount$9p_unix(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x12d7498, 0x0)
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x2a05004, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x83, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = syz_open_dev$loop(&(0x7f0000000180), 0x9, 0x200880)
ioctl$LOOP_GET_STATUS64(r3, 0x4c05, 0x0)
prctl$PR_SET_NAME(0xf, &(0x7f0000000100)='\x85})(})\\/!+,*\'\x00')
r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2)
r5 = eventfd(0xfb)
write$eventfd(r5, &(0x7f0000000440)=0x8c, 0x8)
ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}})
openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f00000002c0)="b800008ec00fc76ce6baf80c66b80ecc138066efbafc0cb030ee0f005200fe0966b817f200000f23d00f21f866353000000e0f23f80f2087f390640f350f01c3", 0x40}], 0x1, 0x35, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000480)="26660f388008c4e279183f0f01d566b8da000f00d0f4ff450cc4e1f8c2832b6400005b66b8ea000f00d067660fc7360700660f388200", 0x36}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0)
r6 = syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00')
write$FUSE_NOTIFY_RETRIEVE(r6, 0x0, 0x4283cafe)
ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)=ANY=[])
ioctl$KVM_RUN(r2, 0xae80, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f0000000500)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8)
r8 = socket(0x40000000015, 0x5, 0x0)
ioctl$KVM_SET_DEBUGREGS(r6, 0x4080aea2, &(0x7f00000003c0)={[0x5000, 0x8080000, 0x3000, 0x3000], 0x100000001, 0x20, 0xcd})
connect$inet(r8, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
quotactl$Q_SETINFO(0x0, &(0x7f0000000080)=@sr0, r7, &(0x7f0000000200)={0x4aaa, 0x4, 0x0, 0x3})

2m32.138422774s ago: executing program 2 (id=449):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x200000, 0x0)

2m30.431838779s ago: executing program 2 (id=461):
r0 = semget$private(0x0, 0x2, 0x0)
semop(r0, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1)
semop(r0, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x4294, 0x1800}, {0x3, 0xd0a3, 0x1000}], 0x2, &(0x7f0000000080))
semtimedop(r0, &(0x7f0000000000)=[{0x3, 0x3ff, 0x1000}], 0x1, &(0x7f0000000040)={0x0, 0x3938700})
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbbd, 0x20011, r1, 0xebe3b000)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0xc)
setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000300)=0x30, 0x1)
r4 = socket$rxrpc(0x21, 0x2, 0xa)
setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3)

2m30.164233937s ago: executing program 32 (id=461):
r0 = semget$private(0x0, 0x2, 0x0)
semop(r0, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1)
semop(r0, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x4294, 0x1800}, {0x3, 0xd0a3, 0x1000}], 0x2, &(0x7f0000000080))
semtimedop(r0, &(0x7f0000000000)=[{0x3, 0x3ff, 0x1000}], 0x1, &(0x7f0000000040)={0x0, 0x3938700})
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbbd, 0x20011, r1, 0xebe3b000)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0xc)
setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000300)=0x30, 0x1)
r4 = socket$rxrpc(0x21, 0x2, 0xa)
setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3)

3.054377024s ago: executing program 4 (id=1640):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r1, &(0x7f0000003c40)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@alg={0xe0, 0x10, 0x1, 0x70bd26, 0x25dfdbff, {{'sha3-256\x00'}, '\x00', '\x00', 0x2400, 0x4000}}, 0xe0}, 0x1, 0x0, 0x0, 0xc890}, 0x4000080)
ioctl$TIOCSIG(r0, 0x40045436, 0x2)
shmget$private(0x0, 0xfffffffffeffffff, 0x4000000, &(0x7f0000ffc000/0x3000)=nil)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x145342, 0x0)
sendfile(r2, r2, 0x0, 0x2fe4)

3.053610746s ago: executing program 3 (id=1641):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x44a00, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10)
connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9)
syz_usb_connect(0x2, 0x3d, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x5f, 0xfc, 0x70, 0x20, 0x711, 0x210, 0xfdd6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8b, 0x0, 0x2, 0xbe, 0x44, 0x8f, 0xff, [], [{{0x9, 0x5, 0x80, 0x2, 0x3ff, 0x9, 0xf, 0x5, [@generic={0x7, 0x5, "bdf74e3781"}]}}, {{0x9, 0x5, 0x8b, 0x3, 0x40, 0xe, 0x4b, 0x2}}]}}]}}]}}, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f030000000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x0)
ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f00000002c0)={0x2, &(0x7f0000000040)=[{0x28, 0x0, 0x0, 0xfffff018}, {0x6}]})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x4a58c000)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r5, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r6, 0x2, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x9a8}], @NL80211_ATTR_DURATION={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x28}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x28a}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x4040091)
recvmmsg(r4, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}, 0x80000001}], 0x1, 0x143, 0x0)
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000240)={0x0, 0x0, <r7=>0xffffffffffffffff})
ioctl$DRM_IOCTL_GET_MAP(r7, 0xc0286404, &(0x7f0000000280)={&(0x7f0000a72000/0x4000)=nil})
setfsuid(0x0)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0xef29a, 0x0, 0x10, 0xb2, 0x80000001, 0x0, 0x0, 0x40, 0x8000}}, 0x50)
r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r9, &(0x7f0000000000)={0x1f, @none}, 0x8)
listen(r9, 0x9)
sendmmsg$inet(r8, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000001540)="5823766e1ca1e9e052", 0x9}], 0x1}}], 0x1, 0x8800)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f00003a9000/0x2000)=nil, 0x2000)

3.037658681s ago: executing program 4 (id=1642):
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0)
r1 = socket$l2tp(0x2, 0x2, 0x73)
socket$inet_tcp(0x2, 0x1, 0x0)
sendto$l2tp(r1, 0x0, 0x18, 0x0, &(0x7f00000000c0)={0x2, 0x0, @multicast1=0xe000006a}, 0x10)
io_setup(0x20, &(0x7f0000001140)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000080)="0d32818e7e6ae0", 0x7}])
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e22, 0x81, @mcast2, 0xffffffff}, 0x1c)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000140)={{0x1, 0x1, 0x18, <r5=>r3, {0x7, 0x10000}}, './cgroup\x00'})
ioctl$USBDEVFS_RESET(r5, 0x5514)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r7 = socket$kcm(0x2, 0xa, 0x2)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
r10 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_tcp_int(r10, 0x6, 0x13, 0x0, &(0x7f0000000040))
sendmsg$DEVLINK_CMD_PORT_GET(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)={0x60, r9, 0x1, 0x70bd27, 0x0, {0x49}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfcf6, 0x3, 0x2}}}]}, 0x60}}, 0x24004000)
setsockopt$MRT_TABLE(r5, 0x0, 0xcf, &(0x7f0000000180)=0xff, 0x4)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x4, 0x8, 0xb02, 0x0, 0x0, {0x5, 0x0, 0x6}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x2f}]}, 0x1c}}, 0x4040)
write$tun(r6, &(0x7f0000000480)=ANY=[@ANYRESHEX=r2], 0x2e)
syz_open_dev$video4linux(&(0x7f0000000080), 0x3, 0x0)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r12, 0xae60)
ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0)

2.758392417s ago: executing program 4 (id=1644):
madvise(&(0x7f000069d000/0x4000)=nil, 0x4000, 0x2)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x22052, r0, 0x2000)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x4000000000001d7)
r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
r3 = socket(0x10, 0x803, 0x0)
write(r3, &(0x7f0000000040)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000d9bffc), 0x4)
sendto(r3, &(0x7f00000005c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0)
recvmmsg(r3, 0x0, 0x0, 0x0, 0x0)
recvmmsg(r3, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/280, 0x118}, {&(0x7f0000004c40)=""/4097, 0x1001}, {&(0x7f0000000700)=""/129, 0x81}, {&(0x7f0000000380)=""/169, 0xa9}, {&(0x7f00000002c0)=""/183, 0xb7}], 0x5}, 0x401}], 0x1, 0x0, 0x0)
r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000180)={0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="4600000000000000200000000000000000000000000000000e000000000000000000000000000000180000000000000001040000000000000a000000000000006c00000000000000c48269f7aea00000003e439cb805000000b9003800000f01c1450f01c967640fc75b0066400f2dc1f30f2a74bd026566430f38800bc7442400fe000000c744240243c02cc7ff2c24c74424004d000000c744240201000000ff2c24c31400000000000000180000000000000057fbffff0000000032000000000000001800000000000000f402000000000000140010000000000018000000000000003d0000002a7100003200000000000000180000000000000097090000000000000a000000000000004d000000000000002646b000da4600c744240018000000c74424027a540000ff1c2466f2420fd6f6480fc718440f01d10f78988a000000360f21ec0f01c5660f381e7a00c31e0000000000000020000000000000008809000000000000008000000000c021f44d94eacf599cd6349123f11fceb306abb6adcf88ac370be5e633bab4763e645cf78a8b0eb8220890a4a1b3723f5e3a3f37287a08c0131982fe5807dd33e81cc4af22912b073fc8dbd2021deb3ca8cb099c829322e681455f917dd8771a91064fd68b4c1cd9c613cb8e24652d1b15e7816549db2641a5b86265b3fa2c2cc2095bab9bf9edebefb056d53afad7e5200d8cd25384a3e7e50e197a18ed5c966523e25042e4c4c37675ed893f96a8c2ea254ffe18808a06d721a0e743e0cdeab9a25e448af402751974c4fa8abc91cc4b32763b93"], 0x171})
syz_usb_connect(0x3, 0x7d, &(0x7f0000001140)={{0x12, 0x1, 0x110, 0x87, 0x80, 0x5b, 0x8, 0x557, 0x2008, 0xa708, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6b, 0x2, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8e, 0x4, 0x2, 0x49, 0xa6, 0xdf, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0xa, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2f, 0x8}]}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x81, 0x3, 0xff}}]}}, {{0x9, 0x4, 0x70, 0x1, 0x3, 0xa7, 0x8c, 0x67, 0x3, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x4, [@generic={0x7, 0x5, "a6c6415a9f"}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x82, 0xb}}]}}]}}]}}, 0x0)
mmap$KVM_VCPU(&(0x7f0000532000/0x3000)=nil, r2, 0x1000000, 0x12, r4, 0x0)
r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={<r6=>0xffffffffffffffff}, 0x13f, 0x6}}, 0x20)
write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r6}}, 0x18)

2.589739355s ago: executing program 1 (id=1646):
mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)='usrquota')
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r0 = socket$inet6(0xa, 0x3, 0x5)
sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000000004802900000037000000"], 0x10}}], 0x1, 0x4044084)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r1, 0x8917)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167840, 0x0)
fadvise64(r2, 0x94, 0x6e, 0x5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r2, 0x2000)

2.50517415s ago: executing program 1 (id=1648):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x1}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64342, 0x0) (async)
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) (async, rerun: 32)
r2 = getpid() (rerun: 32)
r3 = gettid()
rt_tgsigqueueinfo(r2, r3, 0xb, &(0x7f0000000080)={0x0, 0x10, 0x2}) (async, rerun: 64)
r4 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffff9]}, 0x8) (rerun: 64)
read(r4, &(0x7f0000000740)=""/377, 0x179) (async)
sendfile(r1, r1, 0x0, 0x7ffff000) (async)
r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, 0x2) (async)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) (async)
r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
pipe(&(0x7f0000000080)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$TUNGETIFF(r7, 0x800454d2, &(0x7f0000000100)={'veth0_to_bridge\x00'})
write$binfmt_misc(r8, &(0x7f0000000000), 0xfffffecc) (async)
ptrace(0x10, r6)
ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r6, 0x2000000, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

1.979661867s ago: executing program 4 (id=1651):
pipe2(&(0x7f0000000180)={<r0=>0xffffffffffffffff}, 0x80080)
inotify_add_watch(r0, 0x0, 0x1)
ioprio_set$pid(0x1, 0x0, 0x0)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
syz_usb_connect(0x3, 0x2f, &(0x7f0000000b40)={{0x12, 0x1, 0x300, 0x8b, 0x7, 0xb4, 0x10, 0x499, 0x1020, 0xd0bf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d, 0x1, 0x8, 0x6, 0x50, 0x3, [{{0x9, 0x4, 0xac, 0x1, 0x1, 0x6c, 0x77, 0xf6, 0xb7, [@generic={0x2, 0x10}], [{{0x9, 0x5, 0x7, 0x0, 0x20, 0x1, 0x34, 0x4}}]}}]}}]}}, &(0x7f0000001a00)={0x0, 0x0, 0x0, 0x0})
sendfile(r1, r1, 0x0, 0x7ffff000)

1.622618183s ago: executing program 1 (id=1652):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="60000000020605000000000000000000000000001800078008000800017492a20c00018008000140ffffffff0500010006000000050005000200001005000400000000000900020073797a30000000000e0003006269746d61703a6970000000"], 0x60}}, 0x44)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000)

1.554214635s ago: executing program 1 (id=1653):
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a"], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47b07c7d], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000], [0x0, 0x9, 0x0, 0x0, 0x0, 0x800000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c)
ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0)
r1 = dup(r0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x5)
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$uinput_user_dev(r1, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x100, 0x81}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xd, 0x7fff, 0x6, 0x6, 0x5, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xfffff5ee, 0x401, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x7, 0xfffffff9, 0xa, 0x2, 0x5, 0x0, 0x4, 0x6, 0x7, 0x4c, 0xfffffffd, 0x80, 0x8, 0x0, 0x9, 0x7, 0x8000101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x10000, 0x4], [0x8, 0x3, 0x8, 0x8, 0x0, 0x9, 0x4, 0x0, 0x25, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x0, 0x3b40, 0x4, 0x1000, 0x5, 0x7fff, 0x8, 0x5a, 0xffff2503, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdaa, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x10, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0x3, 0x8000008, 0x3, 0x2, 0x3a6, 0x27f8, 0xc0d, 0xfffffffd, 0x4, 0xc, 0xfffffffb], [0xa3, 0x6, 0x6, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0x100, 0x1000, 0xf1, 0x6, 0xc, 0x10000, 0x72, 0xc, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x3, 0x8, 0x2ef3adeb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x7ff, 0xfffffff2, 0x63, 0x7, 0x10000, 0x3, 0x3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x3, 0x40000a8a, 0x2, 0x6, 0x77, 0x8a, 0x1ff, 0x7, 0x7, 0x2, 0x0, 0x2, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x8000, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x4, 0x7fff, 0x5, 0x5, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x4, 0x4, 0x4, 0x0, 0x0, 0x7, 0x4e6, 0x8, 0x6, 0x5ef, 0x8000, 0xc, 0x2, 0x401, 0x1, 0x5, 0x8, 0x9a8, 0x99f, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x1ff, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="180000006800"], 0x1c}], 0x1}, 0x4000080)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0xffff, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x5, 0x5, 0x2, 0xe661, 0x4, 0x7, 0x5, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x407, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x0, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x5, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x9, 0x1, 0x200, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x0, 0x7fff, 0x0, 0x5, 0x8, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xfffffffa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x1, 0x16, 0xffffffff, 0x80000003, 0x5, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x20000d7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2)
syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
close_range(r4, 0xffffffffffffffff, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0)
r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x260)
r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
sendfile(r6, r3, &(0x7f0000000000)=0x7ffffffa, 0x10)
r7 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r8 = dup(r7)
read$FUSE(r8, &(0x7f00000040c0)={0x2020}, 0x2020)
ioctl$TCSETSF(r8, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x515f3157, 0x0, "00000000ade82a8017000000000000000100"})
write$UHID_INPUT(r8, &(0x7f0000001040)={0xd, {"a2e3ad21ed6b0af99cfbf4c007f70eb4d04fe7ff7fc6e5539b0872fc8b546a1b4d09940f08900c878f0e1ac6e7049b4cb4956c409b3c2a0867f3988f7ef319520100ffe8d178708c523c921b1b0f5a0a169b50d336cd3b78130daa61d8f809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1010}}, 0x1b7)

1.453347709s ago: executing program 1 (id=1654):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x12, r0, 0xa0e52000)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x8000000, 0x200}, {}, 0x0, 0x0, 0x2}, [@algo_crypt={0x48, 0x2, {{'cfb(blowfish-generic)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'sha3-224-generic\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x41) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000001100), 0x2, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async)
ioctl$FIONCLEX(r0, 0x5450) (async)
r2 = getpid() (async)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000'])
syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a0000052413"], 0x0) (async)
r3 = socket$isdn_base(0x22, 0x3, 0x0)
bind$isdn_base(r3, &(0x7f0000000000)={0x22, 0xe5, 0x6, 0xf9, 0xdf}, 0x6)
syz_pidfd_open(r2, 0x0)
sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x2) (async)
r4 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00')
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17)
writev(r4, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x17)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

1.407355229s ago: executing program 3 (id=1655):
syslog(0x3, &(0x7f0000000400)=""/4096, 0x1000)
r0 = creat(&(0x7f0000000140)='./file0\x00', 0x71)
r1 = socket$tipc(0x1e, 0x7, 0x0)
bind$tipc(r1, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10)
bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10)
mount(&(0x7f0000000180)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='hfsplus\x00', 0x208083, 0x0)
ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000040)=0x1)
syslog(0x3, &(0x7f0000000400)=""/4096, 0x1000) (async)
creat(&(0x7f0000000140)='./file0\x00', 0x71) (async)
socket$tipc(0x1e, 0x7, 0x0) (async)
bind$tipc(r1, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async)
bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10) (async)
mount(&(0x7f0000000180)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='hfsplus\x00', 0x208083, 0x0) (async)
ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000040)=0x1) (async)

1.256828024s ago: executing program 0 (id=1657):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x4a58c000)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
r1 = getpid()
r2 = syz_pidfd_open(r1, 0x0)
process_madvise(r2, 0x0, 0x0, 0x18, 0x0)
r3 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382)
ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r3)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r4)
ptrace$setregset(0x4211, r4, 0x202, 0x0)
r5 = creat(&(0x7f0000000080)='./file0\x00', 0x2a)
syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000280)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r5, @ANYRES64=r5], 0x0)
ioctl$RTC_VL_CLR(r5, 0x7014)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000003040)={'wlan0\x00'})
ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x40189429, &(0x7f0000000000)={0x1, 0x100, 0x9b02})
r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48241, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r7 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="00000806000003"], 0xfdef)
sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x10)
ioctl$DRM_IOCTL_GET_STATS(0xffffffffffffffff, 0x80f86406, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f00000c8000/0x4000)=nil, 0x4000)

1.122786359s ago: executing program 3 (id=1658):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f000000ae00), 0x0, 0x0)
ioctl$SOUND_OLD_MIXER_INFO(r1, 0x80304d25, 0x0)
sendmsg$netlink(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="100100005f00010100000000ffdbdf2500015080750087809909b9a3556a23ac132da78ad50ddbaa9297c73d4757c1a8d8f277b2329eebef8b0dca3c3a876e267a7343a855eb06e2d9d4588b14839b21a9172f9906bbbc78a6b3d01b1fc87230a0cd617814b9949b235ab272f4f54b9cb3df0d9dd526002f5cd158f87c650729a527015c00000047e3b9708db25322e01bdc0100000000000000feaeb8aba7698c5de50637fbdb7cd6ce33317694ca210f9e118ce2cc7bc8ab42b979233442dcb2ebfa85274d92617080ae72d77583845f590c3c72084a6d930695c3fbd26fdd89ae827d55240034e97f185635d504e7ec283dd9bda165aaac4aaacc4e2f456e458f8ea3dd746bdb1b0ea1f377f68ef265cd1d1c1c19de8947731269907d4dab0dfa1396f1d9b9fef5abbe98026d385cece4df648c229a4dca"], 0x110}], 0x1}, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0)

1.026264816s ago: executing program 3 (id=1659):
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x1ea)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='bbr\x00', 0x4)
setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0xcf}, 0x4)
sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0)
r2 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r3=>0x0}, &(0x7f0000cab000)=0xc)
mount$bpf(0x0, &(0x7f0000000100)='.\x00', &(0x7f00000006c0), 0x400008, &(0x7f0000000000)={[{@uid={'uid', 0x3d, r3}}]})
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00')
lseek(r4, 0x10001, 0x0)
recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='qnx4\x00', 0x84, 0x0)

738.763671ms ago: executing program 4 (id=1660):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="20000000100001070000000000000000030000000c0002"], 0x20}}, 0x0)
recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=""/197, 0xc5}, {&(0x7f0000000ac0)=""/4090, 0xffa}, {&(0x7f0000000740)=""/191, 0xbf}, {&(0x7f0000000180)=""/79, 0x4f}], 0x4}}], 0x2, 0x0, 0x0)
creat(&(0x7f0000001380)='./file0\x00', 0x4)
mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='omfs\x00', 0x0, 0x0)

708.616258ms ago: executing program 1 (id=1661):
capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7})
mkdir(&(0x7f0000000400)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x152)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@userxattr}, {@workdir={'workdir', 0x3d, './bus'}}]})
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000140)='g')
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000)

636.447403ms ago: executing program 4 (id=1662):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0x6}}, './file0\x00'})
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000100)={{0x7000, 0xdddd1000, 0x0, 0x0, 0x8, 0x8, 0x0, 0x2, 0x0, 0x6, 0x9, 0x10}, {0x8080000, 0x0, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x100000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0xeeee8000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0xd, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80}, {0x8080000, 0x0, 0xa, 0x6, 0x5, 0x0, 0x3}, {0x80a0000, 0xdddd0000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xa, 0x26}, {0x80a0000}, {0xeeef0000}, 0xfdfcffdb, 0x0, 0x0, 0x28, 0xb, 0xf801, 0x0, [0x0, 0x0, 0x1]})
r4 = syz_open_dev$usbfs(&(0x7f0000000140), 0x76, 0x101301)
ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000080)={0x2, 0xb, 0xf18, 0x7, 0x0, 0x67, 0x0})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f00000000c0)={0x40000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
syz_usb_connect(0x0, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0xe3, 0xdd, 0xef, 0x20, 0x1d50, 0x60a1, 0xa14f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9d, 0x14, 0x4e}}]}}]}}, 0x0)
recvmmsg(r5, &(0x7f0000006600)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000000e80)=""/223, 0xdf}, {&(0x7f0000000f80)=""/116, 0x74}, {&(0x7f0000001000)=""/220, 0xdc}, {&(0x7f0000001100)=""/137, 0x89}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x5}, 0x7}, {{0x0, 0x0, 0x0}, 0x26}, {{0x0, 0x0, &(0x7f00000058c0)=[{&(0x7f0000004500)=""/39, 0x27}, {&(0x7f0000004540)=""/199, 0xc7}, {&(0x7f0000006480)=""/232, 0xe8}, {&(0x7f0000004740)=""/61, 0x3d}, {&(0x7f0000004780)=""/231, 0xe7}, {&(0x7f0000004880)=""/4096, 0x1000}, {&(0x7f0000005880)=""/24, 0x18}], 0x7}, 0x10000}], 0x6, 0x20, 0x0)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x3c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_FRAME={0x14, 0x33, @ctrl_frame=@cf_end_cf_ack={{}, {0x2}, @device_a, @device_b}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r9)
munmap(&(0x7f0000012000/0x4000)=nil, 0x4000)
write(r8, &(0x7f0000001400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1000)

542.11429ms ago: executing program 33 (id=1661):
capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7})
mkdir(&(0x7f0000000400)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x152)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@userxattr}, {@workdir={'workdir', 0x3d, './bus'}}]})
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000140)='g')
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000)

534.046557ms ago: executing program 0 (id=1664):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed9bebbbd, 0xa0011, r3, 0x52fbb000)
ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000001180)={[0x6, 0x1, 0x49d6069d, 0x3f5, 0x2, 0x0, 0x5, 0x3, 0x3df, 0x1, 0x4, 0x4, 0xe, 0x1000, 0x0, 0x2, 0x4, 0x6, 0xffff, 0x1, 0xd, 0xb, 0x9, 0x3, 0x75d6, 0x3, 0x4, 0xffff, 0x10001, 0x0, 0x553, 0x3, 0x7, 0xda, 0x1, 0x0, 0xfffffffa, 0x0, 0xa, 0x2, 0x8, 0xffffffff, 0xffff2cd5, 0x3, 0xf, 0x8, 0x3, 0xbc1, 0x1, 0x0, 0x5620, 0x7, 0xa4b, 0xffff, 0x5, 0x9, 0x2, 0x4, 0x8000, 0x4, 0x400, 0x6, 0x4a, 0x3, 0x401, 0x0, 0x80000000, 0x62, 0xfff, 0x6, 0x8, 0x800000, 0x5, 0x1, 0x3, 0xc, 0x900, 0x9, 0xfffff801, 0xd14, 0xffffffff, 0x7f, 0x9, 0x7, 0x6, 0x7, 0x5, 0x5, 0x1, 0xfab7, 0x4, 0x8, 0x8, 0x5ab6, 0x80000000, 0x0, 0x99, 0x5, 0x9, 0x1ff, 0x6, 0x80, 0x915f, 0x1, 0xdcde, 0x2, 0x450, 0x2, 0x1, 0x8, 0x1, 0x0, 0x9, 0x6, 0x9, 0xfff00000, 0x0, 0x4, 0x4, 0x9, 0x7, 0x2dec, 0x2, 0x8073, 0x6, 0xa, 0x2, 0xfffffff9, 0x0, 0x7d3, 0x4, 0x1, 0x80000000, 0x4, 0xe, 0xe, 0x0, 0x6, 0x7fffffff, 0x9, 0x6, 0xfffffff3, 0x40, 0xee, 0xadb, 0x5, 0x2, 0xa00, 0xd13, 0x55de, 0x8, 0x2, 0x0, 0x4, 0x6bbe, 0xb18, 0x6, 0x800, 0x8, 0x8, 0xda3f, 0xaf, 0x4, 0x2, 0x100, 0x80, 0x7, 0x5, 0x4, 0x2, 0x80000001, 0x400, 0xffff2826, 0x9, 0x7, 0x2, 0x487f4171, 0x3, 0x5, 0x800, 0x80000000, 0x7, 0x4, 0x871, 0x50, 0x0, 0xff, 0x0, 0x7, 0x5, 0x1, 0x10000, 0xfffffffe, 0x5, 0x2, 0xb0, 0xfffffff5, 0x319, 0x2392, 0xbfd, 0x7, 0x80, 0x13, 0x6, 0x448, 0xeb48, 0x6, 0x5, 0x6c, 0x100, 0x80, 0x4, 0x5, 0x0, 0xe3a1, 0xffff, 0x17f, 0x4, 0x2, 0x6, 0x32c, 0x1000, 0x5, 0x4, 0xfffffff0, 0x3, 0x6, 0x7, 0x8, 0x9, 0x10, 0x6, 0x9, 0x915e, 0x7, 0x7, 0x738d, 0x10, 0x7, 0x1, 0xf, 0x7446, 0xfffffff9, 0x1, 0x7, 0xfffffff8, 0x9, 0xff, 0x0, 0x3, 0xe5, 0x2e2, 0x26210000, 0x3, 0x9, 0x40, 0xe, 0x7fffffff, 0x1, 0x4, 0x1, 0x75ee915a, 0x0, 0x1, 0x6, 0xa8ba, 0x0, 0x2, 0x5, 0x6, 0x7fff, 0x7ff, 0x4, 0x565, 0x80000000, 0x81, 0x7, 0xc, 0x0, 0xffffffff, 0x10, 0x2, 0xe, 0x5, 0x3, 0x8, 0x6, 0x9, 0x7, 0x2, 0x2, 0x3, 0x8, 0x6, 0x9, 0xb, 0x3, 0xb58d, 0x4, 0xfffffff8, 0xa9, 0x4, 0x9, 0xffff0000, 0x8, 0x7, 0x9, 0xfffffffa, 0x1, 0x7, 0x1, 0x7fffffff, 0x5, 0x8, 0x7b, 0xf, 0xc, 0xb08f, 0x5, 0x7ff, 0x2, 0xcaab, 0x9, 0x5, 0x7ff, 0x9, 0x3, 0x6, 0xffffff01, 0xd12, 0x3, 0x8, 0x6, 0x400, 0x3, 0x7, 0xa935, 0x300000, 0xa3, 0xc, 0x5, 0x5, 0x7ff, 0x7, 0x10000, 0x2, 0x8, 0x10001, 0x3ff, 0x3, 0x3, 0x3, 0x66a, 0x3, 0xff, 0x1ff, 0x6, 0x6, 0x6, 0x2, 0x80, 0x0, 0x8, 0x88c, 0x56c, 0x7, 0x98, 0x5, 0x2, 0x8, 0x8, 0x1, 0x7ff, 0x0, 0x5a3c, 0x7fffffff, 0x7, 0x9c, 0x1ff, 0xa00000, 0xffff, 0xd, 0xc6ea, 0xfff, 0x7ff, 0xc594, 0x3, 0x18, 0xa, 0x726c, 0x8, 0x3, 0xd71, 0xc, 0x9, 0x8, 0x2, 0x5, 0x0, 0x10, 0x0, 0xb9, 0x4, 0x9, 0xfff, 0x12, 0x7fff, 0x9, 0x8, 0x7fff, 0x9, 0xb4b, 0x6, 0x1, 0xa312, 0x553, 0x1, 0x0, 0xfffffffc, 0x2, 0xf, 0xe, 0x1, 0x3, 0x48, 0xf2, 0xa28, 0x4, 0xb3c, 0x4, 0xfffffffe, 0xf726, 0x0, 0x4, 0x80000000, 0x1, 0x8, 0xf4, 0x9, 0x2, 0x3, 0x8, 0x4, 0xfffffffe, 0x7, 0x7, 0x48, 0xf, 0xbab, 0xfffffe00, 0x2, 0x7fffffff, 0xfffffffc, 0x10000, 0x4, 0x36c, 0x1, 0x100, 0x3, 0x101, 0x7, 0x0, 0x6, 0x2, 0x5, 0x1, 0x800000, 0x4, 0x5, 0x100, 0x1000, 0x9, 0xde5c, 0x200, 0x80000001, 0xff, 0x0, 0xd, 0x4, 0x0, 0x7cbe8276, 0x3d4, 0x186, 0x1, 0x4, 0x6, 0xfffffffa, 0x1, 0xa000, 0x8, 0x3ad3125e, 0xfffff491, 0x81, 0x2, 0xffffff01, 0x800, 0x3ff, 0x39ae, 0xdf3, 0xe1d2, 0xffffee22, 0x1, 0x1000, 0x1a2f91b4, 0x6, 0x8, 0xfb3, 0x8, 0x3, 0x8, 0xc, 0x1, 0x152, 0xfffffff9, 0x2a, 0x5, 0xfff, 0x7fffffff, 0x4, 0x3000, 0x9, 0x8, 0x7fff, 0x10, 0x3, 0x8, 0x10, 0x57, 0xf, 0x8, 0x2, 0xff, 0xe1, 0xa9, 0x8, 0x8, 0x8c, 0x69e8, 0x130a, 0x4, 0x9, 0x80, 0x2, 0x8, 0x9, 0xfff, 0x7fff, 0x10000, 0x7ff80, 0x8, 0x2, 0x4, 0x90000000, 0x1, 0x7, 0xfffffffd, 0xa12, 0x7, 0xea8, 0x5bf8, 0x2, 0x6ab, 0x3, 0xf, 0xffff, 0x1, 0xfffffffb, 0x80000001, 0x80000001, 0x5, 0x0, 0x78, 0x8, 0x0, 0x0, 0x8001, 0x1, 0x6, 0x4, 0x7, 0x6, 0x400, 0x1, 0xb72, 0x0, 0x4800, 0xdd7f, 0x7, 0x6, 0x9, 0xe, 0x95f, 0x1ff, 0xe5, 0x37ae, 0x0, 0xa92, 0x4, 0x5, 0x9, 0x1, 0x6, 0x2, 0x3ff, 0x3b, 0xb, 0x4, 0x1, 0x12e7, 0x2, 0x10001, 0x7, 0xc5, 0x6, 0x5, 0x1, 0x1, 0x7fffffff, 0x5, 0xa1, 0xffffffff, 0x1, 0x1, 0x743, 0x1, 0x7, 0xffffe9fb, 0xb, 0x7, 0x1, 0x0, 0x100, 0xfffffff7, 0x0, 0x7ff, 0x1, 0x6, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1, 0x9, 0x5, 0x10001, 0x3, 0x8, 0x4, 0x3, 0xb4, 0x80000001, 0x1, 0xbe8b, 0x0, 0x9, 0x3, 0x81, 0x3, 0xdf8, 0x4, 0x71, 0x3, 0x3, 0x9, 0x4edc, 0x100, 0x8, 0x0, 0x2, 0x10, 0x8, 0x7, 0x7f, 0xa58, 0x6, 0x81, 0xfffffffa, 0x3, 0xff, 0xfffff000, 0x1237, 0x71a66a2a, 0x6, 0x1, 0x1, 0xcf0c, 0x4, 0x81, 0xff, 0x1, 0x698fdd79, 0xfffffffc, 0x8, 0x6, 0x7, 0x7f9a, 0x0, 0x0, 0x3, 0x6f5, 0xa, 0x6, 0xfffffffd, 0x2, 0x3, 0x4d4e, 0xfffffff3, 0x3, 0x6, 0x0, 0x200, 0x3cf5dd3d, 0x5, 0x1, 0xa, 0x200, 0x200, 0x92fe25b, 0xc, 0x1, 0x9, 0x81, 0x7, 0x7, 0x1000, 0xc651, 0xf, 0x3, 0x8, 0x6, 0x0, 0x0, 0x7fffffff, 0xffffffff, 0xffffffff, 0x5, 0xd02, 0x2, 0x7, 0x10001, 0x0, 0x9, 0x7, 0xfffffffb, 0x64e, 0x4403c5ae, 0xc, 0xfffffffc, 0x0, 0x3, 0x7f, 0x1, 0x4, 0x1, 0xfffffff6, 0x516, 0x5, 0x2, 0x200, 0xc3, 0x2b1c, 0x6, 0x4, 0x0, 0x81, 0x5, 0x6fa, 0x6, 0x2, 0x80000000, 0x6e7, 0x7f, 0x7, 0x8, 0xfffffff9, 0x3, 0x7f, 0x10000, 0x3, 0x6, 0x37, 0x89, 0x2, 0x2, 0x89a, 0xb, 0x80000000, 0x4, 0x10, 0x6, 0x1, 0x0, 0x5, 0xf8d9, 0x5, 0x2, 0x2, 0x9, 0x2, 0xb8, 0x74e2, 0x2, 0x3ff, 0x1, 0x9, 0x2, 0x1, 0x7, 0x2, 0x0, 0x8, 0x1000, 0x2, 0x6, 0x1, 0x8, 0x7, 0x3, 0x7, 0x7, 0xf, 0x7ff, 0xffffffc6, 0x9, 0xcc9, 0x7, 0x5, 0xb0, 0xe4, 0x5, 0x80000001, 0xc410, 0x8000, 0x7fffffff, 0x3, 0x6, 0x1c000000, 0x101, 0x79, 0xfffffffb, 0x3, 0x1, 0xff, 0x6, 0x81, 0xfffffffc, 0x6, 0x30000, 0x6, 0x7, 0x6, 0x8, 0xc0e1, 0x5, 0x3, 0x6f, 0x5, 0x5, 0x800, 0x1, 0x80000000, 0x8, 0x81, 0x2, 0x9, 0x0, 0x7a8, 0x8e, 0x4, 0x1356, 0x3, 0x80000000, 0x8, 0x7, 0x81, 0x8, 0x1, 0x0, 0x5, 0xa, 0x1d, 0xa22, 0x5, 0xffffffc5, 0xc, 0xa, 0x7, 0x81, 0x2d063505, 0x223, 0xd7, 0x80000001, 0x5, 0xff, 0x4800000, 0x80000000, 0x8001, 0x8, 0x10, 0x9, 0x200, 0x5, 0xfffffffa, 0xd093, 0x3, 0x1, 0x3, 0x5, 0x5, 0x5, 0x589c1fd7, 0xd0f, 0x4, 0x0, 0xb55d, 0x920, 0x7f, 0x3ff, 0x4, 0x7, 0xfffffffd, 0x9, 0x0, 0xe, 0x3ff, 0x0, 0x5, 0x1, 0xffff4bfc, 0x1, 0x10001, 0xfe05, 0x5, 0x79, 0x1000, 0x9, 0x10000, 0xf8b9, 0x4, 0x3832, 0x1, 0xd, 0x81, 0x8, 0x5, 0xbd, 0x4, 0x800, 0x5, 0x826, 0xffffed29, 0x7f, 0x60b8, 0x200, 0x7, 0x6, 0x9, 0x101, 0x0, 0xfffffff8, 0x8, 0x8, 0x401, 0x5, 0x4d800000, 0xa44, 0x3, 0x6, 0xc00, 0x5, 0x2, 0x0, 0x3, 0x200, 0x1fc000, 0x3, 0x3, 0x5, 0x2, 0x8, 0xd, 0x1, 0x80000000, 0xbd1a, 0x0, 0x1, 0xfc4, 0x3, 0xfb1c, 0x42, 0x0, 0x400, 0x7, 0x8d7, 0xd, 0xfffffff9, 0x1, 0xc27a, 0x2, 0x5, 0x5, 0x101, 0x7, 0x0, 0x5, 0x7f, 0x2, 0x8, 0x8, 0x4, 0x8, 0x4, 0x7, 0x9, 0x1, 0x3, 0x3ff, 0x4b6, 0x9, 0x9, 0x3, 0x0, 0x5]})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed9bebbbd, 0xa0011, r3, 0x52fbb000) (async)
ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000001180)={[0x6, 0x1, 0x49d6069d, 0x3f5, 0x2, 0x0, 0x5, 0x3, 0x3df, 0x1, 0x4, 0x4, 0xe, 0x1000, 0x0, 0x2, 0x4, 0x6, 0xffff, 0x1, 0xd, 0xb, 0x9, 0x3, 0x75d6, 0x3, 0x4, 0xffff, 0x10001, 0x0, 0x553, 0x3, 0x7, 0xda, 0x1, 0x0, 0xfffffffa, 0x0, 0xa, 0x2, 0x8, 0xffffffff, 0xffff2cd5, 0x3, 0xf, 0x8, 0x3, 0xbc1, 0x1, 0x0, 0x5620, 0x7, 0xa4b, 0xffff, 0x5, 0x9, 0x2, 0x4, 0x8000, 0x4, 0x400, 0x6, 0x4a, 0x3, 0x401, 0x0, 0x80000000, 0x62, 0xfff, 0x6, 0x8, 0x800000, 0x5, 0x1, 0x3, 0xc, 0x900, 0x9, 0xfffff801, 0xd14, 0xffffffff, 0x7f, 0x9, 0x7, 0x6, 0x7, 0x5, 0x5, 0x1, 0xfab7, 0x4, 0x8, 0x8, 0x5ab6, 0x80000000, 0x0, 0x99, 0x5, 0x9, 0x1ff, 0x6, 0x80, 0x915f, 0x1, 0xdcde, 0x2, 0x450, 0x2, 0x1, 0x8, 0x1, 0x0, 0x9, 0x6, 0x9, 0xfff00000, 0x0, 0x4, 0x4, 0x9, 0x7, 0x2dec, 0x2, 0x8073, 0x6, 0xa, 0x2, 0xfffffff9, 0x0, 0x7d3, 0x4, 0x1, 0x80000000, 0x4, 0xe, 0xe, 0x0, 0x6, 0x7fffffff, 0x9, 0x6, 0xfffffff3, 0x40, 0xee, 0xadb, 0x5, 0x2, 0xa00, 0xd13, 0x55de, 0x8, 0x2, 0x0, 0x4, 0x6bbe, 0xb18, 0x6, 0x800, 0x8, 0x8, 0xda3f, 0xaf, 0x4, 0x2, 0x100, 0x80, 0x7, 0x5, 0x4, 0x2, 0x80000001, 0x400, 0xffff2826, 0x9, 0x7, 0x2, 0x487f4171, 0x3, 0x5, 0x800, 0x80000000, 0x7, 0x4, 0x871, 0x50, 0x0, 0xff, 0x0, 0x7, 0x5, 0x1, 0x10000, 0xfffffffe, 0x5, 0x2, 0xb0, 0xfffffff5, 0x319, 0x2392, 0xbfd, 0x7, 0x80, 0x13, 0x6, 0x448, 0xeb48, 0x6, 0x5, 0x6c, 0x100, 0x80, 0x4, 0x5, 0x0, 0xe3a1, 0xffff, 0x17f, 0x4, 0x2, 0x6, 0x32c, 0x1000, 0x5, 0x4, 0xfffffff0, 0x3, 0x6, 0x7, 0x8, 0x9, 0x10, 0x6, 0x9, 0x915e, 0x7, 0x7, 0x738d, 0x10, 0x7, 0x1, 0xf, 0x7446, 0xfffffff9, 0x1, 0x7, 0xfffffff8, 0x9, 0xff, 0x0, 0x3, 0xe5, 0x2e2, 0x26210000, 0x3, 0x9, 0x40, 0xe, 0x7fffffff, 0x1, 0x4, 0x1, 0x75ee915a, 0x0, 0x1, 0x6, 0xa8ba, 0x0, 0x2, 0x5, 0x6, 0x7fff, 0x7ff, 0x4, 0x565, 0x80000000, 0x81, 0x7, 0xc, 0x0, 0xffffffff, 0x10, 0x2, 0xe, 0x5, 0x3, 0x8, 0x6, 0x9, 0x7, 0x2, 0x2, 0x3, 0x8, 0x6, 0x9, 0xb, 0x3, 0xb58d, 0x4, 0xfffffff8, 0xa9, 0x4, 0x9, 0xffff0000, 0x8, 0x7, 0x9, 0xfffffffa, 0x1, 0x7, 0x1, 0x7fffffff, 0x5, 0x8, 0x7b, 0xf, 0xc, 0xb08f, 0x5, 0x7ff, 0x2, 0xcaab, 0x9, 0x5, 0x7ff, 0x9, 0x3, 0x6, 0xffffff01, 0xd12, 0x3, 0x8, 0x6, 0x400, 0x3, 0x7, 0xa935, 0x300000, 0xa3, 0xc, 0x5, 0x5, 0x7ff, 0x7, 0x10000, 0x2, 0x8, 0x10001, 0x3ff, 0x3, 0x3, 0x3, 0x66a, 0x3, 0xff, 0x1ff, 0x6, 0x6, 0x6, 0x2, 0x80, 0x0, 0x8, 0x88c, 0x56c, 0x7, 0x98, 0x5, 0x2, 0x8, 0x8, 0x1, 0x7ff, 0x0, 0x5a3c, 0x7fffffff, 0x7, 0x9c, 0x1ff, 0xa00000, 0xffff, 0xd, 0xc6ea, 0xfff, 0x7ff, 0xc594, 0x3, 0x18, 0xa, 0x726c, 0x8, 0x3, 0xd71, 0xc, 0x9, 0x8, 0x2, 0x5, 0x0, 0x10, 0x0, 0xb9, 0x4, 0x9, 0xfff, 0x12, 0x7fff, 0x9, 0x8, 0x7fff, 0x9, 0xb4b, 0x6, 0x1, 0xa312, 0x553, 0x1, 0x0, 0xfffffffc, 0x2, 0xf, 0xe, 0x1, 0x3, 0x48, 0xf2, 0xa28, 0x4, 0xb3c, 0x4, 0xfffffffe, 0xf726, 0x0, 0x4, 0x80000000, 0x1, 0x8, 0xf4, 0x9, 0x2, 0x3, 0x8, 0x4, 0xfffffffe, 0x7, 0x7, 0x48, 0xf, 0xbab, 0xfffffe00, 0x2, 0x7fffffff, 0xfffffffc, 0x10000, 0x4, 0x36c, 0x1, 0x100, 0x3, 0x101, 0x7, 0x0, 0x6, 0x2, 0x5, 0x1, 0x800000, 0x4, 0x5, 0x100, 0x1000, 0x9, 0xde5c, 0x200, 0x80000001, 0xff, 0x0, 0xd, 0x4, 0x0, 0x7cbe8276, 0x3d4, 0x186, 0x1, 0x4, 0x6, 0xfffffffa, 0x1, 0xa000, 0x8, 0x3ad3125e, 0xfffff491, 0x81, 0x2, 0xffffff01, 0x800, 0x3ff, 0x39ae, 0xdf3, 0xe1d2, 0xffffee22, 0x1, 0x1000, 0x1a2f91b4, 0x6, 0x8, 0xfb3, 0x8, 0x3, 0x8, 0xc, 0x1, 0x152, 0xfffffff9, 0x2a, 0x5, 0xfff, 0x7fffffff, 0x4, 0x3000, 0x9, 0x8, 0x7fff, 0x10, 0x3, 0x8, 0x10, 0x57, 0xf, 0x8, 0x2, 0xff, 0xe1, 0xa9, 0x8, 0x8, 0x8c, 0x69e8, 0x130a, 0x4, 0x9, 0x80, 0x2, 0x8, 0x9, 0xfff, 0x7fff, 0x10000, 0x7ff80, 0x8, 0x2, 0x4, 0x90000000, 0x1, 0x7, 0xfffffffd, 0xa12, 0x7, 0xea8, 0x5bf8, 0x2, 0x6ab, 0x3, 0xf, 0xffff, 0x1, 0xfffffffb, 0x80000001, 0x80000001, 0x5, 0x0, 0x78, 0x8, 0x0, 0x0, 0x8001, 0x1, 0x6, 0x4, 0x7, 0x6, 0x400, 0x1, 0xb72, 0x0, 0x4800, 0xdd7f, 0x7, 0x6, 0x9, 0xe, 0x95f, 0x1ff, 0xe5, 0x37ae, 0x0, 0xa92, 0x4, 0x5, 0x9, 0x1, 0x6, 0x2, 0x3ff, 0x3b, 0xb, 0x4, 0x1, 0x12e7, 0x2, 0x10001, 0x7, 0xc5, 0x6, 0x5, 0x1, 0x1, 0x7fffffff, 0x5, 0xa1, 0xffffffff, 0x1, 0x1, 0x743, 0x1, 0x7, 0xffffe9fb, 0xb, 0x7, 0x1, 0x0, 0x100, 0xfffffff7, 0x0, 0x7ff, 0x1, 0x6, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1, 0x9, 0x5, 0x10001, 0x3, 0x8, 0x4, 0x3, 0xb4, 0x80000001, 0x1, 0xbe8b, 0x0, 0x9, 0x3, 0x81, 0x3, 0xdf8, 0x4, 0x71, 0x3, 0x3, 0x9, 0x4edc, 0x100, 0x8, 0x0, 0x2, 0x10, 0x8, 0x7, 0x7f, 0xa58, 0x6, 0x81, 0xfffffffa, 0x3, 0xff, 0xfffff000, 0x1237, 0x71a66a2a, 0x6, 0x1, 0x1, 0xcf0c, 0x4, 0x81, 0xff, 0x1, 0x698fdd79, 0xfffffffc, 0x8, 0x6, 0x7, 0x7f9a, 0x0, 0x0, 0x3, 0x6f5, 0xa, 0x6, 0xfffffffd, 0x2, 0x3, 0x4d4e, 0xfffffff3, 0x3, 0x6, 0x0, 0x200, 0x3cf5dd3d, 0x5, 0x1, 0xa, 0x200, 0x200, 0x92fe25b, 0xc, 0x1, 0x9, 0x81, 0x7, 0x7, 0x1000, 0xc651, 0xf, 0x3, 0x8, 0x6, 0x0, 0x0, 0x7fffffff, 0xffffffff, 0xffffffff, 0x5, 0xd02, 0x2, 0x7, 0x10001, 0x0, 0x9, 0x7, 0xfffffffb, 0x64e, 0x4403c5ae, 0xc, 0xfffffffc, 0x0, 0x3, 0x7f, 0x1, 0x4, 0x1, 0xfffffff6, 0x516, 0x5, 0x2, 0x200, 0xc3, 0x2b1c, 0x6, 0x4, 0x0, 0x81, 0x5, 0x6fa, 0x6, 0x2, 0x80000000, 0x6e7, 0x7f, 0x7, 0x8, 0xfffffff9, 0x3, 0x7f, 0x10000, 0x3, 0x6, 0x37, 0x89, 0x2, 0x2, 0x89a, 0xb, 0x80000000, 0x4, 0x10, 0x6, 0x1, 0x0, 0x5, 0xf8d9, 0x5, 0x2, 0x2, 0x9, 0x2, 0xb8, 0x74e2, 0x2, 0x3ff, 0x1, 0x9, 0x2, 0x1, 0x7, 0x2, 0x0, 0x8, 0x1000, 0x2, 0x6, 0x1, 0x8, 0x7, 0x3, 0x7, 0x7, 0xf, 0x7ff, 0xffffffc6, 0x9, 0xcc9, 0x7, 0x5, 0xb0, 0xe4, 0x5, 0x80000001, 0xc410, 0x8000, 0x7fffffff, 0x3, 0x6, 0x1c000000, 0x101, 0x79, 0xfffffffb, 0x3, 0x1, 0xff, 0x6, 0x81, 0xfffffffc, 0x6, 0x30000, 0x6, 0x7, 0x6, 0x8, 0xc0e1, 0x5, 0x3, 0x6f, 0x5, 0x5, 0x800, 0x1, 0x80000000, 0x8, 0x81, 0x2, 0x9, 0x0, 0x7a8, 0x8e, 0x4, 0x1356, 0x3, 0x80000000, 0x8, 0x7, 0x81, 0x8, 0x1, 0x0, 0x5, 0xa, 0x1d, 0xa22, 0x5, 0xffffffc5, 0xc, 0xa, 0x7, 0x81, 0x2d063505, 0x223, 0xd7, 0x80000001, 0x5, 0xff, 0x4800000, 0x80000000, 0x8001, 0x8, 0x10, 0x9, 0x200, 0x5, 0xfffffffa, 0xd093, 0x3, 0x1, 0x3, 0x5, 0x5, 0x5, 0x589c1fd7, 0xd0f, 0x4, 0x0, 0xb55d, 0x920, 0x7f, 0x3ff, 0x4, 0x7, 0xfffffffd, 0x9, 0x0, 0xe, 0x3ff, 0x0, 0x5, 0x1, 0xffff4bfc, 0x1, 0x10001, 0xfe05, 0x5, 0x79, 0x1000, 0x9, 0x10000, 0xf8b9, 0x4, 0x3832, 0x1, 0xd, 0x81, 0x8, 0x5, 0xbd, 0x4, 0x800, 0x5, 0x826, 0xffffed29, 0x7f, 0x60b8, 0x200, 0x7, 0x6, 0x9, 0x101, 0x0, 0xfffffff8, 0x8, 0x8, 0x401, 0x5, 0x4d800000, 0xa44, 0x3, 0x6, 0xc00, 0x5, 0x2, 0x0, 0x3, 0x200, 0x1fc000, 0x3, 0x3, 0x5, 0x2, 0x8, 0xd, 0x1, 0x80000000, 0xbd1a, 0x0, 0x1, 0xfc4, 0x3, 0xfb1c, 0x42, 0x0, 0x400, 0x7, 0x8d7, 0xd, 0xfffffff9, 0x1, 0xc27a, 0x2, 0x5, 0x5, 0x101, 0x7, 0x0, 0x5, 0x7f, 0x2, 0x8, 0x8, 0x4, 0x8, 0x4, 0x7, 0x9, 0x1, 0x3, 0x3ff, 0x4b6, 0x9, 0x9, 0x3, 0x0, 0x5]}) (async)

311.206236ms ago: executing program 0 (id=1665):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async)
r1 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7)
fcntl$addseals(r1, 0x409, 0xc)
ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000)

226.542256ms ago: executing program 0 (id=1666):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @none, 0x0, 0x1}, 0xe)
setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000))
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/comedi4\x00', 0xa0040, 0x0)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/dev_snmp6\x00')
getdents64(r2, &(0x7f0000000b00)=""/4096, 0x1000)
recvmmsg$unix(r2, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000040)=""/164, 0xa4}, {&(0x7f0000000100)=""/212, 0xd4}, {&(0x7f0000000200)=""/241, 0xf1}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/26, 0x1a}, {&(0x7f0000001400)=""/98, 0x62}, {&(0x7f00000003c0)=""/13, 0xd}, {&(0x7f0000001480)=""/3, 0x3}], 0x8, &(0x7f0000001540)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}], 0x1, 0x40000020, &(0x7f0000001680)={0x77359400})
r3 = dup(r1)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@uuid_on}]})
ioctl$KVM_CREATE_VCPU(r3, 0x6410, 0x2)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000)

142.702501ms ago: executing program 3 (id=1667):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbbd, 0x20011, r0, 0xebe3b000)
ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000000))
r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040), 0x90001, 0x0)
ioctl$SNDCTL_DSP_SETDUPLEX(r1, 0x5016, 0x0)
syz_genetlink_get_family_id$nl802154(&(0x7f0000007e00), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$nl802154(&(0x7f0000007e00), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_SET_FLAGS(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)={0x20, r3, 0xe9715da55d7fa39, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x2400c851}, 0x40) (async)
sendmsg$MPTCP_PM_CMD_SET_FLAGS(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)={0x20, r3, 0xe9715da55d7fa39, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x2400c851}, 0x40)
madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x10) (async)
madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x10)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async)
r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$SNDCTL_MIDI_INFO(r4, 0xc074510c, 0x0) (async)
ioctl$SNDCTL_MIDI_INFO(r4, 0xc074510c, 0x0)
ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000100)=0x9) (async)
ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000100)=0x9)
socket$rds(0x15, 0x5, 0x0) (async)
r5 = socket$rds(0x15, 0x5, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000000c0)=0x2, 0x4)
r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140), 0x4040, 0x0)
ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2, {0x2}}, './file0\x00'})
ioctl$sock_proto_private(r5, 0x89e0, &(0x7f0000001080))
keyctl$instantiate(0xc, 0x0, 0xfffffffffffffffe, 0x2d, 0x0) (async)
keyctl$instantiate(0xc, 0x0, 0xfffffffffffffffe, 0x2d, 0x0)
pipe(&(0x7f0000000080)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
vmsplice(r7, &(0x7f0000001280)=[{&(0x7f0000001180)="83", 0x1}], 0x1, 0x200000000000000)
vmsplice(r8, &(0x7f00000005c0)=[{&(0x7f0000000180)="04", 0x1}], 0x1, 0x6)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

55.667413ms ago: executing program 0 (id=1668):
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040), 0x4)
creat(&(0x7f0000000140)='./file0\x00', 0x71)
mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='hfsplus\x00', 0x3080a3, 0x0)

10.397032ms ago: executing program 3 (id=1669):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
pipe2(&(0x7f0000000200)={<r4=>0xffffffffffffffff}, 0x800)
read$nci(r4, &(0x7f0000000300)=""/6, 0x6)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x40, r5, 0x1, 0x70bd24, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x1}]}, 0x40}}, 0x20)
r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0)
ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000002c0)={'rti802\x00', [0x4f27, 0x4, 0x10000, 0x80, 0xe66, 0x5, 0x4, 0x7, 0x54c6cff3, 0xfd, 0x2, 0x1, 0x1, 0xfffffffd, 0x6, 0x101, 0x0, 0x7f, 0x3, 0x40000003, 0x89, 0xcaa3, 0x0, 0x20001e58, 0x3, 0xe63, 0x3, 0x8, 0x5, 0xfffffffe, 0xfffffff8]})
mmap(&(0x7f000033f000/0x2000)=nil, 0x2000, 0x1000003, 0x12, r7, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040))
r8 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_TABLE(r8, 0x0, 0xd1, &(0x7f0000000000)=0xffffffff, 0x4)
r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r10 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x82c65)
write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc)
ioctl$SNDRV_PCM_IOCTL_REWIND(r10, 0x40084146, &(0x7f0000000100)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbbd, 0x20011, r0, 0xebe3b000)
madvise(&(0x7f0000344000/0x3000)=nil, 0x3000, 0x1d)
syz_genetlink_get_family_id$nl802154(&(0x7f0000007e00), 0xffffffffffffffff)
madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x10)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r9, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x80, 0x0, 0x5a, @mcast1, @dev={0xfe, 0x80, '\x00', 0xd}, 0x8, 0x20, 0xe, 0x1}})
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000280)=0x4)

0s ago: executing program 0 (id=1670):
mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 64)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async, rerun: 64)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async)
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r1, &(0x7f00000001c0), 0x8) (async, rerun: 32)
listen(r1, 0x5) (async, rerun: 32)
getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000440)=0x1, &(0x7f00000007c0)=0x4)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil)
openat$ipvs(0xffffffffffffff9c, &(0x7f000000ac40)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

kernel console output (not intermixed with test programs):

 audit: type=1804 audit(1756699252.818:109): pid=8796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.806" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  163.273699][  T982] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[  163.315357][  T982] usb 5-1: device descriptor read/8, error -71
[  163.335478][ T8798] random: crng reseeded on system resumption
[  163.391977][ T8800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  163.408043][ T8800] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  163.424699][  T982] usb usb5-port1: unable to enumerate USB device
[  163.837555][ T5980] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32
[  163.861777][ T5980] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  163.990895][ T8806] rtc_cmos 00:00: Alarms can be up to one day in the future
[  164.116627][ T8813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  164.125956][ T8813] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  164.233899][ T8818] netlink: 'syz.3.813': attribute type 13 has an invalid length.
[  164.241904][ T8818] netlink: 14581 bytes leftover after parsing attributes in process `syz.3.813'.
[  164.253143][   T30] audit: type=1804 audit(1756699253.828:110): pid=8818 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.813" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  164.253961][ T8818] netlink: 'syz.3.813': attribute type 10 has an invalid length.
[  164.288168][ T8818] team0: Port device dummy0 added
[  164.299173][ T8818] netlink: 'syz.3.813': attribute type 10 has an invalid length.
[  164.310466][ T8818] team0: Port device dummy0 removed
[  164.318360][ T8818] bond0: (slave dummy0): Enslaving as an active interface with an up link
[  164.697540][ T5925] usb 4-1: new high-speed USB device number 30 using dummy_hcd
[  164.772813][ T8845] /dev/rnullb0: Can't lookup blockdev
[  164.777702][ T8843] netlink: 8 bytes leftover after parsing attributes in process `syz.0.822'.
[  164.855706][ T8851] Malformed UNC in devname
[  164.855706][ T8851] 
[  164.868627][ T8851] CIFS: VFS: Malformed UNC in devname
[  164.878348][ T5925] usb 4-1: New USB device found, idVendor=0af7, idProduct=0101, bcdDevice=2d.62
[  164.894831][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  164.908271][ T5925] usb 4-1: config 0 descriptor??
[  164.932360][ T5925] usb 4-1: selecting invalid altsetting 1
[  164.938735][ T5925] flexcop_usb: set interface failed.
[  164.945044][ T5925] b2c2_flexcop_usb 4-1:0.0: probe with driver b2c2_flexcop_usb failed with error -22
[  165.098022][ T5980] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71
[  165.109747][ T5980] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write PMT_CTL: -71
[  165.119023][ T8830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  165.120709][ T5980] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71
[  165.131035][ T8830] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  165.138235][ T5980] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71
[  165.157711][ T5980] usb 2-1: USB disconnect, device number 32
[  165.162071][  T982] usb 4-1: USB disconnect, device number 30
[  165.174267][ T6171] usb 5-1: new full-speed USB device number 21 using dummy_hcd
[  165.326358][ T6171] usb 5-1: config 5 has an invalid interface number: 123 but max is 0
[  165.334724][ T6171] usb 5-1: config 5 has no interface number 0
[  165.340840][ T6171] usb 5-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B
[  165.352997][ T6171] usb 5-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0
[  165.363001][ T6171] usb 5-1: config 5 interface 123 has no altsetting 0
[  165.371731][ T6171] usb 5-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7
[  165.380966][ T6171] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  165.389046][ T6171] usb 5-1: Product: syz
[  165.393420][ T6171] usb 5-1: Manufacturer: syz
[  165.398184][ T6171] usb 5-1: SerialNumber: syz
[  165.643233][ T6171] ni6501 5-1:5.123: driver 'ni6501' failed to auto-configure device.
[  165.655875][ T6171] usb 5-1: USB disconnect, device number 21
[  165.715145][   T30] audit: type=1804 audit(1756699255.278:111): pid=8861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.829" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  165.721043][ T8861] sp0: Synchronizing with TNC
[  165.833326][ T8866] sp0: Synchronizing with TNC
[  165.935245][  T982] usb 2-1: new full-speed USB device number 33 using dummy_hcd
[  165.936466][   T51] Bluetooth: hci0: unexpected event for opcode 0x100c
[  165.960143][ T8875] netlink: 'syz.0.834': attribute type 1 has an invalid length.
[  165.970600][ T8875] MTD: Couldn't look up '/dev/rnullb0': -15
[  165.977953][ T8875] /dev/rnullb0: Can't lookup blockdev
[  165.988265][   T30] audit: type=1804 audit(1756699255.558:112): pid=8877 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.835" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  166.090334][ T8881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  166.099252][ T8881] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  166.109647][  T982] usb 2-1: config 1 has an invalid descriptor of length 46, skipping remainder of the config
[  166.120828][  T982] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2
[  166.130804][  T982] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 49532, setting to 64
[  166.144433][  T982] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  166.153719][  T982] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  166.161935][  T982] usb 2-1: Product: syz
[  166.166303][  T982] usb 2-1: Manufacturer: syz
[  166.171026][  T982] usb 2-1: SerialNumber: syz
[  166.187611][  T982] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found
[  166.201311][  T982] cdc_ncm 2-1:1.0: bind() failure
[  166.434811][ T8889] syzkaller1: entered promiscuous mode
[  166.440634][ T8889] syzkaller1: entered allmulticast mode
[  166.449462][ T8889] /dev/rnullb0: Can't lookup blockdev
[  166.663575][   T30] audit: type=1804 audit(1756699256.228:113): pid=8895 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.841" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  166.885766][ T8902] /dev/rnullb0: Can't lookup blockdev
[  166.941203][   T30] audit: type=1804 audit(1756699256.508:114): pid=8906 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.845" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  166.994469][ T8908] /dev/rnullb0: Can't lookup blockdev
[  167.261831][ T8925] /dev/rnullb0: Can't lookup blockdev
[  167.395954][  T982] usb 4-1: new full-speed USB device number 31 using dummy_hcd
[  167.561750][  T982] usb 4-1: unable to get BOS descriptor or descriptor too short
[  167.570485][  T982] usb 4-1: not running at top speed; connect to a high speed hub
[  167.587898][  T982] usb 4-1: config 10 has an invalid interface number: 12 but max is 0
[  167.608536][  T982] usb 4-1: config 10 has no interface number 0
[  167.619913][  T982] usb 4-1: config 10 interface 12 has no altsetting 0
[  167.632580][  T982] usb 4-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice=59.5c
[  167.646647][  T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  167.654975][  T982] usb 4-1: Product: syz
[  167.659204][  T982] usb 4-1: Manufacturer: syz
[  167.664640][  T982] usb 4-1: SerialNumber: syz
[  167.682865][   T30] audit: type=1804 audit(1756699257.248:115): pid=8943 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.857" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  167.813227][ T8949] /dev/rnullb0: Can't lookup blockdev
[  167.883771][  T982] kl5kusb105 4-1:10.12: KL5KUSB105D / PalmConnect converter detected
[  167.899645][  T982] usb 4-1: KL5KUSB105D / PalmConnect converter now attached to ttyUSB0
[  167.912284][  T982] usb 4-1: USB disconnect, device number 31
[  167.932046][  T982] kl5kusb105d ttyUSB0: KL5KUSB105D / PalmConnect converter now disconnected from ttyUSB0
[  167.952777][  T982] kl5kusb105 4-1:10.12: device disconnected
[  167.993300][ T8961] netlink: 24 bytes leftover after parsing attributes in process `syz.0.863'.
[  168.003017][ T8961] netlink: 172 bytes leftover after parsing attributes in process `syz.0.863'.
[  168.012778][ T8961] netlink: 24 bytes leftover after parsing attributes in process `syz.0.863'.
[  168.101614][ T8963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.110639][ T8963] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.121456][ T8963] netlink: 'syz.0.864': attribute type 1 has an invalid length.
[  168.124244][ T6171] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[  168.129225][ T8963] netlink: 'syz.0.864': attribute type 101 has an invalid length.
[  168.145810][ T8963] netlink: 564 bytes leftover after parsing attributes in process `syz.0.864'.
[  168.264231][ T6171] usb 5-1: device descriptor read/64, error -71
[  168.504204][ T6171] usb 5-1: new high-speed USB device number 23 using dummy_hcd
[  168.634205][ T6171] usb 5-1: device descriptor read/64, error -71
[  168.664248][ T5926] usb 4-1: new high-speed USB device number 32 using dummy_hcd
[  168.694655][  T982] usb 2-1: USB disconnect, device number 33
[  168.719119][ T8969] MTD: Couldn't look up '/dev/rnullb0': -15
[  168.729299][ T8969] /dev/rnullb0: Can't lookup blockdev
[  168.736436][ T8969] MTD: Couldn't look up '/dev/rnullb0': -15
[  168.742746][ T8969] /dev/rnullb0: Can't lookup blockdev
[  168.751113][ T6171] usb usb5-port1: attempt power cycle
[  168.809700][ T8975] /dev/rnullb0: Can't lookup blockdev
[  168.826116][ T5926] usb 4-1: Using ep0 maxpacket: 8
[  168.843264][ T5926] usb 4-1: unable to get BOS descriptor or descriptor too short
[  168.867557][ T5926] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  168.881239][ T5926] usb 4-1: config 1 has no interface number 1
[  168.898319][ T5926] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  168.931893][ T5926] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7
[  168.984893][ T5926] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  168.995675][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  169.003974][ T5926] usb 4-1: Product: syz
[  169.008328][ T8981] /dev/rnullb0: Can't lookup blockdev
[  169.020955][ T5926] usb 4-1: Manufacturer: syz
[  169.026031][ T5926] usb 4-1: SerialNumber: syz
[  169.040281][   T30] audit: type=1804 audit(1756699258.608:116): pid=8983 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.872" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  169.094684][ T6171] usb 5-1: new high-speed USB device number 24 using dummy_hcd
[  169.114702][ T6171] usb 5-1: device descriptor read/8, error -71
[  169.130758][ T8983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  169.139771][ T8983] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  169.254266][ T5980] usb 2-1: new high-speed USB device number 34 using dummy_hcd
[  169.287154][ T5926] usb 4-1: 2:1: cannot set freq 15828157 to ep 0x82
[  169.312084][ T5926] usb 4-1: USB disconnect, device number 32
[  169.335898][ T5853] udevd[5853]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  169.354355][ T6171] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[  169.374865][ T6171] usb 5-1: device descriptor read/8, error -71
[  169.417286][ T5980] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00
[  169.426427][ T5980] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  169.434569][ T5980] usb 2-1: Product: syz
[  169.438785][ T5980] usb 2-1: SerialNumber: syz
[  169.445170][ T5980] usb 2-1: config 0 descriptor??
[  169.484548][ T6171] usb usb5-port1: unable to enumerate USB device
[  169.655383][ T5980] hso 2-1:0.0: Failed to find BULK IN ep
[  169.685698][ T8989] /dev/rnullb0: Can't lookup blockdev
[  169.717049][ T8991] netlink: 16 bytes leftover after parsing attributes in process `syz.0.874'.
[  169.732458][ T8991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  169.741932][ T8991] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  169.751477][ T8991] cgroup: noprefix used incorrectly
[  170.134157][   T24] usb 4-1: new high-speed USB device number 33 using dummy_hcd
[  170.218118][ T5980] usb 2-1: USB disconnect, device number 34
[  170.275232][   T24] usb 4-1: device descriptor read/64, error -71
[  170.403186][   T30] audit: type=1326 audit(1756699259.968:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9000 comm="syz.1.877" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1f4e58ebe9 code=0x0
[  170.425240][    C0] vkms_vblank_simulate: vblank timer overrun
[  170.505522][ T9003] /dev/rnullb0: Can't lookup blockdev
[  170.545326][   T24] usb 4-1: new high-speed USB device number 34 using dummy_hcd
[  170.684260][   T24] usb 4-1: device descriptor read/64, error -71
[  170.794399][   T24] usb usb4-port1: attempt power cycle
[  171.117414][   T30] audit: type=1804 audit(1756699260.688:118): pid=9024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.883" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  171.134200][   T24] usb 4-1: new high-speed USB device number 35 using dummy_hcd
[  171.139278][    C0] vkms_vblank_simulate: vblank timer overrun
[  171.174818][   T24] usb 4-1: device descriptor read/8, error -71
[  171.279042][ T9034] netlink: 72 bytes leftover after parsing attributes in process `syz.1.886'.
[  171.381759][   T30] audit: type=1804 audit(1756699260.948:119): pid=9040 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.888" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  171.415145][   T24] usb 4-1: new high-speed USB device number 36 using dummy_hcd
[  171.434705][   T24] usb 4-1: device descriptor read/8, error -71
[  171.544996][   T24] usb usb4-port1: unable to enumerate USB device
[  172.032537][ T9045] /dev/rnullb0: Can't lookup blockdev
[  172.283050][ T9049] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  172.295697][ T9049] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  172.544309][   T24] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  172.589461][ T9055] program syz.4.893 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  172.684186][   T24] usb 2-1: device descriptor read/64, error -71
[  172.843392][ T9067] netlink: 'syz.0.896': attribute type 4 has an invalid length.
[  172.865082][ T9067] netlink: 'syz.0.896': attribute type 4 has an invalid length.
[  172.896984][ T5926] usb 5-1: new full-speed USB device number 26 using dummy_hcd
[  172.924190][   T24] usb 2-1: new high-speed USB device number 36 using dummy_hcd
[  173.059808][   T24] usb 2-1: device descriptor read/64, error -71
[  173.069406][ T5926] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae
[  173.083051][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  173.096836][ T5926] usb 5-1: Product: syz
[  173.101090][ T5926] usb 5-1: Manufacturer: syz
[  173.106189][ T5926] usb 5-1: SerialNumber: syz
[  173.112422][ T5926] usb 5-1: config 0 descriptor??
[  173.125287][ T9083] netlink: 'syz.3.901': attribute type 1 has an invalid length.
[  173.133177][ T9083] netlink: 'syz.3.901': attribute type 101 has an invalid length.
[  173.143301][ T9083] netlink: 564 bytes leftover after parsing attributes in process `syz.3.901'.
[  173.156940][ T9084] netlink: 'syz.3.901': attribute type 21 has an invalid length.
[  173.164919][ T9084] netlink: 100 bytes leftover after parsing attributes in process `syz.3.901'.
[  173.176145][   T24] usb usb2-port1: attempt power cycle
[  173.326233][ T9056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  173.335362][ T9056] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  173.506567][ T9093] pty pty21: ldisc open failed (-12), clearing slot 21
[  173.514242][   T24] usb 2-1: new high-speed USB device number 37 using dummy_hcd
[  173.535920][ T6171] usb 4-1: new high-speed USB device number 37 using dummy_hcd
[  173.536011][   T24] usb 2-1: device descriptor read/8, error -71
[  173.662247][   T30] audit: type=1804 audit(1756699263.228:120): pid=9105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.907" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  173.705936][ T6171] usb 4-1: config 0 has an invalid interface number: 32 but max is 0
[  173.714157][ T6171] usb 4-1: config 0 has no interface number 0
[  173.720353][ T6171] usb 4-1: config 0 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  173.735196][ T6171] usb 4-1: config 0 interface 32 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  173.746456][ T6171] usb 4-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00
[  173.756859][ T6171] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  173.768910][ T6171] usb 4-1: config 0 descriptor??
[  173.784387][   T24] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  173.808486][   T24] usb 2-1: device descriptor read/8, error -71
[  173.830041][   T30] audit: type=1804 audit(1756699263.398:121): pid=9114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.910" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  173.925344][   T24] usb usb2-port1: unable to enumerate USB device
[  174.185811][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.194230][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.202413][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.210724][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.219890][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.228101][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.236286][ T6171] logitech-djreceiver 0003:046D:C71B.0007: unknown main item tag 0x0
[  174.245874][ T6171] logitech-djreceiver 0003:046D:C71B.0007: hidraw0: USB HID v0.00 Device [HID 046d:c71b] on usb-dummy_hcd.3-1/input32
[  174.391428][ T6171] usb 4-1: USB disconnect, device number 37
[  175.330759][ T9128] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.914' sets config #1
[  175.574353][ T5187] Bluetooth: hci1: command 0x0c1a tx timeout
[  175.586773][ T9138] /dev/rnullb0: Can't lookup blockdev
[  175.628629][   T24] usb 5-1: USB disconnect, device number 26
[  175.914859][ T9150] /dev/rnullb0: Can't lookup blockdev
[  176.261884][ T9167] netlink: 'syz.4.926': attribute type 29 has an invalid length.
[  176.273484][ T9167] netlink: 'syz.4.926': attribute type 29 has an invalid length.
[  176.296897][ T9167] netlink: 500 bytes leftover after parsing attributes in process `syz.4.926'.
[  176.341494][ T9167] usb usb9: usbfs: process 9167 (syz.4.926) did not claim interface 0 before use
[  176.385792][ T9169] syzkaller1: entered promiscuous mode
[  176.391479][ T9169] syzkaller1: entered allmulticast mode
[  176.719550][   T30] audit: type=1804 audit(1756699266.288:122): pid=9191 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.934" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  176.954987][ T9199] hfs: unable to load iocharset "io#harset"
[  177.020989][ T9199] kvm: user requested TSC rate below hardware speed
[  177.057346][ T9209] /dev/rnullb0: Can't lookup blockdev
[  177.145293][ T5926] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  177.314375][ T5926] usb 2-1: unable to get BOS descriptor or descriptor too short
[  177.323494][ T5926] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2
[  177.336865][ T5926] usb 2-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  177.384214][ T5926] usb 2-1: config 1 interface 0 has no altsetting 1
[  177.396373][ T5926] usb 2-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75
[  177.397137][ T9225] /dev/rnullb0: Can't lookup blockdev
[  177.405816][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  177.443841][ T5926] usb 2-1: Product: syz
[  177.453967][ T5926] usb 2-1: Manufacturer: syz
[  177.460597][   T30] audit: type=1804 audit(1756699267.038:123): pid=9230 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.948" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  177.465800][ T5926] usb 2-1: SerialNumber: syz
[  177.527314][ T5926] smsusb:smsusb_probe: board id=8, interface number 0
[  177.678508][   T30] audit: type=1804 audit(1756699267.248:124): pid=9237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.951" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  177.699944][    C0] vkms_vblank_simulate: vblank timer overrun
[  177.841424][ T5926] smsusb:smsusb_probe: usb_set_interface failed, rc -71
[  177.862254][ T5926] smsusb 2-1:1.0: probe with driver smsusb failed with error -71
[  177.884434][ T5926] usb 2-1: USB disconnect, device number 39
[  177.891828][ T7524] udevd[7524]: setting mode of /dev/bus/usb/002/039 to 020664 failed: No such file or directory
[  177.914212][ T7524] udevd[7524]: setting owner of /dev/bus/usb/002/039 to uid=0, gid=0 failed: No such file or directory
[  177.993907][ T9247] /dev/sg0: Can't lookup blockdev
[  178.072510][   T30] audit: type=1804 audit(1756699267.638:125): pid=9249 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.956" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  178.201983][   T30] audit: type=1804 audit(1756699267.768:126): pid=9255 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.959" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  178.270054][ T9257] input: syz0 as /devices/virtual/input/input15
[  178.497172][ T9266] MTD: Couldn't look up '/dev/rnullb0': -15
[  178.503267][   T30] audit: type=1804 audit(1756699268.068:127): pid=9266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.964" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  178.773654][ T9275] /dev/rnullb0: Can't lookup blockdev
[  178.981369][ T9287] /dev/rnullb0: Can't lookup blockdev
[  179.105939][ T5980] usb 5-1: new full-speed USB device number 27 using dummy_hcd
[  179.284240][ T5980] usb 5-1: config 0 has an invalid interface number: 49 but max is 0
[  179.292397][ T5980] usb 5-1: config 0 has no interface number 0
[  179.300569][ T5980] usb 5-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0xCD, changing to 0x8D
[  179.320425][ T5980] usb 5-1: config 0 interface 49 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0
[  179.346568][ T5980] usb 5-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7
[  179.363409][ T5980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  179.382446][ T5980] usb 5-1: Product: syz
[  179.386972][ T5980] usb 5-1: Manufacturer: syz
[  179.402708][ T5980] usb 5-1: SerialNumber: syz
[  179.412994][ T9294] pimreg: tun_chr_ioctl cmd 1074025672
[  179.423853][ T5980] usb 5-1: config 0 descriptor??
[  179.434264][ T9294] pimreg: ignored: set checksum enabled
[  179.650193][ T9303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  179.658844][ T5980] usb 5-1: USB disconnect, device number 27
[  179.708091][ T9303] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  179.941716][   T30] audit: type=1804 audit(1756699269.508:128): pid=9313 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.980" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  180.838037][   T30] audit: type=1804 audit(1756699270.408:129): pid=9334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.986" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  180.946856][ T9336] binfmt_misc: Unknown parameter 'usrquota1ꉷÐ×ÈB.SEê9*pjê%�ý[ƒ»¦ã 3áCMG‹¢N´Rù”A¾þ½†0òi¢yo¥'
[  181.014774][ T9336] /dev/rnullb0: Can't lookup blockdev
[  181.045164][ T9339] /dev/rnullb0: Can't lookup blockdev
[  181.254293][ T6171] usb 2-1: new full-speed USB device number 40 using dummy_hcd
[  181.416007][ T6171] usb 2-1: not running at top speed; connect to a high speed hub
[  181.425478][ T6171] usb 2-1: config 2 has an invalid interface number: 63 but max is 1
[  181.433620][ T6171] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[  181.464257][ T6171] usb 2-1: config 2 has 1 interface, different from the descriptor's value: 2
[  181.479813][ T6171] usb 2-1: config 2 has no interface number 0
[  181.492047][ T6171] usb 2-1: config 2 interface 63 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[  181.523831][ T6171] usb 2-1: config 2 interface 63 has no altsetting 0
[  181.533227][ T6171] usb 2-1: New USB device found, idVendor=0421, idProduct=000e, bcdDevice=b6.d0
[  181.543754][ T6171] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  181.552347][ T6171] usb 2-1: Product: 衎飉㱤榱�䗥龑�鮞炶�ㆽﴅ뗵젺쵾焱￫俯棯峵孋�䨕ݫ⻈韑䉂㎚䀛촎젞ퟺ䆭뻢ﰮ᾿÷귇꧱껪䵣�맀롃��攪핥遲ⷬ⮸功�㻗變泀现䪿醻猘런ᯟỹ⅙�𣏕ꄲ嬤㧓鑺௻啺�࿤驤ࣥ㷩ꄳ墜꣙ꑺ�趵⽯�톕ᵦ⿊蚗륉臸ଈΕ譙텽ϔᵛ徶�㪚�姪ꒀ癩走
[  181.571823][ T9349] /dev/rnullb0: Can't lookup blockdev
[  181.587414][    C0] vkms_vblank_simulate: vblank timer overrun
[  181.588792][ T6171] usb 2-1: Manufacturer: 賘��跾溤朆皣䲩
[  181.606125][ T6171] usb 2-1: SerialNumber: syz
[  181.752965][ T9353] sock: sock_set_timeout: `syz.3.993' (pid 9353) tries to set negative timeout
[  181.841283][ T6171] rndis_host 2-1:2.63: skipping garbage
[  181.847134][ T6171] rndis_host 2-1:2.63: skipping garbage
[  181.853071][ T6171] usb 2-1: bad CDC descriptors
[  181.861319][ T6171] cdc_acm 2-1:2.63: skipping garbage
[  181.867168][ T6171] cdc_acm 2-1:2.63: skipping garbage
[  181.882580][ T6171] usb 2-1: USB disconnect, device number 40
[  182.112776][   T30] audit: type=1804 audit(1756699271.678:130): pid=9370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.997" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  182.133963][    C0] vkms_vblank_simulate: vblank timer overrun
[  182.255881][ T9376] netlink: 48 bytes leftover after parsing attributes in process `syz.4.999'.
[  182.320451][   T30] audit: type=1804 audit(1756699271.888:131): pid=9379 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1000" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  182.905140][ T5862] usb 5-1: new full-speed USB device number 28 using dummy_hcd
[  183.036194][ T5926] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[  183.066441][ T5862] usb 5-1: not running at top speed; connect to a high speed hub
[  183.078307][ T5862] usb 5-1: config 5 has an invalid interface number: 6 but max is 0
[  183.086971][ T5862] usb 5-1: config 5 has no interface number 0
[  183.093358][ T5862] usb 5-1: config 5 interface 6 altsetting 3 has an invalid descriptor for endpoint zero, skipping
[  183.108912][ T5862] usb 5-1: config 5 interface 6 altsetting 3 has a duplicate endpoint with address 0x8, skipping
[  183.121263][ T5862] usb 5-1: config 5 interface 6 altsetting 3 endpoint 0xB has invalid maxpacket 512, setting to 64
[  183.135513][ T5862] usb 5-1: config 5 interface 6 altsetting 3 endpoint 0xC has invalid maxpacket 512, setting to 64
[  183.147915][ T5862] usb 5-1: config 5 interface 6 altsetting 3 endpoint 0xD has invalid maxpacket 1024, setting to 64
[  183.160303][ T5862] usb 5-1: config 5 interface 6 altsetting 3 has an invalid descriptor for endpoint zero, skipping
[  183.172005][ T5862] usb 5-1: config 5 interface 6 altsetting 3 endpoint 0x5 has invalid maxpacket 1023, setting to 64
[  183.184656][ T5862] usb 5-1: config 5 interface 6 altsetting 3 has a duplicate endpoint with address 0xD, skipping
[  183.197704][ T5862] usb 5-1: config 5 interface 6 altsetting 3 has a duplicate endpoint with address 0xE, skipping
[  183.209936][ T5862] usb 5-1: config 5 interface 6 has no altsetting 0
[  183.219106][ T5926] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  183.232512][ T5926] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3
[  183.242690][ T5926] usb 2-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00
[  183.253975][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  183.266451][ T5862] usb 5-1: New USB device found, idVendor=1822, idProduct=3201, bcdDevice=37.e5
[  183.276997][ T5862] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  183.286702][ T5862] usb 5-1: Manufacturer: â Š
[  183.292392][ T5926] usb 2-1: config 0 descriptor??
[  183.305281][ T5862] usb 5-1: SerialNumber: 皜䣾崲焓㗛ጔི힧䊃ᄞ﹠쳣政��ꄉ꘰餷輙鳸�鄚戗蘿̱ﶦ;醘镕ỉ槻뫶殨즢袃庿듥뗸㹱�é옢å��沴㘽㲶឵⧧㱘룜▷�ㅒ饔哢�氠ᒙ螺盔籅挫沥ဇ�毱�쀆洢隔�㠵⢟鑨Ｋ益겖ۢ갗擳䨤�st嵶셕屮಼᳊ﲸ븧鳉秀猓�豼턅懢맓훻
[  183.413152][   T30] audit: type=1326 audit(1756699272.978:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.435472][    C0] vkms_vblank_simulate: vblank timer overrun
[  183.465460][   T30] audit: type=1326 audit(1756699272.978:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.495320][   T30] audit: type=1326 audit(1756699272.978:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.517882][    C0] vkms_vblank_simulate: vblank timer overrun
[  183.526509][   T30] audit: type=1326 audit(1756699272.978:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.549148][    C0] vkms_vblank_simulate: vblank timer overrun
[  183.563305][   T30] audit: type=1326 audit(1756699272.978:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.585983][    C0] vkms_vblank_simulate: vblank timer overrun
[  183.594592][   T30] audit: type=1326 audit(1756699272.978:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9386 comm="syz.3.1004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7fc00000
[  183.617041][    C0] vkms_vblank_simulate: vblank timer overrun
[  183.619988][ T5862] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in cold state, will try to load a firmware
[  183.655182][ T5862] usb 5-1: Direct firmware load for dvb-usb-dibusb-5.0.0.11.fw failed with error -2
[  183.666973][ T5862] usb 5-1: Falling back to sysfs fallback for: dvb-usb-dibusb-5.0.0.11.fw
[  183.707868][ T9399] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1008'.
[  183.763766][ T9395] MTD: Couldn't look up './file0': -15
[  183.772773][ T5926] Bluetooth: Can't get state to change to load configuration err
[  183.782906][ T5926] Bluetooth: Loading sysconfig file failed
[  183.789674][ T5926] ath3k 2-1:0.0: probe with driver ath3k failed with error -16
[  183.799938][ T5926] usb 2-1: USB disconnect, device number 41
[  183.964200][ T5905] usb 4-1: new high-speed USB device number 38 using dummy_hcd
[  184.117327][ T5905] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  184.134231][ T5905] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00
[  184.159562][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  184.175606][ T5905] usb 4-1: config 0 descriptor??
[  184.356600][ T9409] ALSA: mixer_oss: invalid OSS volume ''
[  184.428964][ T9411] /dev/rnullb0: Can't lookup blockdev
[  184.610812][ T5905] lenovo 0003:17EF:6047.0008: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.3-1/input0
[  184.923825][ T9421] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  184.933921][ T9421] block device autoloading is deprecated and will be removed.
[  184.953364][ T9421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  184.962313][ T9421] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  184.976422][ T9421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  185.006115][ T9421] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  185.034997][ T9423] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1015'.
[  185.335972][ T6171] usb 2-1: new full-speed USB device number 42 using dummy_hcd
[  185.358665][ T9426] input: syz0 as /devices/virtual/input/input16
[  185.477402][   T30] kauditd_printk_skb: 4 callbacks suppressed
[  185.477421][   T30] audit: type=1804 audit(1756699275.048:142): pid=9432 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1008" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  185.508787][ T6171] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64
[  185.520001][ T6171] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  185.533568][ T6171] usb 2-1: New USB device found, idVendor=20d6, idProduct=cb17, bcdDevice= 0.00
[  185.542780][ T6171] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  185.553725][ T6171] usb 2-1: config 0 descriptor??
[  185.560015][ T9424] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  185.802819][ T9424] program syz.1.1015 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  185.813020][ T9424] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0
[  185.986164][ T9455] /dev/rnullb0: Can't lookup blockdev
[  186.047970][ T6171] hid-udraw 0003:20D6:CB17.0009: item fetching failed at offset 5/7
[  186.079370][ T6171] hid-udraw 0003:20D6:CB17.0009: parse failed
[  186.087670][ T6171] hid-udraw 0003:20D6:CB17.0009: probe with driver hid-udraw failed with error -22
[  186.255224][ T9424] netlink: 14568 bytes leftover after parsing attributes in process `syz.1.1015'.
[  186.267079][   T30] audit: type=1804 audit(1756699275.838:143): pid=9424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1015" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  186.328587][ T9479] siw: device registration error -23
[  186.431239][ T9487] /dev/rnullb0: Can't lookup blockdev
[  186.713121][ T5905] lenovo 0003:17EF:6047.0008: Sensitivity setting failed: -71
[  186.725760][ T5905] usb 4-1: USB disconnect, device number 38
[  186.851246][   T30] audit: type=1804 audit(1756699276.418:144): pid=9507 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1033" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  186.858993][ T9507] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  187.097415][ T9510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  187.106942][ T9510] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  187.854580][ T9531] syzkaller1: entered promiscuous mode
[  187.861866][ T9531] syzkaller1: entered allmulticast mode
[  187.871335][ T9531] tap0: tun_chr_ioctl cmd 1074025676
[  187.872437][ T9534] /dev/rnullb0: Can't lookup blockdev
[  187.879257][ T9531] tap0: owner set to 0
[  187.889589][ T9531] 9p: Bad value for 'rfdno'
[  187.895530][ T9531] /dev/rnullb0: Can't lookup blockdev
[  187.918174][ T9536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  187.927176][ T9536] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  188.023423][ T5905] usb 2-1: USB disconnect, device number 42
[  188.063747][   T30] audit: type=1804 audit(1756699277.628:145): pid=9541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1044" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  188.181271][ T9547] /dev/rnullb0: Can't lookup blockdev
[  188.404178][ T5926] usb 4-1: new high-speed USB device number 39 using dummy_hcd
[  188.454260][ T5187] Bluetooth: hci1: command 0x0c1a tx timeout
[  188.534239][ T5926] usb 4-1: device descriptor read/64, error -71
[  188.544382][ T9550] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  188.550474][ T9550] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  188.558116][ T9550] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  188.588833][ T9554] /dev/rnullb0: Can't lookup blockdev
[  188.597906][ T9555] /dev/rnullb0: Can't lookup blockdev
[  188.705414][ T9564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  188.717895][ T9564] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  188.748563][   T30] audit: type=1804 audit(1756699278.318:146): pid=9567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1054" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  188.774693][ T5926] usb 4-1: new high-speed USB device number 40 using dummy_hcd
[  188.808681][ T9571] Invalid source name
[  188.812751][ T9571] UBIFS error (pid: 9571): cannot open "/dev/rnullb0", error -22
[  188.927457][ T5926] usb 4-1: device descriptor read/64, error -71
[  189.044387][ T5926] usb usb4-port1: attempt power cycle
[  189.129959][ T9584] netlink: 'syz.1.1060': attribute type 6 has an invalid length.
[  189.143929][ T9584] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1060'.
[  189.155527][ T9582] netlink: 'syz.1.1060': attribute type 15 has an invalid length.
[  189.163472][ T9582] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1060'.
[  189.285197][ T9589] binder: 9588:9589 ioctl c018620c 200000000580 returned -22
[  189.292813][ T9589] binder: 9588:9589 ioctl 7a7 200000000000 returned -22
[  189.404408][ T5926] usb 4-1: new high-speed USB device number 41 using dummy_hcd
[  189.444768][ T5926] usb 4-1: device descriptor read/8, error -71
[  189.694227][ T5926] usb 4-1: new high-speed USB device number 42 using dummy_hcd
[  189.724764][ T5926] usb 4-1: device descriptor read/8, error -71
[  189.834686][ T5926] usb usb4-port1: unable to enumerate USB device
[  190.011262][   T30] audit: type=1804 audit(1756699279.578:147): pid=9612 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1066" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  190.180009][ T9616] /dev/rnullb0: Can't lookup blockdev
[  190.259501][ T9619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  190.268834][ T9619] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  190.274470][ T9618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  190.286203][   T24] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[  190.287673][ T9619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  190.297941][ T9618] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  190.314880][ T9619] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  190.458277][   T24] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  190.467553][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  190.475768][   T24] usb 2-1: Product: syz
[  190.479970][   T24] usb 2-1: Manufacturer: syz
[  190.484746][   T24] usb 2-1: SerialNumber: syz
[  190.493286][   T24] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[  190.508692][ T5926] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  190.614882][ T5873] Bluetooth: hci1: command 0x0c1a tx timeout
[  190.615547][ T5861] Bluetooth: hci3: command 0x0c1a tx timeout
[  190.621767][ T5187] Bluetooth: hci0: command 0x0c1a tx timeout
[  190.712092][ T9614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  190.721065][ T9614] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  191.017769][   T30] audit: type=1804 audit(1756699280.588:148): pid=9627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1067" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  191.140166][  T982] usb 2-1: USB disconnect, device number 43
[  191.519827][ T9649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  191.532523][ T9649] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  191.604272][   T24] usb 4-1: new high-speed USB device number 43 using dummy_hcd
[  191.743445][ T9656] /dev/rnullb0: Can't lookup blockdev
[  191.758684][ T5926] usb 2-1: Service connection timeout for: 256
[  191.775901][ T5926] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services
[  191.785497][ T5926] ath9k_htc: Failed to initialize the device
[  191.791891][  T982] usb 2-1: ath9k_htc: USB layer deinitialized
[  191.798173][   T24] usb 4-1: Using ep0 maxpacket: 32
[  191.836753][   T24] usb 4-1: config 0 has an invalid interface number: 184 but max is 0
[  191.849581][   T24] usb 4-1: config 0 has no interface number 0
[  191.858127][   T24] usb 4-1: config 0 interface 184 has no altsetting 0
[  191.908490][   T24] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  191.918114][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  191.944103][   T24] usb 4-1: Product: syz
[  191.948480][   T24] usb 4-1: Manufacturer: syz
[  191.953132][   T24] usb 4-1: SerialNumber: syz
[  191.974751][   T24] usb 4-1: config 0 descriptor??
[  191.985708][   T24] smsc75xx v1.0.0
[  192.103118][   T30] audit: type=1804 audit(1756699281.668:149): pid=9673 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1085" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  192.124570][    C0] vkms_vblank_simulate: vblank timer overrun
[  192.203781][   T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71
[  192.230912][ T9677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  192.243331][   T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71
[  192.260507][ T9677] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  192.274864][   T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind
[  192.287627][ T9677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  192.294759][   T24] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71
[  192.306152][ T9677] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  192.317893][   T24] usb 4-1: USB disconnect, device number 43
[  192.328705][ T9677] netlink: 'syz.0.1087': attribute type 11 has an invalid length.
[  192.404245][ T5926] usb 2-1: new full-speed USB device number 44 using dummy_hcd
[  192.567901][ T5926] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[  192.587701][ T5926] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b
[  192.588633][ T9681] /dev/rnullb0: Can't lookup blockdev
[  192.597563][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  192.618464][ T5926] usb 2-1: Product: syz
[  192.633636][ T5926] usb 2-1: Manufacturer: syz
[  192.641354][ T5926] usb 2-1: SerialNumber: syz
[  192.657504][ T5926] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state
[  192.704170][   T51] Bluetooth: hci1: command 0x0c1a tx timeout
[  193.011893][ T9703] netlink: 'syz.3.1094': attribute type 10 has an invalid length.
[  193.045033][ T9703] 8021q: adding VLAN 0 to HW filter on device batadv0
[  193.066327][ T5926] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter)
[  193.066971][ T9703] bond0: (slave batadv0): Enslaving as an active interface with an up link
[  193.093359][ T9706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  193.106771][   T30] audit: type=1400 audit(1756699282.658:150): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="#(%#{//&@\)//&" pid=9706 comm="syz.0.1097"
[  193.153182][ T5926] usb 2-1: USB disconnect, device number 44
[  193.413842][ T9719] Bluetooth: MGMT ver 1.23
[  193.424524][ T9714] /dev/rnullb0: Can't lookup blockdev
[  193.707425][   T30] audit: type=1804 audit(1756699283.278:151): pid=9735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1107" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  193.756210][ T6171] usb 4-1: new low-speed USB device number 44 using dummy_hcd
[  193.791605][ T9741] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  193.802147][ T9741] efs: cannot read volume header
[  193.810529][ T9743] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  193.825092][ T9743] efs: cannot read volume header
[  193.836182][ T9742] tmpfs: Bad value for 'mpol'
[  193.916753][ T6171] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  193.929972][ T6171] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8
[  193.942888][ T6171] usb 4-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.00
[  193.952603][ T6171] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  193.971797][ T6171] usb 4-1: config 0 descriptor??
[  193.980921][ T9727] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  194.458091][ T1303] ieee802154 phy0 wpan0: encryption failed: -22
[  194.464793][ T1303] ieee802154 phy1 wpan1: encryption failed: -22
[  194.542744][ T9754] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1115'.
[  194.553797][ T9754] erofs (device md0): cannot find valid erofs superblock
[  194.601538][   T30] audit: type=1326 audit(1756699284.168:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.667670][ T6002] IPVS: starting estimator thread 0...
[  194.683542][   T30] audit: type=1326 audit(1756699284.168:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.710767][   T30] audit: type=1326 audit(1756699284.168:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.740415][   T30] audit: type=1326 audit(1756699284.168:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.786799][ T9762] /dev/rnullb0: Can't lookup blockdev
[  194.794231][ T9759] IPVS: using max 39 ests per chain, 93600 per kthread
[  194.813141][   T30] audit: type=1326 audit(1756699284.168:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.839399][   T30] audit: type=1326 audit(1756699284.168:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9726 comm="syz.3.1103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f88b798ebe9 code=0x7ffc0000
[  194.887363][ T6171] usbhid 4-1:0.0: can't add hid device: -71
[  194.893439][ T6171] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  194.917786][ T9764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  194.925431][ T6171] usb 4-1: USB disconnect, device number 44
[  194.929923][ T9765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  194.949662][ T9765] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  194.959910][ T9764] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  195.102147][ T9771] MTD: Couldn't look up '/dev/rnullb0': -15
[  195.123115][ T5926] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0
[  195.155847][ T5926] hid-generic 0000:0000:0000.000A: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  195.494237][   T51] Bluetooth: hci0: command 0x0c1a tx timeout
[  215.927285][   T30] kauditd_printk_skb: 89 callbacks suppressed
[  215.927304][   T30] audit: type=1804 audit(1756699305.498:247): pid=9795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1130" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  215.970896][ T9797] loop6: detected capacity change from 0 to 7
[  215.982536][ T9797] Dev loop6: unable to read RDB block 7
[  215.989087][ T9797]  loop6: AHDI p1
[  215.992829][ T9797] loop6: partition table partially beyond EOD, truncated
[  216.041899][   T30] audit: type=1326 audit(1756699305.608:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa9e138ebe9 code=0x7fc00000
[  216.069442][ T9805] fuse: Bad value for 'user_id'
[  216.075880][ T9805] fuse: Bad value for 'user_id'
[  216.190770][ T9813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  216.200205][ T9813] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  216.256384][ T9812] ALSA: mixer_oss: invalid OSS volume ''
[  216.876977][ T9822] /dev/rnullb0: Can't lookup blockdev
[  217.071841][   T30] audit: type=1804 audit(1756699306.638:249): pid=9837 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1143" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  217.284206][ T6171] usb 2-1: new high-speed USB device number 45 using dummy_hcd
[  217.444236][ T6171] usb 2-1: Using ep0 maxpacket: 32
[  217.453164][ T6171] usb 2-1: config 9 has an invalid interface number: 82 but max is 2
[  217.453413][ T9845] /dev/rnullb0: Can't lookup blockdev
[  217.461757][ T6171] usb 2-1: config 9 has an invalid interface number: 180 but max is 2
[  217.468621][ T9846] /dev/rnullb0: Can't lookup blockdev
[  217.477463][ T6171] usb 2-1: config 9 has an invalid interface number: 19 but max is 2
[  217.490540][ T6171] usb 2-1: config 9 has an invalid interface number: 171 but max is 2
[  217.499043][ T6171] usb 2-1: config 9 has 4 interfaces, different from the descriptor's value: 3
[  217.508429][ T6171] usb 2-1: config 9 has no interface number 0
[  217.514807][ T6171] usb 2-1: config 9 has no interface number 1
[  217.515595][ T9848] netlink: 'syz.0.1146': attribute type 27 has an invalid length.
[  217.521925][ T6171] usb 2-1: config 9 has no interface number 2
[  217.538786][ T6171] usb 2-1: config 9 has no interface number 3
[  217.543003][ T9848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  217.546706][ T6171] usb 2-1: config 9 interface 82 altsetting 190 endpoint 0x9 has invalid maxpacket 512, setting to 64
[  217.558345][ T9848] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  217.566942][ T6171] usb 2-1: config 9 interface 82 altsetting 190 endpoint 0x8 has invalid maxpacket 512, setting to 64
[  217.586157][ T6171] usb 2-1: config 9 interface 180 altsetting 4 endpoint 0xB has invalid maxpacket 512, setting to 64
[  217.597497][ T6171] usb 2-1: config 9 interface 180 altsetting 4 endpoint 0xC has invalid maxpacket 1024, setting to 64
[  217.608798][ T6171] usb 2-1: config 9 interface 180 altsetting 4 has an invalid descriptor for endpoint zero, skipping
[  217.619822][ T6171] usb 2-1: config 9 interface 180 altsetting 4 has a duplicate endpoint with address 0xD, skipping
[  217.630724][ T6171] usb 2-1: config 9 interface 180 altsetting 4 endpoint 0x7 has invalid maxpacket 1024, setting to 64
[  217.642596][ T6171] usb 2-1: config 9 interface 180 altsetting 4 has a duplicate endpoint with address 0x8, skipping
[  217.653745][ T6171] usb 2-1: config 9 interface 180 altsetting 4 has 6 endpoint descriptors, different from the interface descriptor's value: 10
[  217.668477][ T6171] usb 2-1: config 9 interface 19 altsetting 26 has an invalid descriptor for endpoint zero, skipping
[  217.680402][ T6171] usb 2-1: config 9 interface 19 altsetting 26 has 4 endpoint descriptors, different from the interface descriptor's value: 0
[  217.693677][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0xB, skipping
[  217.705042][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0xB, skipping
[  217.715890][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has an invalid descriptor for endpoint zero, skipping
[  217.727010][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0x8, skipping
[  217.739277][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has an invalid descriptor for endpoint zero, skipping
[  217.750468][ T6171] usb 2-1: config 9 interface 171 altsetting 14 endpoint 0x5 has invalid maxpacket 1024, setting to 64
[  217.761776][ T6171] usb 2-1: config 9 interface 171 altsetting 14 endpoint 0x3 has invalid maxpacket 1023, setting to 64
[  217.773422][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0x9, skipping
[  217.784518][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0x9, skipping
[  217.795714][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0x8, skipping
[  217.806659][ T6171] usb 2-1: config 9 interface 171 altsetting 14 endpoint 0xF has an invalid bInterval 252, changing to 7
[  217.819125][ T6171] usb 2-1: config 9 interface 171 altsetting 14 has a duplicate endpoint with address 0x84, skipping
[  217.830575][ T6171] usb 2-1: config 9 interface 82 has no altsetting 0
[  217.838185][ T6171] usb 2-1: config 9 interface 180 has no altsetting 0
[  217.845153][ T6171] usb 2-1: config 9 interface 19 has no altsetting 0
[  217.851943][ T6171] usb 2-1: config 9 interface 171 has no altsetting 0
[  217.860365][ T6171] usb 2-1: New USB device found, idVendor=0df6, idProduct=0017, bcdDevice=2d.b1
[  217.869736][ T6171] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  217.877802][ T6171] usb 2-1: Product: 㢠ﮒ礮ꃨꈔ曱ུ볗ᩋ�咔�ﴊÿ墮내ῶ攨纯겒�詖칟�趘顯铋ᆄﾅᙡ๱뵹虎鑖銊��沪ꊔ��㲅瀪⸑⯛褟�朮쪔鿗ꚾ∧綀쿓軣䪄洄
[  217.897979][ T6171] usb 2-1: Manufacturer: ⬫﮵쇭�瞗莾狆씡辉��⢴ꌶ쫙ᅷ�ᑗ賯雄횤ȧ晞伪ᶶ䋕�鵧羈
[  217.911381][ T6171] usb 2-1: SerialNumber: syz
[  218.152221][ T6171] usb 2-1: USB disconnect, device number 45
[  218.178967][ T9852] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 2
[  218.189067][ T9852] XFS (loop0): SB validate failed with error -5.
[  218.199063][ T9858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  218.210319][ T9858] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  218.231777][ T9852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  218.249109][ T9852] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  218.292233][ T9863] input: syz1 as /devices/virtual/input/input17
[  218.302122][ T9863] binder: Bad value for 'max'
[  218.309505][   T30] audit: type=1326 audit(1756699307.878:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.3.1149" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0xa5980000
[  218.897194][ T9869] /dev/rnullb0: Can't lookup blockdev
[  218.945217][ T6171] usb 2-1: new full-speed USB device number 46 using dummy_hcd
[  218.954593][   T30] audit: type=1804 audit(1756699308.508:251): pid=9871 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1154" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  219.094797][ T6171] usb 2-1: device descriptor read/64, error -71
[  219.344211][ T6171] usb 2-1: new full-speed USB device number 47 using dummy_hcd
[  219.474202][ T6171] usb 2-1: device descriptor read/64, error -71
[  219.585600][ T6171] usb usb2-port1: attempt power cycle
[  219.884199][ T5905] usb 4-1: new high-speed USB device number 45 using dummy_hcd
[  219.944161][ T6171] usb 2-1: new full-speed USB device number 48 using dummy_hcd
[  219.964775][ T6171] usb 2-1: device descriptor read/8, error -71
[  220.014894][ T5905] usb 4-1: device descriptor read/64, error -71
[  220.214232][ T6171] usb 2-1: new full-speed USB device number 49 using dummy_hcd
[  220.234725][ T6171] usb 2-1: device descriptor read/8, error -71
[  220.254160][ T5905] usb 4-1: new high-speed USB device number 46 using dummy_hcd
[  220.344374][ T6171] usb usb2-port1: unable to enumerate USB device
[  220.384754][ T5905] usb 4-1: device descriptor read/64, error -71
[  220.494895][ T5905] usb usb4-port1: attempt power cycle
[  220.834922][ T5905] usb 4-1: new high-speed USB device number 47 using dummy_hcd
[  220.856449][ T5905] usb 4-1: device descriptor read/8, error -71
[  221.094272][ T5905] usb 4-1: new high-speed USB device number 48 using dummy_hcd
[  221.115839][ T5905] usb 4-1: device descriptor read/8, error -71
[  221.225759][ T5905] usb usb4-port1: unable to enumerate USB device
[  221.838290][ T9897] /dev/rnullb0: Can't lookup blockdev
[  221.901420][ T9899] /dev/rnullb0: Can't lookup blockdev
[  221.966560][ T9904] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode
[  221.976539][ T9904] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode
[  222.224233][ T5905] usb 2-1: new high-speed USB device number 50 using dummy_hcd
[  222.354561][ T5905] usb 2-1: device descriptor read/64, error -71
[  222.467666][ T9914] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  222.476993][ T9915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  222.477075][ T9914] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  222.488979][ T9915] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  222.594157][ T5905] usb 2-1: new high-speed USB device number 51 using dummy_hcd
[  222.724442][ T5905] usb 2-1: device descriptor read/64, error -71
[  222.836185][ T5905] usb usb2-port1: attempt power cycle
[  223.174361][ T5905] usb 2-1: new high-speed USB device number 52 using dummy_hcd
[  223.205580][ T5905] usb 2-1: device descriptor read/8, error -71
[  223.322332][ T9932] misc userio: Can't change port type on an already running userio instance
[  223.454210][ T5905] usb 2-1: new high-speed USB device number 53 using dummy_hcd
[  223.474809][ T5905] usb 2-1: device descriptor read/8, error -71
[  223.584573][ T5905] usb usb2-port1: unable to enumerate USB device
[  224.130430][ T9934] /dev/rnullb0: Can't lookup blockdev
[  225.018259][ T9946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  225.029507][ T9946] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  225.208465][ T9955] /dev/rnullb0: Can't lookup blockdev
[  225.214193][ T5905] usb 4-1: new high-speed USB device number 49 using dummy_hcd
[  225.374355][ T5905] usb 4-1: Using ep0 maxpacket: 32
[  225.381063][ T5905] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  225.392447][ T5905] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  225.404333][ T5905] usb 4-1: New USB device found, idVendor=20bc, idProduct=5500, bcdDevice= 0.00
[  225.413540][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  225.424176][ T5905] usb 4-1: config 0 descriptor??
[  225.595795][ T9964] sctp: [Deprecated]: syz.0.1188 (pid 9964) Use of int in max_burst socket option.
[  225.595795][ T9964] Use struct sctp_assoc_value instead
[  225.643415][ T9966] /dev/rnullb0: Can't lookup blockdev
[  225.698506][ T9973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  225.708207][ T9973] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  225.751080][   T30] audit: type=1804 audit(1756699315.318:252): pid=9975 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1192" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  225.845128][ T5905] betop 0003:20BC:5500.000B: unbalanced delimiter at end of report description
[  225.854937][ T5905] betop 0003:20BC:5500.000B: parse failed
[  225.860781][ T5905] betop 0003:20BC:5500.000B: probe with driver betop failed with error -22
[  226.059655][   T24] usb 4-1: USB disconnect, device number 49
[  226.120427][   T30] audit: type=1804 audit(1756699315.688:253): pid=9982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1194" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  226.280523][ T9987] netlink: 14593 bytes leftover after parsing attributes in process `syz.0.1195'.
[  226.350022][ T9991] syz0: rxe_newlink: already configured on wlan1
[  226.360979][ T9991] /dev/rnullb0: Can't lookup blockdev
[  226.724140][ T6002] usb 2-1: new high-speed USB device number 54 using dummy_hcd
[  226.768160][T10007] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  226.781627][T10007] /dev/rnullb0: Can't lookup blockdev
[  226.854149][ T6002] usb 2-1: device descriptor read/64, error -71
[  226.897350][T10019] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1204'.
[  227.069929][T10022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  227.079540][T10022] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  227.114292][ T6002] usb 2-1: new high-speed USB device number 55 using dummy_hcd
[  227.244198][ T6002] usb 2-1: device descriptor read/64, error -71
[  227.354336][ T6002] usb usb2-port1: attempt power cycle
[  227.694226][ T6002] usb 2-1: new high-speed USB device number 56 using dummy_hcd
[  227.715152][ T6002] usb 2-1: device descriptor read/8, error -71
[  227.964211][ T6002] usb 2-1: new high-speed USB device number 57 using dummy_hcd
[  227.985339][ T6002] usb 2-1: device descriptor read/8, error -71
[  228.094956][ T6002] usb usb2-port1: unable to enumerate USB device
[  228.112016][T10032] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  228.188997][T10036] tipc: Started in network mode
[  228.195153][T10036] tipc: Node identity 2d000000400000000000000000000001, cluster identity 4711
[  228.206733][T10036] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  228.226773][T10040] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  228.436858][   T30] audit: type=1804 audit(1756699318.008:254): pid=10064 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1216" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  228.502479][T10066] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  229.179227][   T30] audit: type=1804 audit(1756699318.748:255): pid=10070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1219" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  229.512968][T10075] MTD: Couldn't look up '/dev/rnullb0': -15
[  229.563403][T10078] /dev/rnullb0: Can't lookup blockdev
[  229.864216][   T24] usb 2-1: new high-speed USB device number 58 using dummy_hcd
[  229.942535][   T30] audit: type=1804 audit(1756699319.508:256): pid=10094 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1229" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  230.020984][T10100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  230.033904][T10100] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  230.035165][   T24] usb 2-1: Using ep0 maxpacket: 16
[  230.052905][   T24] usb 2-1: config 0 has an invalid interface number: 105 but max is 0
[  230.065865][   T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  230.076760][   T24] usb 2-1: config 0 has no interface number 0
[  230.089047][   T24] usb 2-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28
[  230.101207][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  230.109576][   T24] usb 2-1: Product: syz
[  230.113899][   T24] usb 2-1: Manufacturer: syz
[  230.120878][   T24] usb 2-1: SerialNumber: syz
[  230.132115][   T24] usb 2-1: config 0 descriptor??
[  230.142028][   T24] uvcvideo 2-1:0.105: probe with driver uvcvideo failed with error -22
[  230.204977][ T6171] usb 4-1: new high-speed USB device number 50 using dummy_hcd
[  230.221649][ T7592] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
[  230.233394][ T7592] CPU: 0 UID: 0 PID: 7592 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
[  230.233422][ T7592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  230.233434][ T7592] Call Trace:
[  230.233442][ T7592]  <TASK>
[  230.233449][ T7592]  dump_stack_lvl+0x189/0x250
[  230.233484][ T7592]  ? __pfx_dump_stack_lvl+0x10/0x10
[  230.233511][ T7592]  ? __pfx__printk+0x10/0x10
[  230.233539][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.233562][ T7592]  dump_header+0xd3/0x480
[  230.233580][ T7592]  oom_kill_process+0x387/0x920
[  230.233603][ T7592]  out_of_memory+0xf09/0x12a0
[  230.233626][ T7592]  ? mem_cgroup_iter+0x3b/0x460
[  230.233647][ T7592]  ? __pfx_out_of_memory+0x10/0x10
[  230.233670][ T7592]  mem_cgroup_out_of_memory+0x145/0x240
[  230.233692][ T7592]  ? __pfx_mem_cgroup_out_of_memory+0x10/0x10
[  230.233716][ T7592]  ? _raw_spin_unlock+0x28/0x50
[  230.233738][ T7592]  ? memcg1_oom_prepare+0x37f/0x450
[  230.233764][ T7592]  try_charge_memcg+0xdff/0x1290
[  230.233789][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.233815][ T7592]  ? __pfx_try_charge_memcg+0x10/0x10
[  230.233841][ T7592]  ? rcu_irq_exit_check_preempt+0x201/0x210
[  230.233861][ T7592]  ? xa_load+0x60/0x210
[  230.233885][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.233905][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.233924][ T7592]  ? mem_cgroup_swapin_charge_folio+0x33/0x390
[  230.233952][ T7592]  charge_memcg+0x9f/0x180
[  230.233976][ T7592]  ? mem_cgroup_swapin_charge_folio+0x33/0x390
[  230.234002][ T7592]  mem_cgroup_swapin_charge_folio+0x262/0x390
[  230.234035][ T7592]  __read_swap_cache_async+0x28c/0x510
[  230.234060][ T7592]  swap_cluster_readahead+0x305/0x5f0
[  230.234094][ T7592]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  230.234117][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.234134][ T7592]  ? filemap_get_entry+0xad/0x2f0
[  230.234154][ T7592]  ? get_vma_policy+0x27c/0x3c0
[  230.234182][ T7592]  swapin_readahead+0x17d/0xb50
[  230.234200][ T7592]  ? __pfx_filemap_get_entry+0x10/0x10
[  230.234221][ T7592]  ? get_swap_device_info+0x1c/0x2b0
[  230.234242][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.234261][ T7592]  ? __pfx_swapin_readahead+0x10/0x10
[  230.234282][ T7592]  ? __filemap_get_folio+0x9a6/0xaf0
[  230.234306][ T7592]  ? swap_cache_get_folio+0xae/0x3b0
[  230.234328][ T7592]  do_swap_page+0x525/0x5ac0
[  230.234358][ T7592]  ? ___pte_offset_map+0x29/0x250
[  230.234385][ T7592]  ? lock_acquire+0x5f/0x360
[  230.234401][ T7592]  ? do_swap_page+0x184/0x5ac0
[  230.234424][ T7592]  ? __pfx_do_swap_page+0x10/0x10
[  230.234448][ T7592]  ? __pfx_default_wake_function+0x10/0x10
[  230.234466][ T7592]  ? ___pte_offset_map+0x45/0x250
[  230.234490][ T7592]  ? ___pte_offset_map+0x1cf/0x250
[  230.234514][ T7592]  ? pte_offset_map_rw_nolock+0xea/0x160
[  230.234540][ T7592]  __handle_mm_fault+0xe55/0x5400
[  230.234572][ T7592]  ? __pfx___handle_mm_fault+0x10/0x10
[  230.234597][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.234621][ T7592]  ? lock_vma_under_rcu+0x3cb/0x450
[  230.234638][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.234658][ T7592]  ? __pfx_lock_vma_under_rcu+0x10/0x10
[  230.234677][ T7592]  handle_mm_fault+0x40a/0x8e0
[  230.234705][ T7592]  do_user_addr_fault+0xa81/0x1390
[  230.234726][ T7592]  ? rcu_is_watching+0x15/0xb0
[  230.234745][ T7592]  ? trace_page_fault_user+0x84/0x1e0
[  230.234764][ T7592]  exc_page_fault+0x82/0x100
[  230.234787][ T7592]  asm_exc_page_fault+0x26/0x30
[  230.234804][ T7592] RIP: 0033:0x7f7e4b9b6a10
[  230.234822][ T7592] Code: 48 8b 3c 25 00 03 00 00 e8 1d 13 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 e7 02 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 <64> 48 8b 04 25 10 00 00 00 8b 90 08 03 00 00 48 8d b8 08 03 00 00
[  230.234838][ T7592] RSP: 002b:00007ffe9c693738 EFLAGS: 00010246
[  230.234857][ T7592] RAX: 0000000000000000 RBX: 00000000000001ab RCX: 00007f7e4b9c14a5
[  230.234871][ T7592] RDX: 00007ffe9c693780 RSI: 0000000000000000 RDI: 0000000000000000
[  230.234883][ T7592] RBP: 00007ffe9c6937ec R08: 0000000000000000 R09: 0000000000000000
[  230.234895][ T7592] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000001388
[  230.234906][ T7592] R13: 00000000000927c0 R14: 0000000000037ceb R15: 00007ffe9c693840
[  230.234926][ T7592]  </TASK>
[  230.656033][T10083] /dev/rnullb0: Can't lookup blockdev
[  230.661925][ T7592] memory: usage 307200kB, limit 307200kB, failcnt 2274
[  230.669501][ T7592] memory+swap: usage 308212kB, limit 9007199254740988kB, failcnt 0
[  230.677943][ T7592] kmem: usage 3176kB, limit 9007199254740988kB, failcnt 0
[  230.685268][ T7592] Memory cgroup stats for /syz4:
[  230.685408][ T7592] cache 311320576
[  230.694449][ T7592] rss 0
[  230.697257][ T7592] rss_huge 0
[  230.700536][ T7592] shmem 311320576
[  230.706092][ T7592] mapped_file 0
[  230.710096][ T7592] dirty 0
[  230.713076][ T7592] writeback 0
[  230.717142][ T7592] workingset_refault_anon 1
[  230.721714][ T7592] workingset_refault_file 0
[  230.724116][ T6171] usb 4-1: Using ep0 maxpacket: 8
[  230.727780][ T7592] swap 1036288
[  230.732974][ T6171] usb 4-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e
[  230.736762][   T24] usb 2-1: USB disconnect, device number 58
[  230.745096][ T6171] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  230.759449][ T7592] swapcached 0
[  230.760509][ T6171] usb 4-1: config 0 descriptor??
[  230.777965][ T7592] pgpgin 108466
[  230.781555][ T7592] pgpgout 32460
[  230.785195][ T7592] pgfault 23050
[  230.788675][ T7592] pgmajfault 2
[  230.792628][ T7592] inactive_anon 0
[  230.796425][ T7592] active_anon 173060096
[  230.801042][ T7592] inactive_file 0
[  230.805208][ T7592] active_file 0
[  230.808710][ T7592] unevictable 138260480
[  230.812977][ T7592] hierarchical_memory_limit 314572800
[  230.818918][ T7592] hierarchical_memsw_limit 9223372036854771712
[  230.825741][ T7592] total_cache 311320576
[  230.830324][ T7592] total_rss 0
[  230.833819][ T7592] total_rss_huge 0
[  230.837642][ T7592] total_shmem 311320576
[  230.843209][ T7592] total_mapped_file 0
[  230.847521][ T7592] total_dirty 0
[  230.851011][ T7592] total_writeback 0
[  230.855350][ T7592] total_workingset_refault_anon 1
[  230.860630][ T7592] total_workingset_refault_file 0
[  230.866500][ T7592] total_swap 1036288
[  230.870581][ T7592] total_swapcached 0
[  230.879298][ T7592] total_pgpgin 108466
[  230.883484][ T7592] total_pgpgout 32460
[  230.887965][ T7592] total_pgfault 23050
[  230.892541][ T7592] total_pgmajfault 2
[  230.896677][ T7592] total_inactive_anon 0
[  230.904499][ T7592] total_active_anon 173060096
[  230.909315][ T7592] total_inactive_file 0
[  230.913643][ T7592] total_active_file 0
[  230.917766][ T7592] total_unevictable 138260480
[  230.922479][ T7592] anon_cost 0
[  230.926910][ T7592] file_cost 0
[  230.930351][ T7592] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.1218,pid=10067,uid=0
[  230.946948][ T7592] Memory cgroup out of memory: Killed process 10067 (syz.4.1218) total-vm:102024kB, anon-rss:1016kB, file-rss:23208kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000
[  230.981673][ T6002] usb 4-1: USB disconnect, device number 50
[  231.158662][T10109] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[  231.185069][    C1] vkms_vblank_simulate: vblank timer overrun
[  231.193199][T10109] CIFS mount error: No usable UNC path provided in device string!
[  231.193199][T10109] 
[  231.204309][T10109] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string!
[  231.307784][T10118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  231.316851][T10118] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  231.563230][T10129] netlink: 'syz.3.1237': attribute type 11 has an invalid length.
[  231.572119][T10129] netlink: 'syz.3.1237': attribute type 11 has an invalid length.
[  231.580683][T10129] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.1237'.
[  231.754129][ T6171] usb 2-1: new high-speed USB device number 59 using dummy_hcd
[  231.925164][ T6171] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  231.939173][ T6171] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  231.953653][ T6171] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  231.971088][   T30] audit: type=1804 audit(1756699321.538:257): pid=10149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1244" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  231.993257][ T6171] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  232.006440][ T6171] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  232.021395][ T6171] usb 2-1: config 0 descriptor??
[  232.398749][T10159] delete_channel: no stack
[  232.403437][T10159] delete_channel: no stack
[  232.441263][ T6171] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[  232.442567][T10161] /dev/rnullb0: Can't lookup blockdev
[  232.530124][   T30] audit: type=1804 audit(1756699322.098:258): pid=10164 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1248" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  232.551638][    C1] vkms_vblank_simulate: vblank timer overrun
[  232.830001][T10175] /dev/rnullb0: Can't lookup blockdev
[  233.066870][T10183] /dev/rnullb0: Can't lookup blockdev
[  233.775250][   T10] usb 2-1: USB disconnect, device number 59
[  234.485612][T10205] /dev/rnullb0: Can't lookup blockdev
[  234.583601][T10214] EXT4-fs (md0): unable to read superblock
[  234.918976][T10238] nbd: must specify an index to disconnect
[  234.926238][T10238] /dev/rnullb0: Can't lookup blockdev
[  235.822131][T10253] openvswitch: netlink: Key type 169 is out of range max 32
[  235.867626][T10257] /dev/rnullb0: Can't lookup blockdev
[  235.937109][T10261] /dev/rnullb0: Can't lookup blockdev
[  235.994965][T10268] /dev/rnullb0: Can't lookup blockdev
[  236.001479][T10267] ntfs3(nullb0): Primary boot signature is not NTFS.
[  236.008462][T10267] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00
[  236.063902][T10272] /dev/rnullb0: Can't lookup blockdev
[  236.400842][   T30] audit: type=1804 audit(1756699325.968:259): pid=10297 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1291" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  236.639830][   T30] audit: type=1804 audit(1756699326.208:260): pid=10301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1293" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  236.786566][T10305] MTD: Couldn't look up '/dev/rnullb0': -15
[  236.801783][T10303] smc: net device bridge0 applied user defined pnetid SYZ0
[  236.824140][T10303] /dev/rnullb0: Can't lookup blockdev
[  236.916802][T10308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  236.944590][T10308] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  237.524191][T10318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  237.554001][T10318] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  237.775983][T10318] /dev/rnullb0: Can't lookup blockdev
[  238.109584][T10330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  238.149827][T10330] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  238.176341][T10330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  238.200029][T10330] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  238.228967][T10330] /dev/rnullb0: Can't lookup blockdev
[  238.565659][T10336] veth1_to_bond: entered allmulticast mode
[  238.585494][T10336] veth1_to_bond: left allmulticast mode
[  238.897944][   T30] audit: type=1804 audit(1756699328.458:261): pid=10343 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1308" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  239.234722][T10349] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  239.585650][T10357] fuse: blksize only supported for fuseblk
[  239.883985][T10361] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  239.987535][T10364] /dev/rnullb0: Can't lookup blockdev
[  240.005308][T10365] /dev/rnullb0: Can't lookup blockdev
[  240.852378][T10384] MTD: Couldn't look up '/dev/rnullb0': -15
[  240.861515][T10384] /dev/rnullb0: Can't lookup blockdev
[  240.876511][T10384] smc: net device bond0 applied user defined pnetid SYZ0
[  241.019009][T10389] input: syz1 as /devices/virtual/input/input20
[  241.038173][   T30] audit: type=1804 audit(1756699330.608:262): pid=10389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1323" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  241.060942][    C1] vkms_vblank_simulate: vblank timer overrun
[  241.691158][T10424] /dev/rnullb0: Can't lookup blockdev
[  241.894602][ T6002] usb 4-1: new high-speed USB device number 51 using dummy_hcd
[  241.906216][   T30] audit: type=1804 audit(1756699331.458:263): pid=10436 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1340" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  241.931844][    C1] vkms_vblank_simulate: vblank timer overrun
[  241.944153][T10436] wlan1 speed is unknown, defaulting to 1000
[  242.036502][T10439] (syz.0.1341,10439,1):ocfs2_fill_super:989 ERROR: superblock probe failed!
[  242.069753][T10441] /dev/rnullb0: Can't lookup blockdev
[  242.086714][T10439] (syz.0.1341,10439,0):ocfs2_fill_super:1177 ERROR: status = -22
[  242.104715][ T6002] usb 4-1: Using ep0 maxpacket: 32
[  242.125584][ T6002] usb 4-1: config 0 has an invalid interface number: 196 but max is 0
[  242.136350][ T6002] usb 4-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config
[  242.149553][ T6002] usb 4-1: config 0 has no interface number 0
[  242.156673][ T6002] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528
[  242.169307][ T6002] usb 4-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  242.184941][ T6002] usb 4-1: config 0 interface 196 has no altsetting 0
[  242.197139][ T6002] usb 4-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a
[  242.207616][ T6002] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  242.218595][ T6002] usb 4-1: Product: syz
[  242.223025][ T6002] usb 4-1: Manufacturer: syz
[  242.228736][ T6002] usb 4-1: SerialNumber: syz
[  242.244684][ T6002] usb 4-1: config 0 descriptor??
[  242.257993][T10422] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  242.307173][T10447] /dev/rnullb0: Can't lookup blockdev
[  242.324727][T10447] /dev/rnullb0: Can't lookup blockdev
[  242.484887][ T6002] ipheth 4-1:0.196: Unable to find endpoints
[  242.544455][ T6002] usb 4-1: USB disconnect, device number 51
[  242.575385][T10454] MTD: Couldn't look up '/dev/rnullb0': -15
[  242.990115][T10470] MTD: Couldn't look up '/dev/rnullb0': -15
[  243.244249][   T10] usb 4-1: new high-speed USB device number 52 using dummy_hcd
[  243.384181][   T10] usb 4-1: device descriptor read/64, error -71
[  243.624197][   T10] usb 4-1: new high-speed USB device number 53 using dummy_hcd
[  243.715598][   T30] audit: type=1804 audit(1756699333.288:264): pid=10474 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1352" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  243.747420][    C1] vkms_vblank_simulate: vblank timer overrun
[  243.785432][   T10] usb 4-1: device descriptor read/64, error -71
[  243.904404][   T10] usb usb4-port1: attempt power cycle
[  244.254158][   T10] usb 4-1: new high-speed USB device number 54 using dummy_hcd
[  244.296947][   T10] usb 4-1: device descriptor read/8, error -71
[  244.534225][   T10] usb 4-1: new high-speed USB device number 55 using dummy_hcd
[  244.555620][   T10] usb 4-1: device descriptor read/8, error -71
[  244.665014][   T10] usb usb4-port1: unable to enumerate USB device
[  244.697819][T10496] /dev/rnullb0: Can't lookup blockdev
[  245.449404][T10506] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1365'.
[  245.628408][   T30] audit: type=1804 audit(1756699335.198:265): pid=10510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1367" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  245.667418][ T5862] dvb-usb: did not find the firmware file 'dvb-usb-dibusb-5.0.0.11.fw' (status -110). You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware
[  245.696246][ T5862] dvb_usb_dibusb_mb 5-1:5.6: probe with driver dvb_usb_dibusb_mb failed with error -22
[  245.724261][ T5862] usb 5-1: USB disconnect, device number 28
[  246.034147][ T5862] usb 5-1: new full-speed USB device number 29 using dummy_hcd
[  246.134479][ T6002] usb 4-1: new high-speed USB device number 56 using dummy_hcd
[  246.186960][ T5862] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  246.198319][ T5862] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00
[  246.212226][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  246.223510][ T5862] usb 5-1: config 0 descriptor??
[  246.231242][T10486] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  246.247149][ T5862] usbhid 5-1:0.0: can't add hid device: -22
[  246.253439][ T5862] usbhid 5-1:0.0: probe with driver usbhid failed with error -22
[  246.287166][ T6002] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  246.299339][ T6002] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  246.313280][ T6002] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  246.323921][ T6002] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  246.333774][ T6002] usb 4-1: SerialNumber: syz
[  246.583039][T10525] /dev/rnullb0: Can't lookup blockdev
[  246.605341][   T30] audit: type=1326 audit(1756699336.178:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10518 comm="syz.3.1370" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f88b798ebe9 code=0x0
[  246.627386][    C1] vkms_vblank_simulate: vblank timer overrun
[  246.801854][T10533] netlink: 'syz.0.1376': attribute type 10 has an invalid length.
[  246.850958][T10536] /dev/rnullb0: Can't lookup blockdev
[  246.897690][T10538] erofs (device md0): cannot find valid erofs superblock
[  246.978633][T10542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  246.989699][T10542] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  247.180371][T10543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  247.190569][T10543] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  247.561641][T10545] netlink: 9896 bytes leftover after parsing attributes in process `syz.0.1381'.
[  247.572212][   T30] audit: type=1804 audit(1756699337.148:267): pid=10545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1381" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  247.593721][    C1] vkms_vblank_simulate: vblank timer overrun
[  247.608116][T10545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  247.620062][T10545] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  248.299482][ T5862] usb 5-1: USB disconnect, device number 29
[  248.420422][T10556] /dev/rnullb0: Can't lookup blockdev
[  248.670598][T10564] syz.0.1387 (10564) used greatest stack depth: 17992 bytes left
[  248.773074][   T30] audit: type=1804 audit(1756699338.338:268): pid=10579 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1391" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  248.782168][T10579] netlink: 666 bytes leftover after parsing attributes in process `syz.0.1391'.
[  248.922857][T10582] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1392'.
[  249.010788][ T6002] usb 4-1: 0:2 : does not exist
[  249.045387][ T6002] usb 4-1: unit 5: unexpected type 0x0b
[  249.078350][ T6002] usb 4-1: USB disconnect, device number 56
[  249.272946][T10602] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1398'.
[  249.283493][T10601] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1398'.
[  249.314589][T10604] /dev/rnullb0: Can't lookup blockdev
[  249.444346][ T6002] usb 4-1: new high-speed USB device number 57 using dummy_hcd
[  249.585160][ T6002] usb 4-1: device descriptor read/64, error -71
[  249.767464][   T30] audit: type=1804 audit(1756699339.338:269): pid=10612 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1402" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  249.824262][ T6002] usb 4-1: new high-speed USB device number 58 using dummy_hcd
[  249.900313][   T30] audit: type=1326 audit(1756699339.468:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10619 comm="syz.1.1405" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1f4e58ebe9 code=0x0
[  249.932115][T10622] IPVS: set_ctl: invalid protocol: 1 10.1.1.1:20000
[  249.958438][T10625] netlink: 'syz.0.1407': attribute type 1 has an invalid length.
[  249.968625][T10625] netlink: 'syz.0.1407': attribute type 1 has an invalid length.
[  250.004205][ T6002] usb 4-1: device descriptor read/64, error -71
[  250.012300][T10630] syzkaller1: entered promiscuous mode
[  250.019843][T10630] syzkaller1: entered allmulticast mode
[  250.114767][ T6002] usb usb4-port1: attempt power cycle
[  250.244191][ T5926] usb 5-1: new full-speed USB device number 30 using dummy_hcd
[  250.406683][ T5926] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 5
[  250.416024][ T5926] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 4
[  250.427756][ T5926] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b
[  250.437180][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  250.447484][ T5926] usb 5-1: config 0 descriptor??
[  250.464103][ T6002] usb 4-1: new high-speed USB device number 59 using dummy_hcd
[  250.494258][ T6002] usb 4-1: device descriptor read/8, error -71
[  250.661631][ T5926] ath6kl: Failed to submit usb control message: -71
[  250.668610][ T5926] ath6kl: unable to send the bmi data to the device: -71
[  250.676325][ T5926] ath6kl: Unable to send get target info: -71
[  250.683001][ T5926] ath6kl: Failed to init ath6kl core: -71
[  250.690300][ T5926] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71
[  250.702726][ T5926] usb 5-1: USB disconnect, device number 30
[  250.734312][ T6002] usb 4-1: new high-speed USB device number 60 using dummy_hcd
[  250.764249][ T6002] usb 4-1: device descriptor read/8, error -71
[  250.850092][T10641] wlan1 speed is unknown, defaulting to 1000
[  250.874311][ T6002] usb usb4-port1: unable to enumerate USB device
[  251.261874][T10649] MTD: Couldn't look up '/dev/rnullb0': -15
[  251.314238][   T30] audit: type=1804 audit(1756699340.878:271): pid=10653 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1416" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  252.116576][T10664] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1419'.
[  252.295071][T10670] MTD: Couldn't look up '/dev/rnullb0': -15
[  252.732125][T10673] ieee802154 phy0 wpan0: encryption failed: -22
[  252.739421][T10673] /dev/rnullb0: Can't lookup blockdev
[  253.008519][T10678] netlink: 'syz.3.1423': attribute type 29 has an invalid length.
[  253.050233][T10678] netlink: 'syz.3.1423': attribute type 29 has an invalid length.
[  253.075940][T10678] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1423'.
[  253.527580][T10690] /dev/rnullb0: Can't lookup blockdev
[  253.716350][   T30] audit: type=1804 audit(1756699343.286:272): pid=10703 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1431" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  253.760854][T10705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  253.769945][T10705] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  253.781771][T10705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  253.791364][T10705] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  253.800951][T10705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  253.809748][T10705] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  253.819498][T10705] random: crng reseeded on system resumption
[  253.931053][T10707] /dev/rnullb0: Can't lookup blockdev
[  254.470901][T10729] Bluetooth: MGMT ver 1.23
[  254.499251][   T30] audit: type=1804 audit(1756699344.066:273): pid=10729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1440" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  254.572543][T10740] /dev/rnullb0: Can't lookup blockdev
[  254.603664][T10742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  254.612884][T10742] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  254.626292][T10738] usb usb8: usbfs: process 10738 (syz.4.1442) did not claim interface 0 before use
[  254.627499][T10742] /dev/rnullb0: Can't lookup blockdev
[  254.643927][T10743] /dev/rnullb0: Can't lookup blockdev
[  254.645465][T10738] /dev/rnullb0: Can't lookup blockdev
[  254.937507][T10749] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1447'.
[  254.949009][T10751] /dev/rnullb0: Can't lookup blockdev
[  254.993325][   T30] audit: type=1804 audit(1756699344.556:274): pid=10754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1449" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  255.076176][T10756] /dev/rnullb0: Can't lookup blockdev
[  255.162884][T10762] 9p: Unknown access argument Š: -22
[  255.169760][T10762] openvswitch: netlink: Flow key attr not present in new flow.
[  255.185560][T10762] MTD: Couldn't look up '/dev/rnullb0': -15
[  255.192254][   T13] nci: nci_rsp_packet: unknown rsp opcode 0x211
[  255.278843][T10773] /dev/rnullb0: Can't lookup blockdev
[  255.445572][T10776] MTD: Couldn't look up '/dev/rnullb0': -15
[  255.897797][ T1303] ieee802154 phy0 wpan0: encryption failed: -22
[  255.906391][ T1303] ieee802154 phy1 wpan1: encryption failed: -22
[  256.150973][T10805] MTD: Couldn't look up '/dev/rnullb0': -15
[  256.261340][T10812] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  256.407132][   T30] audit: type=1804 audit(1756699345.976:275): pid=10824 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1471" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  256.525301][ T6002] usb 2-1: new high-speed USB device number 60 using dummy_hcd
[  256.685655][ T6002] usb 2-1: config 0 has no interfaces?
[  256.692940][ T6002] usb 2-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 0.02
[  256.702962][ T6002] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  256.711667][ T6002] usb 2-1: SerialNumber: syz
[  256.720247][ T6002] usb 2-1: config 0 descriptor??
[  256.829939][T10837] MTD: Couldn't look up '/dev/rnullb0': -15
[  256.841698][T10837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  256.856517][T10837] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  256.968467][ T6002] usb 2-1: USB disconnect, device number 60
[  257.207339][T10847] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5)
[  257.214358][T10847] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless)
[  257.231115][T10847] vhci_hcd vhci_hcd.0: Device attached
[  257.238887][T10847] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7)
[  257.245449][T10847] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  257.254947][T10847] vhci_hcd vhci_hcd.0: Device attached
[  257.263606][T10847] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9)
[  257.270262][T10847] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed)
[  257.285350][T10847] vhci_hcd vhci_hcd.0: Device attached
[  257.294371][T10847] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(11)
[  257.301187][T10847] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed)
[  257.321167][T10847] vhci_hcd vhci_hcd.0: Device attached
[  257.375123][T10847] /dev/rnullb0: Can't lookup blockdev
[  257.401875][T10852] vhci_hcd: connection closed
[  257.402204][   T36] vhci_hcd: stop threads
[  257.404650][ T6171] vhci_hcd: vhci_device speed not set
[  257.408361][T10850] vhci_hcd: connection closed
[  257.411587][T10854] vhci_hcd: connection closed
[  257.417162][T10848] vhci_hcd: connection closed
[  257.429667][   T36] vhci_hcd: release socket
[  257.440332][   T36] vhci_hcd: disconnect device
[  257.456090][   T36] vhci_hcd: stop threads
[  257.464488][   T36] vhci_hcd: release socket
[  257.471962][   T36] vhci_hcd: disconnect device
[  257.477188][   T36] vhci_hcd: stop threads
[  257.481550][   T36] vhci_hcd: release socket
[  257.486550][ T6171] usb 39-1: new full-speed USB device number 2 using vhci_hcd
[  257.494615][   T36] vhci_hcd: disconnect device
[  257.502555][ T6171] usb 39-1: enqueue for inactive port 0
[  257.510678][   T36] vhci_hcd: stop threads
[  257.536697][   T36] vhci_hcd: release socket
[  257.554806][   T36] vhci_hcd: disconnect device
[  257.604150][ T6171] vhci_hcd: vhci_device speed not set
[  257.729728][   T30] audit: type=1804 audit(1756699347.296:276): pid=10877 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1487" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  257.790253][T10881] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  257.989037][T10893] /dev/rnullb0: Can't lookup blockdev
[  258.113198][T10904] netlink: 'syz.4.1494': attribute type 4 has an invalid length.
[  258.140749][T10904] netlink: 17 bytes leftover after parsing attributes in process `syz.4.1494'.
[  258.150319][ T5926] usb 2-1: new high-speed USB device number 61 using dummy_hcd
[  258.174427][T10907] /dev/rnullb0: Can't lookup blockdev
[  258.304121][ T5926] usb 2-1: Using ep0 maxpacket: 16
[  258.311179][ T5926] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  258.321904][ T5926] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  258.332381][ T5926] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  258.343791][ T5926] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  258.353782][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  258.362236][ T5926] usb 2-1: Product: syz
[  258.367327][ T5926] usb 2-1: Manufacturer: syz
[  258.372447][ T5926] usb 2-1: SerialNumber: syz
[  258.410620][T10917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  258.419528][T10917] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  258.434199][ T6002] usb 4-1: new high-speed USB device number 61 using dummy_hcd
[  258.544317][   T24] usb 5-1: new high-speed USB device number 31 using dummy_hcd
[  258.574286][ T6002] usb 4-1: device descriptor read/64, error -71
[  258.582846][T10918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  258.591928][T10918] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  258.602099][ T5926] usb 2-1: 0:2 : does not exist
[  258.633913][T10917] MTD: Couldn't look up '/dev/rnullb0': -15
[  258.640843][T10917] /dev/rnullb0: Can't lookup blockdev
[  258.705923][   T24] usb 5-1: config 0 has an invalid interface number: 1 but max is 0
[  258.714403][   T24] usb 5-1: config 0 has no interface number 0
[  258.720674][   T24] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  258.731708][   T24] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  258.741909][   T24] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00
[  258.751203][   T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  258.761345][   T24] usb 5-1: config 0 descriptor??
[  258.814337][ T6002] usb 4-1: new high-speed USB device number 62 using dummy_hcd
[  258.944253][ T6002] usb 4-1: device descriptor read/64, error -71
[  259.054821][ T6002] usb usb4-port1: attempt power cycle
[  259.103547][T10922] /dev/rnullb0: Can't lookup blockdev
[  259.118282][ T5926] usb 2-1: USB disconnect, device number 61
[  259.145331][ T9793] udevd[9793]: setting mode of /dev/mixer3 to 020660 failed: No such file or directory
[  259.164304][ T9793] udevd[9793]: setting owner of /dev/mixer3 to uid=0, gid=29 failed: No such file or directory
[  259.177366][   T24] prodikeys 0003:041E:2801.000D: reserved main item tag 0xd
[  259.198536][   T24] prodikeys 0003:041E:2801.000D: item fetching failed at offset 6/7
[  259.216899][   T24] prodikeys 0003:041E:2801.000D: hid parse failed
[  259.230208][   T24] prodikeys 0003:041E:2801.000D: probe with driver prodikeys failed with error -22
[  259.259983][T10927] /dev/rnullb0: Can't lookup blockdev
[  259.286815][T10931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  259.296566][T10931] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  259.384378][   T24] usb 5-1: USB disconnect, device number 31
[  259.394115][ T6002] usb 4-1: new high-speed USB device number 63 using dummy_hcd
[  259.415574][ T6002] usb 4-1: device descriptor read/8, error -71
[  259.506284][T10932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  259.515638][T10931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  259.516908][T10932] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  259.525212][T10931] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  259.584628][ T5926] usb 2-1: new full-speed USB device number 62 using dummy_hcd
[  259.666183][ T6002] usb 4-1: new high-speed USB device number 64 using dummy_hcd
[  259.694988][ T6002] usb 4-1: device descriptor read/8, error -71
[  259.745266][ T5926] usb 2-1: not running at top speed; connect to a high speed hub
[  259.753158][ T5926] usb 2-1: too many configurations: 147, using maximum allowed: 8
[  259.762381][ T5926] usb 2-1: unable to read config index 0 descriptor/start: -61
[  259.770201][ T5926] usb 2-1: can't read configurations, error -61
[  259.815133][ T6002] usb usb4-port1: unable to enumerate USB device
[  259.904183][ T5926] usb 2-1: new full-speed USB device number 63 using dummy_hcd
[  260.075785][ T5926] usb 2-1: not running at top speed; connect to a high speed hub
[  260.083759][ T5926] usb 2-1: too many configurations: 147, using maximum allowed: 8
[  260.112141][ T5926] usb 2-1: unable to read config index 0 descriptor/start: -61
[  260.124109][ T5926] usb 2-1: can't read configurations, error -61
[  260.174286][ T5926] usb usb2-port1: attempt power cycle
[  260.416229][T10951] /dev/rnullb0: Can't lookup blockdev
[  260.489872][T10959] rdma_rxe: rxe_newlink: failed to add wlan1
[  260.489872][T10958] rdma_rxe: rxe_newlink: failed to add wlan1
[  260.507354][T10958] /dev/rnullb0: Can't lookup blockdev
[  260.525282][ T5926] usb 2-1: new full-speed USB device number 64 using dummy_hcd
[  260.566512][ T5926] usb 2-1: not running at top speed; connect to a high speed hub
[  260.574438][ T5926] usb 2-1: too many configurations: 147, using maximum allowed: 8
[  260.585445][ T5926] usb 2-1: unable to read config index 0 descriptor/start: -61
[  260.593367][ T5926] usb 2-1: can't read configurations, error -61
[  260.651916][T10969] /dev/rnullb0: Can't lookup blockdev
[  260.701285][T10972] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1514'.
[  260.712084][T10972] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1514'.
[  260.722596][T10972] 9p: Bad value for 'rfdno'
[  260.728551][T10972] /dev/rnullb0: Can't lookup blockdev
[  260.734560][ T5926] usb 2-1: new full-speed USB device number 65 using dummy_hcd
[  260.767725][ T5926] usb 2-1: not running at top speed; connect to a high speed hub
[  260.776194][ T5926] usb 2-1: too many configurations: 147, using maximum allowed: 8
[  260.795938][ T5926] usb 2-1: unable to read config index 0 descriptor/start: -61
[  260.803658][ T5926] usb 2-1: can't read configurations, error -61
[  260.812103][ T5926] usb usb2-port1: unable to enumerate USB device
[  261.004221][T10985] MPI: mpi too large (124808 bits)
[  261.011984][T10985] tipc: Started in network mode
[  261.018456][T10985] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711
[  261.026234][T10985] tipc: Enabled bearer <eth:batadv0>, priority 10
[  261.048420][T10989] /dev/rnullb0: Can't lookup blockdev
[  261.087878][   T30] audit: type=1804 audit(1756699350.656:277): pid=10992 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1521" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  261.093331][T10993] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  261.126552][T10993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  261.137246][T10993] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  261.147545][T10991] tipc: Disabling bearer <eth:syzkaller0>
[  261.249794][T10999] bridge0: port 3(syz_tun) entered blocking state
[  261.257284][T10999] bridge0: port 3(syz_tun) entered disabled state
[  261.265057][T10999] syz_tun: entered allmulticast mode
[  261.271572][T10999] syz_tun: entered promiscuous mode
[  261.277568][T10999] bridge0: port 3(syz_tun) entered blocking state
[  261.284227][T10999] bridge0: port 3(syz_tun) entered forwarding state
[  261.594853][ T6002] usb 4-1: new high-speed USB device number 65 using dummy_hcd
[  261.764203][ T6002] usb 4-1: Using ep0 maxpacket: 32
[  261.775319][ T6002] usb 4-1: config index 0 descriptor too short (expected 156, got 27)
[  261.794142][ T6002] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[  261.817259][ T6002] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7
[  261.830923][ T6002] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[  261.844674][ T6002] usb 4-1: config 0 interface 0 has no altsetting 0
[  261.853460][ T6002] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[  261.865003][ T6002] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[  261.894228][ T6002] usb 4-1: Product: syz
[  261.902188][ T6002] usb 4-1: Manufacturer: syz
[  261.907470][ T6002] usb 4-1: SerialNumber: syz
[  261.921308][ T6002] usb 4-1: config 0 descriptor??
[  261.939962][ T6002] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[  261.942573][T11016] MTD: Couldn't look up '/dev/rnullb0': -15
[  261.962124][ T6002] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[  261.964829][T11016] /dev/rnullb0: Can't lookup blockdev
[  262.047967][T11019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  262.067190][T11021] /dev/rnullb0: Can't lookup blockdev
[  262.083897][T11019] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  262.087256][T11018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  262.116755][   T30] audit: type=1326 audit(1756699351.686:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11017 comm="syz.0.1528" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa9e138ebe9 code=0x0
[  262.139875][T11018] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  262.165662][ T6002] tipc: Node number set to 8432298
[  262.173724][ T6002] usb 4-1: USB disconnect, device number 65
[  262.198053][ T6002] ldusb 4-1:0.0: LD USB Device #0 now disconnected
[  262.357025][   T30] audit: type=1804 audit(1756699351.916:279): pid=11040 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1533" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  262.379236][T11039] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1534'.
[  262.556739][T11056] cgroup2: Unknown parameter 'obj_user'
[  262.572184][T11058] /dev/rnullb0: Can't lookup blockdev
[  262.587028][T11056] /dev/rnullb0: Can't lookup blockdev
[  262.642445][T11061] MTD: Couldn't look up '/dev/rnullb0': -15
[  263.403340][T11073] /dev/rnullb0: Can't lookup blockdev
[  263.458744][T11039] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1534'.
[  263.560757][   T30] audit: type=1804 audit(1756699353.126:280): pid=11085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1551" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  263.614922][   T30] audit: type=1804 audit(1756699353.186:281): pid=11092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1553" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  263.656618][T11083] /dev/rnullb0: Can't lookup blockdev
[  263.701343][T11093] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1553'.
[  263.710552][T11093] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1553'.
[  263.720314][T11093] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1553'.
[  263.774376][ T6171] usb 2-1: new high-speed USB device number 66 using dummy_hcd
[  263.924118][ T6171] usb 2-1: Using ep0 maxpacket: 16
[  263.930745][ T6171] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  263.941936][ T6171] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  263.955012][ T6171] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  263.964302][ T5980] usb 4-1: new high-speed USB device number 66 using dummy_hcd
[  263.972016][ T6171] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  263.981957][ T6171] usb 2-1: config 0 descriptor??
[  264.012621][T11095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  264.022235][T11095] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  264.104181][ T5980] usb 4-1: device descriptor read/64, error -71
[  264.354893][ T5980] usb 4-1: new high-speed USB device number 67 using dummy_hcd
[  264.413885][T11097] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  264.485432][ T5980] usb 4-1: device descriptor read/64, error -71
[  264.585642][T11105] netlink: 165 bytes leftover after parsing attributes in process `syz.0.1558'.
[  264.596958][ T5980] usb usb4-port1: attempt power cycle
[  264.796816][T11115] /dev/rnullb0: Can't lookup blockdev
[  264.954391][ T5980] usb 4-1: new high-speed USB device number 68 using dummy_hcd
[  264.978500][ T6171] usbhid 2-1:0.0: can't add hid device: -71
[  264.986343][ T6171] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  264.995171][ T5980] usb 4-1: device descriptor read/8, error -71
[  265.000398][T11121] tmpfs: Unknown parameter 'grpquota_block_hardli'
[  265.005074][ T6171] usb 2-1: USB disconnect, device number 66
[  265.019437][T11121] overlay: ./file0 is not a directory
[  265.026279][T11121] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  265.035397][T11121] overlayfs: missing 'lowerdir'
[  265.066904][T11123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  265.076226][T11123] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  265.134160][ T5926] usb 5-1: new high-speed USB device number 32 using dummy_hcd
[  265.254299][ T5980] usb 4-1: new high-speed USB device number 69 using dummy_hcd
[  265.275116][ T5980] usb 4-1: device descriptor read/8, error -71
[  265.304176][ T5926] usb 5-1: Using ep0 maxpacket: 32
[  265.312378][ T5926] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[  265.321882][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  265.330014][ T5926] usb 5-1: Product: syz
[  265.334498][ T5926] usb 5-1: Manufacturer: syz
[  265.339258][ T5926] usb 5-1: SerialNumber: syz
[  265.345711][ T5926] usb 5-1: config 0 descriptor??
[  265.352994][ T5926] gspca_main: stk1135-2.14.0 probing 174f:6a31
[  265.384440][ T5980] usb usb4-port1: unable to enumerate USB device
[  265.530999][T11125] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1564'.
[  265.542735][   T59] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  265.709631][T11135] /dev/rnullb0: Can't lookup blockdev
[  265.907682][T11151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  265.922352][T11151] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  266.483842][T11164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  266.496016][T11164] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  266.770044][T11117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  266.785101][T11117] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  267.069098][T11172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  267.104466][T11172] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  267.140237][T11172] /dev/rnullb0: Can't lookup blockdev
[  267.464235][   T24] usb 4-1: new high-speed USB device number 70 using dummy_hcd
[  267.624261][   T24] usb 4-1: Using ep0 maxpacket: 8
[  267.633001][   T24] usb 4-1: unable to get BOS descriptor or descriptor too short
[  267.642218][   T24] usb 4-1: config 59 has an invalid interface number: 141 but max is 0
[  267.654205][   T24] usb 4-1: config 59 has no interface number 0
[  267.661342][   T24] usb 4-1: config 59 interface 141 altsetting 6 endpoint 0xC has an invalid bInterval 160, changing to 11
[  267.689151][   T24] usb 4-1: config 59 interface 141 has no altsetting 0
[  267.699435][   T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 0.72
[  267.711575][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  267.720817][   T24] usb 4-1: Product: syz
[  267.727129][   T24] usb 4-1: Manufacturer: syz
[  267.732101][   T24] usb 4-1: SerialNumber: syz
[  267.795260][T11177] tipc: New replicast peer: 0.0.0.0
[  267.801139][T11177] tipc: Enabled bearer <udp:syz2>, priority 10
[  267.809755][T11177] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0000
[  267.821249][T11177] /dev/rnullb0: Can't lookup blockdev
[  267.981068][T11184] /dev/rnullb0: Can't lookup blockdev
[  268.420174][T11117] /dev/rnullb0: Can't lookup blockdev
[  268.435158][ T5926] gspca_stk1135: reg_w 0x352 err -71
[  268.442601][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.461638][ T5926] gspca_stk1135: Sensor write failed
[  268.474073][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.480591][ T5926] gspca_stk1135: Sensor write failed
[  268.487075][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.493651][ T5926] gspca_stk1135: Sensor read failed
[  268.500665][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.508913][ T5926] gspca_stk1135: Sensor read failed
[  268.514531][ T5926] gspca_stk1135: Detected sensor type unknown (0x0)
[  268.523507][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.532883][ T5926] gspca_stk1135: Sensor read failed
[  268.540190][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.540281][T11211] evm: overlay not supported
[  268.548345][ T5926] gspca_stk1135: Sensor read failed
[  268.554842][T11211] /dev/rnullb0: Can't lookup blockdev
[  268.556976][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.585632][ T5926] gspca_stk1135: Sensor write failed
[  268.594807][ T5926] gspca_stk1135: serial bus timeout: status=0x00
[  268.601489][ T5926] gspca_stk1135: Sensor write failed
[  268.610483][ T5926] stk1135 5-1:0.0: probe with driver stk1135 failed with error -71
[  268.621279][ T5926] usb 5-1: USB disconnect, device number 32
[  268.651277][   T30] audit: type=1804 audit(1756699358.216:282): pid=11214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1592" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  268.870368][T11225] can0: slcan on ptm1.
[  268.880443][T11225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  268.890408][T11225] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  268.904634][T11225] /dev/rnullb0: Can't lookup blockdev
[  269.004307][T11224] can0 (unregistered): slcan off ptm1.
[  269.391459][T11248] XFS (nullb0): Invalid superblock magic number
[  269.428063][T11248] /dev/rnullb0: Can't lookup blockdev
[  269.804151][   T24] usbtest 4-1:59.141: couldn't get endpoints, -71
[  269.810753][   T24] usbtest 4-1:59.141: probe with driver usbtest failed with error -71
[  269.854404][   T24] usb 4-1: USB disconnect, device number 70
[  269.921021][T11278] MTD: Couldn't look up '/dev/rnullb0': -15
[  269.952001][T11282] syzkaller1: entered promiscuous mode
[  269.967970][T11282] syzkaller1: entered allmulticast mode
[  270.115958][ T5980] usb 5-1: new low-speed USB device number 33 using dummy_hcd
[  270.150089][T11296] tmpfs: Bad value for 'mpol'
[  270.294711][ T5980] usb 5-1: Invalid ep0 maxpacket: 16
[  270.424186][ T5980] usb 5-1: new low-speed USB device number 34 using dummy_hcd
[  270.494190][ T5905] usb 4-1: new high-speed USB device number 71 using dummy_hcd
[  270.574451][ T5980] usb 5-1: Invalid ep0 maxpacket: 16
[  270.581072][ T5980] usb usb5-port1: attempt power cycle
[  270.654192][ T5905] usb 4-1: Using ep0 maxpacket: 8
[  270.661962][ T5905] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1024, setting to 64
[  270.674067][ T5905] usb 4-1: config 0 interface 0 has no altsetting 0
[  270.683615][ T5905] usb 4-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e
[  270.693325][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  270.702354][ T5905] usb 4-1: Product: syz
[  270.706694][ T5905] usb 4-1: Manufacturer: syz
[  270.711310][ T5905] usb 4-1: SerialNumber: syz
[  270.721293][ T5905] usb 4-1: config 0 descriptor??
[  270.730544][ T5905] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 found
[  270.741002][   T30] audit: type=1804 audit(1756699360.306:283): pid=11304 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1610" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  270.932041][ T5905] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 now disconnected
[  270.942467][ T5980] usb 5-1: new low-speed USB device number 35 using dummy_hcd
[  270.951969][ T5905] snd_usb_toneport 4-1:0.0: probe with driver snd_usb_toneport failed with error -22
[  270.976558][ T5980] usb 5-1: Invalid ep0 maxpacket: 16
[  270.983601][   T30] audit: type=1804 audit(1756699360.546:284): pid=11317 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1615" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  271.029913][T11319] /dev/rnullb0: Can't lookup blockdev
[  271.035215][   T24] usb 2-1: new low-speed USB device number 67 using dummy_hcd
[  271.089707][T11324] syzkaller1: entered promiscuous mode
[  271.097106][T11324] syzkaller1: entered allmulticast mode
[  271.106288][T11324] MTD: Couldn't look up '/dev/rnullb0': -15
[  271.114519][ T5980] usb 5-1: new low-speed USB device number 36 using dummy_hcd
[  271.155433][ T5980] usb 5-1: Invalid ep0 maxpacket: 16
[  271.161257][ T5980] usb usb5-port1: unable to enumerate USB device
[  271.196843][   T24] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb
[  271.207102][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  271.219183][T11326] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  271.225422][   T24] usb 2-1: config 0 descriptor??
[  271.379739][T11328] /dev/rnullb0: Can't lookup blockdev
[  271.485451][T11330] /dev/rnullb0: Can't lookup blockdev
[  271.519082][T11334] /dev/rnullb0: Can't lookup blockdev
[  271.561305][ T5187] Bluetooth: hci0: SCO packet for unknown connection handle 0
[  272.429907][T11341] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  272.657376][T11356] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  272.754924][T11359] MTD: Couldn't look up '/dev/rnullb0': -15
[  272.761156][T11359] /dev/rnullb0: Can't lookup blockdev
[  272.771953][T11359] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  272.777041][T11361] /dev/rnullb0: Can't lookup blockdev
[  272.786441][T11359] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1629'.
[  272.840030][T11364] /dev/rnullb0: Can't lookup blockdev
[  272.843046][T11365] /dev/rnullb0: Can't lookup blockdev
[  272.893030][   T30] audit: type=1804 audit(1756699362.456:285): pid=11367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1633" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  272.923143][T11369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  272.938193][T11369] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  273.032473][T11371] /dev/rnullb0: Can't lookup blockdev
[  273.105879][T11379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  273.119647][T11379] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  273.274602][T11383] /dev/rnullb0: Can't lookup blockdev
[  273.281733][ T5980] usb 4-1: USB disconnect, device number 71
[  273.290791][T11381] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[  273.370193][T11391] /dev/rnullb0: Can't lookup blockdev
[  273.470641][T11397] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1642'.
[  273.744115][ T5980] usb 4-1: new full-speed USB device number 72 using dummy_hcd
[  273.849371][T11410] /dev/rnullb0: Can't lookup blockdev
[  273.916057][ T5980] usb 4-1: config 0 has an invalid interface number: 139 but max is 0
[  273.934993][ T5980] usb 4-1: config 0 has no interface number 0
[  273.953716][ T5980] usb 4-1: config 0 interface 139 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  273.974804][ T5980] usb 4-1: config 0 interface 139 altsetting 0 has an endpoint descriptor with address 0xBD, changing to 0x8D
[  273.987510][ T5980] usb 4-1: config 0 interface 139 altsetting 0 endpoint 0x8D has invalid maxpacket 14158, setting to 64
[  274.006131][ T5980] usb 4-1: config 0 interface 139 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  274.025818][ T5980] usb 4-1: New USB device found, idVendor=0711, idProduct=0210, bcdDevice=fd.d6
[  274.036463][ T5980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  274.045801][ T5980] usb 4-1: Product: syz
[  274.050247][ T5980] usb 4-1: Manufacturer: syz
[  274.057678][ T5980] usb 4-1: SerialNumber: syz
[  274.063418][T11424] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1649'.
[  274.074710][T11421] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1649'.
[  274.084846][T11424] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1649'.
[  274.085013][ T5980] usb 4-1: config 0 descriptor??
[  274.098926][T11421] /dev/rnullb0: Can't lookup blockdev
[  274.105000][T11395] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  274.115249][T11395] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  274.165482][T11426] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1650'.
[  274.176512][T11426] nft_compat: unsupported protocol 5
[  274.382353][ T5980] mct_u232 4-1:0.139: MCT U232 converter detected
[  274.405044][ T5980] usb 4-1: MCT U232 converter now attached to ttyUSB0
[  274.411952][ T5980] usb 4-1: USB disconnect, device number 72
[  274.418771][ T5980] mct_u232 ttyUSB0: MCT U232 converter now disconnected from ttyUSB0
[  274.419158][ T5980] mct_u232 4-1:0.139: device disconnected
[  274.448644][T11428] ./cgroup: Can't lookup blockdev
[  274.521960][   T30] audit: type=1804 audit(1756699364.086:286): pid=11430 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1651" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  274.764178][ T5926] usb 5-1: new high-speed USB device number 37 using dummy_hcd
[  274.892547][T11435] input: syz1 as /devices/virtual/input/input21
[  274.916993][ T5926] usb 5-1: Using ep0 maxpacket: 16
[  274.927413][ T5926] usb 5-1: unable to get BOS descriptor or descriptor too short
[  274.938359][ T5926] usb 5-1: config 8 has an invalid interface number: 172 but max is 0
[  274.948094][ T5926] usb 5-1: config 8 has no interface number 0
[  274.954358][ T5926] usb 5-1: config 8 interface 172 has no altsetting 0
[  274.963259][ T5926] usb 5-1: New USB device found, idVendor=0499, idProduct=1020, bcdDevice=d0.bf
[  274.972785][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  274.981189][ T5926] usb 5-1: Product: syz
[  274.986100][ T5926] usb 5-1: Manufacturer: syz
[  274.991315][ T5926] usb 5-1: SerialNumber: syz
[  275.154213][   T24] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71
[  275.172395][   T24] asix 2-1:0.0: probe with driver asix failed with error -71
[  275.177213][T11442] /dev/rnullb0: Can't lookup blockdev
[  275.186612][   T24] usb 2-1: USB disconnect, device number 67
[  275.231412][ T5926] usb 5-1: Quirk or no altset; falling back to MIDI 1.0
[  275.279107][ T5926] snd-usb-audio 5-1:8.172: probe with driver snd-usb-audio failed with error -2
[  275.299039][ T5926] usb 5-1: USB disconnect, device number 37
[  275.329016][ T9835] udevd[9835]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:8.172/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  275.378297][T11450] /dev/rnullb0: Can't lookup blockdev
[  275.613397][T11456] /dev/rnullb0: Can't lookup blockdev
[  275.752986][T11458] /dev/rnullb0: Can't lookup blockdev
[  275.775767][ T3477] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  275.825273][T11460] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  275.851917][ T3477] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  275.925252][ T3477] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  276.074244][ T5980] usb 5-1: new high-speed USB device number 38 using dummy_hcd
[  276.119053][ T3477] bridge_slave_1: left allmulticast mode
[  276.133062][ T3477] bridge_slave_1: left promiscuous mode
[  276.140315][ T3477] bridge0: port 2(bridge_slave_1) entered disabled state
[  276.149540][ T3477] bridge_slave_0: left allmulticast mode
[  276.156770][ T3477] bridge_slave_0: left promiscuous mode
[  276.163372][ T3477] bridge0: port 1(bridge_slave_0) entered disabled state
[  276.221798][ T5187] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  276.231219][ T5187] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  276.234134][ T5980] usb 5-1: Using ep0 maxpacket: 32
[  276.249381][ T5187] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  276.250239][T11475] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null.
[  276.269746][ T5187] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  276.272213][T11475] overlayfs: missing 'lowerdir'
[  276.282540][ T5187] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  276.286759][ T5980] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f
[  276.299227][ T5980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  276.318349][ T5980] usb 5-1: Product: syz
[  276.331180][ T5980] usb 5-1: Manufacturer: syz
[  276.349401][ T5980] usb 5-1: SerialNumber: syz
[  276.363981][ T5980] usb 5-1: config 0 descriptor??
[  276.394502][ T3477] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  276.406484][ T3477] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  276.426829][ T3477] bond0 (unregistering): Released all slaves
[  276.441553][T11482] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
[  276.453676][T11482] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
[  276.462390][T11482] CPU: 1 UID: 0 PID: 11482 Comm: syz.3.1669 Not tainted syzkaller #0 PREEMPT(full) 
[  276.472152][T11482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  276.482869][T11482] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0
[  276.488584][T11482] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 d9 85 2b f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 b8 85 2b f9 4d 8b 24 24 48 83 c3
[  276.508929][T11482] RSP: 0018:ffffc9000ad1fa40 EFLAGS: 00010206
[  276.515020][T11482] RAX: 0000000000000005 RBX: ffff8880335ee080 RCX: 0000000000080000
[  276.523213][T11482] RDX: ffffc9000cb45000 RSI: 00000000000003b1 RDI: 00000000000003b2
[  276.531313][T11482] RBP: 0000000000000000 R08: ffff88814ca1592f R09: 1ffff11029942b25
[  276.539841][T11482] R10: dffffc0000000000 R11: ffffffff88f8cd30 R12: 0000000000000028
[  276.548099][T11482] R13: dffffc0000000000 R14: ffff88814ca15800 R15: dffffc0000000000
[  276.556379][T11482] FS:  00007f88b88b36c0(0000) GS:ffff8881258c4000(0000) knlGS:0000000000000000
[  276.565419][T11482] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  276.572374][T11482] CR2: 000000110c3e45c9 CR3: 0000000072990000 CR4: 00000000003526f0
[  276.580547][T11482] Call Trace:
[  276.583921][T11482]  <TASK>
[  276.586854][T11482]  pcl818_detach+0x66/0xd0
[  276.591318][T11482]  comedi_device_detach_locked+0x175/0x750
[  276.597396][T11482]  ? security_capable+0x7e/0x2e0
[  276.602599][T11482]  comedi_unlocked_ioctl+0xcde/0x1020
[  276.607984][T11482]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[  276.613967][T11482]  ? tomoyo_path_number_perm+0x47a/0x5a0
[  276.619618][T11482]  ? do_futex+0x395/0x420
[  276.624059][T11482]  ? __se_sys_futex+0x36f/0x400
[  276.629121][T11482]  ? __fget_files+0x3a0/0x420
[  276.633999][T11482]  ? __fget_files+0x2a/0x420
[  276.638647][T11482]  ? bpf_lsm_file_ioctl+0x9/0x20
[  276.643749][T11482]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[  276.649751][T11482]  __se_sys_ioctl+0xf9/0x170
[  276.654819][T11482]  do_syscall_64+0xfa/0xfa0
[  276.659465][T11482]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  276.665577][T11482]  ? clear_bhb_loop+0x60/0xb0
[  276.670536][T11482]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  276.676443][T11482] RIP: 0033:0x7f88b798ebe9
[  276.680859][T11482] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  276.700659][T11482] RSP: 002b:00007f88b88b3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  276.709255][T11482] RAX: ffffffffffffffda RBX: 00007f88b7bc5fa0 RCX: 00007f88b798ebe9
[  276.717254][T11482] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 000000000000000a
[  276.725320][T11482] RBP: 00007f88b7a11e19 R08: 0000000000000000 R09: 0000000000000000
[  276.733409][T11482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  276.741639][T11482] R13: 00007f88b7bc6038 R14: 00007f88b7bc5fa0 R15: 00007fffdccc5cb8
[  276.750238][T11482]  </TASK>
[  276.753345][T11482] Modules linked in:
[  276.759902][T11482] ---[ end trace 0000000000000000 ]---
[  276.782058][ T5980] airspy 5-1:0.0: usb_control_msg() failed -71 request 09
[  276.793020][   T30] audit: type=1804 audit(1756699366.346:287): pid=11460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1662" name="/newroot/dev/rnullb0" dev="devtmpfs" ino=2902 res=1 errno=0
[  276.813279][T11472] wlan1 speed is unknown, defaulting to 1000
[  276.834124][T11482] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0
[  276.835688][ T5980] airspy 5-1:0.0: Could not detect board
[  276.846773][T11482] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 d9 85 2b f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 b8 85 2b f9 4d 8b 24 24 48 83 c3
[  276.872261][ T5980] airspy 5-1:0.0: probe with driver airspy failed with error -71
[  276.922112][T11482] RSP: 0018:ffffc9000ad1fa40 EFLAGS: 00010206
[  276.931295][ T5980] usb 5-1: USB disconnect, device number 38
[  276.942985][   T10] wlan1 speed is unknown, defaulting to 1000
[  276.954463][   T10] syz0: Port: 1 Link DOWN
[  276.959165][ T6171] wlan1 speed is unknown, defaulting to 1000
[  276.984905][T11482] RAX: 0000000000000005 RBX: ffff8880335ee080 RCX: 0000000000080000
[  277.020296][T11482] RDX: ffffc9000cb45000 RSI: 00000000000003b1 RDI: 00000000000003b2
[  277.031330][T11482] RBP: 0000000000000000 R08: ffff88814ca1592f R09: 1ffff11029942b25
[  277.049761][T11482] R10: dffffc0000000000 R11: ffffffff88f8cd30 R12: 0000000000000028
[  277.075088][T11482] R13: dffffc0000000000 R14: ffff88814ca15800 R15: dffffc0000000000
[  277.093205][T11482] FS:  00007f88b88b36c0(0000) GS:ffff8881258c4000(0000) knlGS:0000000000000000
[  277.104709][T11482] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  277.111525][T11482] CR2: 00007fc47430b368 CR3: 0000000072990000 CR4: 00000000003526f0
[  277.120343][T11482] Kernel panic - not syncing: Fatal exception
[  277.127511][T11482] Kernel Offset: disabled
[  277.132136][T11482] Rebooting in 86400 seconds..