last executing test programs: 13m23.498096626s ago: executing program 1 (id=1215): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x1}], 0x1}}], 0x1, 0x80) r2 = dup3(r1, r0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac404000000afb9fdd672bad09dfb78c7699c74e891a0c7fffffffffffffff5000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) recvmmsg$unix(r2, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000005140)=""/4111, 0x100f}], 0x1}}], 0x1, 0x58ca2280, 0x0) 13m23.341963903s ago: executing program 1 (id=1217): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r1, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd000012000000003b000060fc03000f982c"], 0xfce) 13m23.153968921s ago: executing program 1 (id=1220): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="05052cb57000ff5a6a002c00000608000300", @ANYRES32=r2], 0x20}, 0x1, 0x0, 0x0, 0x4004095}, 0x4008000) 13m23.120822801s ago: executing program 1 (id=1221): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0xcc, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x38, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}}]}]}, 0xcc}, 0x1, 0x0, 0xfffffff5}, 0x0) 13m23.012890665s ago: executing program 1 (id=1223): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x68}}, 0x0) r1 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r1, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001640)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ceb4a06ff270ff8c9f0d3a19133f1fdfd51b767b8cef1f36e5490c5df5fcb378a6fb6eb5d8aaf7791ce81f61a05e1ebdd1789eb70ac1f3dfed378f6f3e237120052113a75ab977796117f7e7b2d6ee499f51dc070c820d10a0eaef4fc94ddc648bafae070caf70c465267497b3de963df649e113e2060c82b057abfae0798d424c81aeb42796189eb0936a2c547a5c4d6351ed786c75beb926118fb7af49ecc00b545fe2563bd4294a982980afed3f9cf390f304611db4c6d7b64d64f38db5fde5cf7cadb29c697013b710e0218660671d0051ddd7fb7f5eb72a34f469b2e20600000091817eb5b952af43d1a40f4770e7220fcdfe25d3e9747e2af76ece5922724840afdba6f6f9e1d11db8561e8e836413ee04d6e084700ec1ac0e00569f0e4d4844f4710299aabbef615c33e276544669ce074528938ec0cc6d2af1ce7a47a64ad676f08507aa08d4210f979ef4aacfa4d524c9952d4743d65c3c527302942a8880116ce7ebc6c84778346f02c806bb466db7d313d7ebc7ea87823d4a8de0b697929fb3277012327827801f75ca3c5776d1a81acb160007f73148dfaf05ab7eed5a0e603ac468eb2bcd9de5f140758e74c20a9931187e0cbc857aa62a4cec8a62f7e31af3a78cdb8608551cdd68e83aebb3c9e05519184ff996c336553fa6bf16865cd6c4eacf1e360b029cdae41070f569a15bfd30f671c0a2fd183ea0eaae427505d56994ccfd0737aae3abbc45f56710d2e3f2662bf4514044f7fa03cde28fa1783970d3c676cb23cb1923a9feb233267ef663936ccf25f7597a2270724527bf468d22786d0548b25582180b72c51742c4e5c373a1008dd4cfba508e8f3f8ec35e6f1375a11b1fbe2dc09e9fe609e80112c8f5c895c922cd547def707b7252d7afa0030d008b1dd10fd4a56e30237a6e0229fb4562cb8df3d4e64b28e15c075e59554e9d61a6065d49c1e765a49195cf5d6b1e2b6192447817fedfe41fcdf9a4fc5af567906e4b6453da7b97eac255cc253d7bceba09f67da4815438583c6843366b76d9e9277558e48681e9cfa920b47aea0e5c46ef86ea7f1ef534cf7565b24b833ba2cbfe60e6271614850dd68f2a8a6be4f315b83abb8e2699ed8e2a4b3506f9dacbb180c4deeef7489f49faf34cdf4e91a402956564f854d71c892e4aada1c91647ce45d4834d000e8d5be1773ecae388e511228977a69d4cc67fbab60ee1555a219e41eebc31807a87d9cbe88a8b05959e1a988f6ea6ed73a6ac1ec2f3d74d73eaa91a39308e008b7fa1ecc2a020d950a777c0d8d131416ef55a4ec041113df65ba4aea92fcb3e2268510f316bd17f04993b6473338fe7c08fd9874e743a31582162232c7d6c614e7b3513abcc0feb99b2c9111300004fe291f5bd682c039183e61c1fdac90b2a015939a8d10b07a05e99e5772b4b9329275cef8de2b066d4e4d421e4a0a69cdd8f674b12f5b3fa764e4b1e9f4d767e252e37577813a03f18da16d598fddcf4be590d9f65f64c647cb2f330a614fe688d3d80182ed8aa59905a1cb0d3f034d927e070d71f56ee8e5c5bdf23c4f85c7a17834467bd6cf58218868fe53e3675c130bbe44bea271fa67999a0dc3dbf7c40dbba6e7d6cc0936bd8d466a1f041883c093a3a60743d0549b1a989a2fa41ff978388014434909053e279a21e7866bd4efb4a9f46b7a8b0d1d84d83020e9e68936ca3de030269784aa29a3e25146cd5b03d21ca82f961be925c9ad487fb24b1e35c2d043ee4b6a4aaf811c4308a6ced6b4c45e7513a3f0e1421cb3b0fd8571a7085c9a4b454e4ee8b44767428666cd108b78369b871ab32f36943e24976f4bb6bd4068cc19585a2de791e3f950d220b28f4ba268d8c9dbccc1a705b1b1c30881babdbc8cc4cf97b801e4d410fd7c61b34b1f1265b9d114c99fb469914a213bb289c5bdf5af3835d089a2300"/1504, 0x5e0}, {&(0x7f0000000600)="3001fb90647586f4601659c5ad2644b99bfd65452e947b394c96c29278d097c5f170d77283a744139d2ce2a2f4bb5bb37e7396e7bac14056f25d17145e73bc246104000000000000002d1585e8a456763cfafcf7189145a6e261af6232014cbf8a0f898bf6d14136874b6a1fd7caf8ec9966b0419be0420dc6e247dfb7715ebafaa20fcbc57ade23cba05da1fbe4bba675b742472eebaabf356adc99866930e146125a272cef5baf5dfad4a28a01208d9908183ab2085a781e531f1bed4ac9c245ec19be383047656a7d857d364e6f69eccea5aca3964f", 0xd7}, {&(0x7f0000000b00)="79dfe4263f037de282e588f3c773eca5f0c383e7425d1573aa90a44223bfeced3ff85afe9d0c0b3b5a7ed7fcdb96a3934fe7af73ee25d5d36ba42e2a858c3d134299abc0393e031db435b2156e55eb2b2b2e0300e0706dfc5c4ec73ba929ffe8a7bb7ce55d95fb6e58560c45d96a58a13aa944b98c481a82927ec071b272b4592616116116527fd2dbc0dfd540810275770aa531098c572f714f6852063afc8358fb33cc7ef5c52565d586cfe6805bb8a95460b32b4e26bea604e534d8983790b5e2a180fed88108b0f5a499d5f80b4e4047d9ecc03d21856a4ec0d0d41496d99dddfa9098d327d9559e82fceb2b1b1c7be309200691488d6616780cd4e9020865ef41a22175dc52d35dac1232ae1164d7fee64a50651978436207fca4a9026a8a903e7857324459b7e8a143e6fdac0823c8d1a3ac864ad2d0402344aee2511247e716436fe118e65455da74ef25627785638dfa4bf365840fe12fbf73f0d42bcc66efc8693855156f6151e49471e1b7cccbfb01344f76cca177551c73147c32615b53f74a0b7c7ac25b86a01ce3", 0x18e}, {&(0x7f0000000cc0)="f2a0f0f863621b483b19e7ecfce0d34e53fbf295927214684f4d69e90f0ec506442d2126c3f5ab0cdfd79dc1815274c3ee57068b3793c25fab48eb353478689f452328afb023f75f93229060bc2c82dd05d1e8c3a549a06e280ca4eaf77b4aed57a0c5f6120d25a3d5121895638ec5e2e600000000f5be12a64e075c60dd63e0b00e8f42bfb7671a56925477029cec7e7f16b358404edfb5e7a055fdeb2ba044d0d54e341d1d1ef1eb2c317f587f591626ceed08555ca0b2f31a3e7bf5ba7541db275e6a6b6501b87cc74c4804f6da7d3de93327287204cc97f9cb747576d2ab23a6e35c6da6b3240c92ae18b31cb6e7bc60066994e2cb401c76b1840d3e231621355f10ff35ea91ffd463228d000000000000000e454d3c36efee949f6311c6ad78b5a8f091d2ebb008925107e4a4584dab83f7f0cb5ad94266e71e2b7aaa01cf4f9f5e1d52e1e5086e9633cbee8126a200"/349, 0x15d}, {&(0x7f0000000700)="15c84609b06c6d85a5ca6f3a9a242f214aee4e7093161b717090c0c852a05393abd8992d91576f57bbd3488e85d8456d6c6c09de5c5228ee18819665861f01a2823a7cfa8e9260a5fe3921638db2dc5156149f86916810f913a944e1c8cd7fccb63f5b287016e512b050ca214125b2217260c9ce3019e88b80985402ff7ca34be17e0dbda4f028cec9973a2b9eed83eee86f35f2c0adf50a04296e99c0f709fb3990", 0xa2}], 0x5, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x20}, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x0, 0x6) r3 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x3a09007, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='./file0/../file0/../file0\x00') syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000001000)={0x44, &(0x7f0000000040)=ANY=[@ANYRES64=r2, @ANYRES8=r3, @ANYRESOCT=r2, @ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 13m21.21679524s ago: executing program 1 (id=1236): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x800) socket$igmp(0x2, 0x3, 0x2) creat(&(0x7f0000001380)='./file0\x00', 0x12c) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000001c0)) socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000f50000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r1], 0xc4}}, 0x0) 13m4.811417038s ago: executing program 32 (id=1236): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x800) socket$igmp(0x2, 0x3, 0x2) creat(&(0x7f0000001380)='./file0\x00', 0x12c) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000001c0)) socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000f50000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r1], 0xc4}}, 0x0) 12m26.54954157s ago: executing program 0 (id=1595): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x7, 0x15, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000200472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a2b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6d07002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f63520cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000000000000000000000000000000000000000000200"}) 12m26.381616627s ago: executing program 0 (id=1596): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40c0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000003000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 12m26.324772144s ago: executing program 0 (id=1597): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x0, 0x0}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x1, r1}) 12m26.239297808s ago: executing program 0 (id=1598): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) (async) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000002200)={r2, @in6={{0xa, 0x4e23, 0x0, @private0, 0xfffffffd}}}, &(0x7f0000000040)=0x84) (async) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000140)="0200000009800089", 0x8) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x3000000) (async) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) (async) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000140)='./file0\x00', 0x0, 0x200000, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) (async) mount$bpf(0x200000002000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) (async) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102cab4c508720c14008a570102030109022400010b00e0090904f405021df45208090503"], &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1, 0xffffffff, 0x11) (async) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xa2000) ioctl$SG_GET_VERSION_NUM(r4, 0x2282, &(0x7f0000000080)) (async) mprotect(&(0x7f00001ad000/0x3000)=nil, 0x3000, 0x0) (async) close(r4) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) (async) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000300)={0x5, 0xa34, 0x0, &(0x7f00000022c0)="a1984ec3aec3fc2e025f90eda6dbc901cf9aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b2cb48968dc188fc75ac1f7e8add6d8d982c4929300572f084dd207eec0794b3e47c5678c36b99ed061e1dbac68ce8a79aa21a51202018bdc4a51480000f785887083a9847d2bdede66c6e3184c386f250bfc3d9f25a1686636d34ba06435061ece6676795a6d2e45b7c7248e55c4c2ca0652a13b6f24201ad38470579f00002bf55359c987bb9d5ad90bb1c04aa6206b82d149d6235b785279facc643e38c4889101fada72eea245388eb0ada2b9e7a4de913593b0f2dae60000e0406f6be5529b2296106bb5c370b35d3991ce31dd5d5d4b0ada860df8db9216f8e756895b6777f0fbecdc00dbac55241cf9befc3c205584268ac2e5e8a9ac4cfa893cd1ee9c35c0460a5276c0029df3f5042be889850000000000000000000000000000d46c707efb93a913796b75f82657e91df3145084514a0d6ff5cc981f155c8b1a14e9af0147a154408aa379148382811b80b1699a5df0cc25823faeb5e1fa3036e01aae5a66a3d77d41bae44303e95976866085cba4125ff77ecaf830049f6b5d5f93acca5d82eba77416427fdb59535e3c78a46d5f58e2f36bb73e4c21afecbc77088c10d9cb0cfc50c567d374ab209f97733d82b8", 0x0, 0x1f3}) (async) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x1, 0x1, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d000018000000000000000000000005000600002000000a00004000000000fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000000000000000000000200120002000200000000000000000006003200000000000000000000000000fe880000000000000000000000000001ac141432000000000000000000000000040003"], 0xc0}}, 0x8000) 12m24.905140701s ago: executing program 0 (id=1605): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x81}]}, 0x10) sendto(r0, &(0x7f0000000900)="50fbdf12a30d7a48b2c5c84948f3426077a9f0ca1475183db3ae52a6b2cdb77ef9af2a603a3e78e0355c09f3bdec242443011f0101251bcef800000000000000006dd50205000000a335445845ad1eaedbe2a4242113527efa170af26f1725", 0x5f, 0x4008044, 0x0, 0x0) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b4d73ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x0, 0x0, 0x0) 12m24.657212267s ago: executing program 0 (id=1610): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x20a, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x98, 0x0, &(0x7f0000003200)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xf0}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1472, 0x0, 0x0, 0x0, 0xff8, 0x0, &(0x7f00000031c0)={0x30, 0x30, 0x1e}}}], 0x0, 0x0, 0x0}) 12m24.406446006s ago: executing program 33 (id=1610): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x20a, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x98, 0x0, &(0x7f0000003200)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xf0}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1472, 0x0, 0x0, 0x0, 0xff8, 0x0, &(0x7f00000031c0)={0x30, 0x30, 0x1e}}}], 0x0, 0x0, 0x0}) 4m37.637256426s ago: executing program 3 (id=5106): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x202, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080b01000000e8fe55a1180015000600142603600e120800180000000401080016000a00014006001000036010fa", 0x40}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000000206010800000000000000000000fffd14000780080011400000000005001500010000000500010006000000050005000a000000050004"], 0x60}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500211dff000401a8001600a400014020", 0x39}], 0x1}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfe33) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r4) ioctl$DRM_IOCTL_MODE_ADDFB2(r4, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0xfffffff7, 0x34325241, 0x0, [], [0x2b8], [0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x1]}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x0, 0x3, 0x5000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x52, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="f00fc7484d36f08266060266b9800000c00f326635000400000f308bc1de780066b9aa0200000fb266b9ab0900000f32f2f031b3e759dc2c", 0x38}], 0x1, 0x9f6a364b3fac2a73, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4m37.484570405s ago: executing program 3 (id=5107): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000000c0)="ce1b", 0x2}], 0x1}}], 0x1, 0x24008054) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e9000009", @ANYRESDEC], 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="001c86dd2000100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000001200000001"], 0xffe) 4m36.000115244s ago: executing program 3 (id=5110): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) (async) r1 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r1, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x8282) (async) syz_io_uring_setup(0x2af8, &(0x7f0000000380)={0x0, 0xffffffff, 0x8}, 0x0, 0x0, &(0x7f0000000000)) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) (async) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) (async) syz_usb_connect$uac1(0x5, 0x11f, &(0x7f0000001080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0xe41, 0x424a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10d, 0x3, 0x1, 0x0, 0x10, 0xff, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x3c}, [@input_terminal={0xc, 0x24, 0x2, 0x5, 0x403, 0x1, 0x2, 0x3e3, 0x4, 0x16}, @selector_unit={0x5, 0x24, 0x5, 0x2, 0x81}, @processing_unit={0x8, 0x24, 0x7, 0x6, 0x1, 0x7, "82"}, @mixer_unit={0x6, 0x24, 0x4, 0x6, 0x1, ','}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x4, 0x4}, @extension_unit={0xc, 0x24, 0x8, 0x5, 0x0, 0x7, "70f939a6b4"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x9c, 0xc, 0x68, 0xfb}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x6, 0x3, 0x3, 0xc7, "", '#'}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x8, 0x4, 0x10, 0x6, "55f1"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x1, 0xfffb, 0x81, 0x6}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5a, 0x1, 0xf0, 0xa, 0x52}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x8, 0x2, 0x2, {0x7, 0x25, 0x1, 0xc, 0x40, 0xb}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x8, 0x101, 0xc, "3b35045d80d78b55d2"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x8, 0x3, 0x7, 0x6a, "", "1ff9f9"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x0, 0x200, 0x6, "7a24961164"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x1, 0x9, 0x9, 0x3}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x7, 0x5, 0x4, "a349e2f54c"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x3, 0x96, 0x8, 0x5, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x7, 0x6, 0x9, {0x7, 0x25, 0x1, 0xc, 0x2, 0x5}}}}}}}}]}}, &(0x7f0000001280)={0xa, &(0x7f00000011c0)={0xa, 0x6, 0x300, 0x2, 0x0, 0xa, 0x20, 0x2}, 0x23, &(0x7f0000001200)={0x5, 0xf, 0x23, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x40, 0x2, 0xa}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x0, 0x49, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x5e, 0xff, 0x5}]}, 0x1, [{0x4, &(0x7f0000001240)=@lang_id={0x4, 0x3, 0x400a}}]}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7) sendmsg$NFC_CMD_DEV_UP(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r8, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)={0x2c, r4, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x2b, 0x1, r6}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48014}, 0x8080) (async) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f0000000100)={{0x0, 0x4}, {0x0, 0xe}, 0x80, 0x4, 0x8}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000300)={0xd017, "c6ac4700cb0f3a90f165756105ff1278f61fb5875bd76664359f647677f4d605", 0xffffffffffffffff}) ioctl$XFS_IOC_START_COMMIT(r9, 0x80585882, &(0x7f0000000440)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$sierra_net(r0, &(0x7f00000000c0)={0x14, 0x0, 0x0}, &(0x7f0000000780)={0x1c, &(0x7f00000001c0)={0x20, 0xd, 0x48, "ae403cc5d6d32934c4789c08bd99255c8b05e74f20c49be2b07c3da7c85d92ae58ebb17fd0e37e26713403ffb6ee270d9ad1bbaf6d38e497303c776d9af972629468a597554384ca"}, 0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="210000000000d8"]}) (async) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000240)={0x14, &(0x7f0000000040)={0x20, 0xa, 0xb, {0xb, 0x5, "58850cdb0ba4c4cb1b"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x43e}}}, &(0x7f0000000c40)={0x1c, &(0x7f00000002c0)={0x20, 0xf, 0x28, "4fe8c3687643e934665fae986447559c0312164f89cecc2ecfb47125aed82f38f881ee8e4f5ac985"}, &(0x7f00000007c0)={0xa1, 0x1, 0x400, "b10d8ce3ec1125aedb3ac4c09f207358f69baa431d8a475320395960554d20c65dfa3709ebb15f5bf77c2c1a8ff2296e1098522a40f4b148efddde0055be1eff87807486748d3f589b30bb5466343d47a4f458de0ebd4e4586aa034dc4cf053053be11412cfb158bf97f20b05b7e52bf5639494d90d98d317fd13d54201392b8a93aba77200f7665ec3cb480d23c3afa66396d9a3e8e31c8d3e3e17d5aa1a6e5ea2ca4055ba9a68609dae726476e2c3ecca4df28d6bdb939c2c4cde6566a8171a66752de69ca7b5527cb8c4f9a3dd7539a08ec02ee48582600014fcb97054998f44fd10c3c95f5d24031fa01a20ecb4cfb785ee4787ac684dd74017ab959349b23be98fe3d43e6a16ed128a4aa3be597662608ae4da25c6a03088b7c7fd3b324bd647b23511a7c53e9a96c5414f6e24e37056bc930d06f2dde07d1f34924fb4191eb2944489f510814d9787fa7adf3d2ac5f5d76c0fd67d54c9a172e888d8575482be0e4f110849e5377b6e86400eeee52c76791d002c16ad6aacf9bc788e0a5339643089c612fed9deb346a4fb510a838b834a20a491f82854d4cd85d63fa4a77a07cacbeeebcca1d833a2a56eeb96937ab288bb0289c16361b9c8abb54304618d5d64bd69bc7c87e8e3b5e4a16479de97f3dbb2cf19d0ec36c5982d41c04563234fc23a3475c2d09c3926ff62a2039b769823b4eb26fafdf3860ad0c7639e89cadd57c4957e991c53408afe7a4ecd4e8145a1ed1bed23e277bad33486e0600f25bcbe3cabe3f0ecbe691de0d498d57daef02ca0b1583f396d3ded2b4c28f47968da16edb4620f8fbaa36a0a8bb4aa919c02421c6362ea063de5e13bc423ea5e038424988e5ac420f115ab74efbe67c11f26efe6f3963a4d7acd70b3584c64ce88ad15342305eb8e603c55f8df1f7f03e85c084fd4eaa1ecb7cec8a286eb59729ad3fa92f49a1bab241a1b20c9aab9e3fd07f8b6a0c33427421d1fff95b1e0d2748ed5587c5b3959556cbf8090d13877f6223672563cc4699bce25c71dccef1d8a3f75dcaa256894b77ec2bbe0f166b8f9fcf3ab1d4102f10eb41ed119c0f0b655b6edee5f439798ac65fa81b38b5068c7bd6ac390390ac55931b5e196816923b3af2c3e94c14f90ab3cb487120c1a108df5dba2b23e5400f1ab229e457e281a6acfb3f6001e8c42491d480e0800f8abff5721ae8a2cbfe6cfd25effadc576e68b2bf6165acd89c728b82094fa1d9a5cbe9e790ece450af4a9a8dda8a0220a3e18c15c019eb8c4d4e4301eb0218d3fe5254540123b25d3dc0b8f60e84893288db67ca09234e57bff743fb93381c4061f68624ffa7961fee55ca6f2a409210f4ca1fb5709befaa87b92b0a3500e84a71d48fdabd58492f894065f19280e9b2471dc36abfc954506932ce263112818407a90c4501a7ea25dcd798504a8fb8598e"}, &(0x7f0000000c00)={0x21, 0x0, 0x1, '('}}) r10 = syz_usb_connect$uac3(0x6, 0x13f, &(0x7f0000000e40)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x4fa, 0x4201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12d, 0x3, 0x1, 0x8, 0x20, 0x3, {0x8, 0xb, 0x2, 0x0, 0x1, 0x24, 0x30, 0x31}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x8, 0x5c, 0x3}, [@extension_unit={0x11, 0x24, 0xa, 0x2, 0x2, [0x2, 0x2, 0x0]}, @extension_unit={0x1d, 0x24, 0xa, 0x5, 0x2, [0x1, 0x0, 0x1, 0x0, 0x0, 0x3]}, @mixer_unit={0x7, 0x24, 0x5, 0x6, 0xd7, "a4c0"}, @power_domain={0x10, 0x24, 0x10, 0x3, 0x1ff, 0x1, 0x1, "b5d0ba7f7d05a4"}, @feature_unit={0xd, 0x24, 0x7, 0x6, 0x2, [0xf7, 0x10]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x153a, 0x9, 0x5, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x7, 0x6, 0x4, {0xa, 0x25, 0x25, 0x8, 0x7, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7, 0x5, 0x6f, 0x8}, @as_header={0x17, 0x24, 0x1, 0x9, 0x5, 0x8, 0x1001, 0x0, 0xc, 0xff, 0x7}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x1, 0x7ff, 0x8, "fa23d9cc9df2efdc"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x40, 0x9, 0xb7, "6ac073ef63366736"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x3, 0xd, 0x1, 0x3}, @as_header={0x17, 0x24, 0x1, 0x1, 0x80000000, 0xc6, 0x3, 0x87, 0x8, 0xe8, 0xfa}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x0, 0x1, 0x7, {0xa, 0x25, 0x25, 0xc, 0x6, 0x8}}}}}}}}]}}, &(0x7f0000001040)={0xa, &(0x7f0000000f80)={0xa, 0x6, 0x110, 0x1, 0xb9, 0x3, 0xdf, 0x4}, 0x19, &(0x7f0000000fc0)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "12550e49da7f1b8d4c79b0f300d9b2f9"}]}, 0x1, [{0x2b, &(0x7f0000001000)=@string={0x2b, 0x3, "e67ef9547014402c19d326bab773ba313a1cdc454a1baccfef0ea9d9cefd6ac2ff4a62940415ec778a"}}]}) (async) r11 = syz_open_dev$loop(&(0x7f00000006c0), 0x87, 0x101000) ioctl$BLKIOOPT(r11, 0x1279, &(0x7f0000000700)) (async) syz_usb_control_io$uac3(r10, &(0x7f0000000600)={0x14, &(0x7f00000004c0)={0x0, 0xccee70abb3f482a0, 0xe8, {0xe8, 0x31, "3275ac0c94e6b03f83c2d1902037ebff181fbfcb7755a1cc0097ccb24f2cf21b96db799b241859fb92e45721d59cde22202c15b5ae925f698cf3c2304843aa58e8f6599ec9cf334c49ff88904051efba9d5657b8d576c1219a39d0ace553d82effb081be25270e22e6391e24a9ff938233913740b9c73533fba6e21dedb602168c05c47f8378d9f1ccde47680e73721be51e584f9fc718adb4e9b6754b49a5d81d794a5ce43b57985e8a97b69a5cb01350844a0ef3fad82d90a4e36fe4ba16a1c55f1f5a2910d3fe30fecbeb10144765cb1ced63424452dda309d6c0c20c10a64f538ff4ae7a"}}, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x422}}}, &(0x7f0000000dc0)={0x55, &(0x7f0000000640)={0x20, 0x17, 0x77, "5908cc3e2a493b8e5d2d5a18ad20f4270e42aabf017e88244ed3c675aa79ec7a7586bbdc3431f5b3e36730ec38f7aaab5e52f7d5346c023648055df3069900a78e23b822be6003b3f4adf635bd1c1f5ffe0eabd2134117550de6537b213d9bfe0861ee3c18ee6146205fa659af1c8d0a82cabc91350323"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x62}, &(0x7f0000000700)={0x0, 0x8, 0x1}, &(0x7f0000000c80)={0x20, 0x81, 0x2, "c535"}, &(0x7f0000000cc0)={0x20, 0x82, 0x2, "c687"}, &(0x7f0000000d00)={0x20, 0x83, 0x2, "cf4a"}, &(0x7f0000000d40)={0x20, 0x84, 0x4, "144909b5"}, &(0x7f0000000d80)={0x20, 0x85, 0x3, "e76ab7"}}) 4m35.888796869s ago: executing program 3 (id=5111): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa5688a828008100200086dd6d00200000081100000000000000000000202a0000f50000ff0200000000000000000000000000014f194e20"], 0x46) 4m35.757882863s ago: executing program 3 (id=5113): sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000040)=ANY=[@ANYBLOB='@'], 0x40}}, 0x40048a4) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0xffffaa55, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) 4m35.661350462s ago: executing program 3 (id=5114): r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) landlock_create_ruleset(&(0x7f00000000c0)={0x0, 0x2, 0x1}, 0x18, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) (async, rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a6ddf0000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038480000000c0a01010000000000000000070000000900020073797a31000000080900010073797a30000000001c00038018000080040002800900090073797a300000000004000180"], 0xdc}}, 0x0) (async) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, 0x6, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) (async) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) accept4(r5, 0x0, 0x0, 0x80800) (async) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x8080, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESDEC=r4]) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000a00)={&(0x7f0000000080)=0x2, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}], &(0x7f00000009c0)}) (async) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000014c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m19.560853402s ago: executing program 34 (id=5114): r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) landlock_create_ruleset(&(0x7f00000000c0)={0x0, 0x2, 0x1}, 0x18, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) (async, rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a6ddf0000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038480000000c0a01010000000000000000070000000900020073797a31000000080900010073797a30000000001c00038018000080040002800900090073797a300000000004000180"], 0xdc}}, 0x0) (async) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, 0x6, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) (async) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) accept4(r5, 0x0, 0x0, 0x80800) (async) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x8080, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESDEC=r4]) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000a00)={&(0x7f0000000080)=0x2, 0x0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}], &(0x7f00000009c0)}) (async) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000014c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m39.285574705s ago: executing program 2 (id=5482): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$igmp6(0xa, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f0000000140)='hfs\x00', 0x1) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r1, 0x40044103, &(0x7f0000000180)=0x5) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r2], 0x20}}, 0x0) r3 = memfd_secret(0x80000) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f00000000c0)={{0xa, 0x4e22, 0x10001, @ipv4={'\x00', '\xff\xff', @local}, 0x81}, {0xa, 0x4e21, 0x4, @empty, 0x9}, 0xffffffffffffffff, {[0x0, 0xe, 0x80000000, 0x24c655b8, 0x101, 0x8, 0x1, 0x5]}}, 0x5c) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000068000000060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001400000000108000240000000090500030000000000140001800a0001007265646972000000040002800900010073797a30"], 0xdc}, 0x1, 0x0, 0x0, 0x5090}, 0x4000000) 3m39.175918354s ago: executing program 2 (id=5484): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x33, &(0x7f0000000340)={&(0x7f00000000c0)={0x3c, r2, 0x60b, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5}]}, 0x3c}}, 0x0) 3m39.14127243s ago: executing program 2 (id=5485): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa5688a828008100200086dd6d00200000081100000000000000000000202a0000000000ff02000000000000194f0000000000014f194e20"], 0x46) 3m38.991703104s ago: executing program 2 (id=5488): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0x8a4, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3m38.060035339s ago: executing program 2 (id=5492): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x132) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x132) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0xcb3, 0x0, 0x400, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1}, 0x10) syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x800, 0x0) write$tun(r0, &(0x7f00000002c0)={@val={0x0, 0x88ca}, @val={0x1, 0x1, 0xa8, 0x1, 0x3d76, 0x3}, @eth={@remote, @remote, @val={@val={0x88a8, 0x6, 0x0, 0x4}, {0x8100, 0x0, 0x1, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, 'QS\x00', 0x14, 0x3a, 0x1, @local, @loopback, {[], @ndisc_ns={0x87, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}}}}}, 0x60) (async) write$tun(r0, &(0x7f00000002c0)={@val={0x0, 0x88ca}, @val={0x1, 0x1, 0xa8, 0x1, 0x3d76, 0x3}, @eth={@remote, @remote, @val={@val={0x88a8, 0x6, 0x0, 0x4}, {0x8100, 0x0, 0x1, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, 'QS\x00', 0x14, 0x3a, 0x1, @local, @loopback, {[], @ndisc_ns={0x87, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}}}}}, 0x60) keyctl$search(0xa, 0x0, 0x0, 0x0, 0xfffffffffffffffa) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3100, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x10, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x80, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) (async) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3100, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x10, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x80, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) (async) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x12) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000080), 0x0, 0x0) (async) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r3, 0x40049366, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dffff000000000000a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0xd0404, 0x64) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0xd0404, 0x64) quotactl_fd$Q_SYNC(r2, 0x3, 0x0, 0x0) getdents64(r4, &(0x7f0000002600)=""/4113, 0x1011) mkdir(&(0x7f0000000000)='./file0\x00', 0x30d) 3m34.771954546s ago: executing program 2 (id=5511): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x3, 0x2000005}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000fffffff500000000000001"], 0xfdef) 3m18.696220617s ago: executing program 35 (id=5511): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x3, 0x2000005}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000fffffff500000000000001"], 0xfdef) 2m34.462143779s ago: executing program 5 (id=5781): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0xb42, 0x0) ioctl$SNDCTL_TMR_TEMPO(r0, 0xc0045405, &(0x7f0000000040)=0x17) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x9009, 0x3}}, './file0\x00'}) (async, rerun: 32) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) (rerun: 32) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f00000000c0), r2, 0x7}}, 0x18) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000280)={'wg2\x00', 0x0}) (rerun: 32) bind(r1, &(0x7f00000002c0)=@xdp={0x2c, 0x0, r3, 0x1a}, 0x80) (async, rerun: 64) write$P9_RWALK(r1, &(0x7f0000000340)={0x23, 0x6f, 0x1, {0x2, [{0x10, 0x1, 0x7}, {0x20, 0x0, 0x3}]}}, 0x23) (async, rerun: 64) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r1, 0x4002f516, &(0x7f0000000380)={0x3, 0x3}) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r4, 0x4004f506, &(0x7f00000003c0)=0x1) (async, rerun: 32) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e20, @local}}}, &(0x7f00000004c0)=0x84) (rerun: 32) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000500)={r5, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xa}}}, 0x3}, 0x90) recvmsg$unix(r1, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f00000005c0)=""/144, 0x90}, {&(0x7f0000000680)=""/238, 0xee}, {&(0x7f0000000780)=""/144, 0x90}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000a00)=""/130, 0x82}, {&(0x7f0000000ac0)=""/160, 0xa0}], 0x7, &(0x7f0000000c00)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x120}, 0x40000002) r18 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000d80), 0x462100, 0x0) ioctl$TUNSETOFFLOAD(r18, 0x400454d0, 0x9) (async, rerun: 32) write$P9_RXATTRWALK(r14, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x800}, 0xf) (rerun: 32) socket$netlink(0x10, 0x3, 0x5) (async) ioctl$AUTOFS_DEV_IOCTL_READY(r15, 0xc0189376, &(0x7f0000000e00)={{0x1, 0x1, 0x18, r16}, './file0\x00'}) (async) getsockopt$inet_sctp6_SCTP_MAXSEG(r13, 0x84, 0xd, &(0x7f0000000e40)=@assoc_id=r5, &(0x7f0000000e80)=0x4) (async, rerun: 64) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r12, 0xc018937d, &(0x7f0000000ec0)={{0x1, 0x1, 0x18, r7, {0xa}}, './file0\x00'}) (rerun: 64) ioctl$sock_inet6_SIOCADDRT(r20, 0x890b, &(0x7f0000000f00)={@private2, @mcast1, @ipv4={'\x00', '\xff\xff', @empty}, 0x1, 0x5, 0x4, 0x0, 0x1, 0x100201, r3}) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000f80)=@assoc_value={r19, 0xb01}, &(0x7f0000000fc0)=0x8) (async) ioctl$VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000001000)={0x3dbb8a55, 0x38414762, 0x2, @stepwise={0x0, 0x8, 0x9, 0xe, 0x3f43, 0x5}}) fsconfig$FSCONFIG_SET_BINARY(r11, 0x2, &(0x7f0000001040)='^\xea\x00', &(0x7f0000001080)="794f94f83c1115920231f298c500d1464c", 0x11) (async, rerun: 32) quotactl_fd$Q_SETINFO(r17, 0xffffffff80000600, r8, &(0x7f00000010c0)={0x6, 0x10001, 0x1, 0x1}) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r10, 0xc018937e, &(0x7f0000001100)={{0x1, 0x1, 0x18, r9, {0x4}}, './file0/file0\x00'}) accept$packet(r21, &(0x7f0000001140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001180)=0x14) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x74, 0x3, 0x8, 0x3, 0x0, 0x0, {0x2, 0x0, 0x7}, [@CTA_TIMEOUT_DATA={0x4c, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x4a8}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x7fffffff}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x80}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x9}]}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x2f}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x80) 2m34.353218925s ago: executing program 5 (id=5782): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x3, 0x2000005}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff020000000003e80000000000000001"], 0xfdef) 2m34.106990965s ago: executing program 5 (id=5783): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x7, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r1, 0x0, 0x0, 0x30, 0x0, @in6={0x1b, 0x0, 0x7, @empty, 0x3aa7}, @ib={0x1b, 0xffff, 0x0, {}, 0x0, 0xfffffffffffffffc, 0x6}}}, 0x118) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f00000005c0), r1, 0x2}}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000280)={[{0x9, 0x7, 0x8, 0x3, 0xa, 0x5, 0x69, 0x80, 0x6, 0x3, 0x8d, 0x7, 0x749b}, {0x2, 0x0, 0x3, 0xfa, 0x20, 0xd, 0x64, 0xa6, 0x0, 0xd, 0x4, 0x10, 0x100000001}, {0x3, 0x7, 0x6, 0x1, 0x4, 0x0, 0x4, 0x8, 0x2, 0x4, 0x0, 0x2, 0x7f}], 0x4}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 2m33.149791234s ago: executing program 5 (id=5787): prctl$PR_SET_NAME(0xf, &(0x7f0000000040)='^\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e9000009", @ANYRESDEC], 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="001c86dd2000100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000001000001"], 0xffe) 2m31.582269363s ago: executing program 5 (id=5790): r0 = syz_open_dev$loop(&(0x7f0000000280), 0x80010a, 0x1cb600) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r1, 0x1201, 0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r2, 0x6f000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'gre0\x00', 0x0}) sendmsg$nl_route_sched_retired(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x9, 0x6}, {0x6, 0x7}, {0xfff2, 0x10}}}, 0x24}}, 0x9880) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82803, 0x8e) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000088c0), r7) sendmsg$NLBL_CALIPSO_C_LIST(r7, &(0x7f00000089c0)={0x0, 0x0, &(0x7f0000008980)={&(0x7f0000008900)={0x1c, r8, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x49}, 0x24008040) ioctl$F2FS_IOC_DEFRAGMENT(r6, 0xc010f508, &(0x7f0000000040)={0x2, 0x6}) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1d, 0x14, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5d69098c8b534464c516bdd8a0f350000e35abdb80e38f5eb010001", "32d8cc263d9e234b02000000000000004a6783cdd3dfe7800b2d7b6aa54cc5001fcaed1e831fa79a000000020000000000000400", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x8, 0x5]}}) 2m31.453625475s ago: executing program 5 (id=5791): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x3, 0x2000005}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff020000000022eb0000000000000001"], 0xfdef) 2m15.245720065s ago: executing program 36 (id=5791): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x3, 0x2000005}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff020000000022eb0000000000000001"], 0xfdef) 40.057045713s ago: executing program 4 (id=6354): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14, 0x800) setsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000100)="c072ee46624e0aa27d4d4391093a72618ef7d2fb947d57b703a685b33221ea78445e646c01b627fb4a33f77d771a457e355b333e65c34fa8cf0c466e6bf24e5130eb651781b2ea3c755c7bca87db156d5873a06e4cbb374fe2ebdf0aa268e8cd1ebdce3e3455c8400e", 0x69) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/syz0\x00', 0x1ff) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002180), 0xa0002, 0x0) syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000200)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0xff, 0x5ac, 0x220, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x1, 0x40, 0x6, "", [{{0x9, 0x4, 0x0, 0x65, 0x1, 0x3, 0x1, 0x2, 0x3, {0x9, 0x21, 0x2, 0x0, 0x1, {0x22, 0xfbe}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x1, 0x44, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0xc, 0xd, 0xf9}}]}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x200, 0xe, 0x2, 0x3, 0x20, 0xfe}, 0xa2, &(0x7f00000002c0)={0x5, 0xf, 0xa2, 0x3, [@ssp_cap={0x1c, 0x10, 0xa, 0xff, 0x4, 0x9, 0xf000, 0x46e, [0xff, 0xf0, 0x3fc0, 0x3f0f]}, @generic={0x6d, 0x10, 0x3, "c0faeb7288428f8672244f3377be994b7eb00a08db95e253f1379ac5efe4deef078f518f53476e6f6ca591ff83c97e8bc0369af52c46d37e4ca850a96e0b1f961a5d5d46ba0bf6d22efd28930c53ba43b7f69a8c4f8a8609c8224bf2f2fe85366b73c4008a7f8d2a7eb7"}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "ed79ad81315614cf922dee048fb885bc"}]}, 0x2, [{0x4a, &(0x7f0000000480)=@string={0x4a, 0x3, "99de56410781c20c0068bcddc57fb4abe8d76de12ae211fce0c1885bc78c781ab178b4ebba49874b3e01fd37458e5489003b123173423a82a4b0f8b13c5ac5fcd95472d8519508c9"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x1809}}]}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x4000009b}]}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000440)={0x20, 0x38d06c00aa96fada}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r1, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000100)={0x0, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000840)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0}) r5 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r5, 0x0, 0x0, 0x141, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000580)={0x34, &(0x7f0000000180)=ANY=[@ANYBLOB="a4050b000200"], 0x0, 0x0, 0x0, 0x0, 0x0}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x141480, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1000001, 0x8013, r6, 0xf6695000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f00000000c0)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, 0x6}, 0x1c) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) writev(r7, &(0x7f0000000080)=[{&(0x7f0000000100)="5514377d925cfac68fa5e905ccd2593d6d0f37d8422f54e9fbc8881033b7e59b0ce2a896d5c195741b964850ca7444d0926630715341d8ef0611e595745d05bb0484b65adfe33ed3639e7722ef74b92df54d886779faf3deee20a0724362221a9fc4a7f86a07042dd5875131ff0d57107a01db1964be5dd15d8d3be6fd3209f87210f2e9de528884797a1c43157c6f56349e263c79cb13df66409f7cd33b9ebb000fd19d5521eab9eb89ad56a45108b1d3179077413d0e16044c0fe0", 0xbc}, {&(0x7f00000003c0)="fc30dbe99679dd0987d9b79d2816807e5ae56a882530ffe1ae10045ba28c5dd5d248346be2a47ba7ee4ad5737e6f7ee5972f54c5c05986ceaefcd934112e67e808e7197431b1ccde1f3f6c5fc18a493805bc62c575cbdf0d821e4d78766945408115744f77f5fd65bbdc64876a8a4cc6c9ac20ba24e72a582ac25cf4c4abc66e220276c80ddfadfb0d2dbd81ac158689bb3ee37cd6030474f0b67ab077d71a4af43f2ad4865aebe10863d1fbc13d4b6fa0cf2ac1622bf3c908302f7e49debf566d5390f5cc4dca4aefa4823d39cb7dd4f4b9ccaa3deca2483f38c68a6dd882630c645b3731764f609c43fdf70d1426eb074aaf64f950877536287cbb548ae806ec459b787cbca0bbc12a0044111c8b688d9d2c1400cbd43c21fee0085f3a88a87d0acc4328488cf64db57a3ac6ca7ba0effedb266c9c8c2eb03d42aa488241af22018d2f94b6e657a54801b656a8806f1f6b009a6e9f37d02caa6795ca7bd3cac3507f37a462e1ac4439246310bfef901b7664009228e5db784966aa690a2a06414cb47c02440fb402a214f204030d28d13f1267dddfab49dc95ab673ec2a243ded076600e33fdca0495a0807d4a3057b703770316b6afd5dcd1ebe22e7922e67c8378c09623c068e49f788048bd2390e8d48301490e26b950018a18b196d038d9786f268a202b76acdeb0e879e291b0585aecc2b12b692e4ebde3703a7036408accf2a7ce0155b54bbd79aebb61e2f881ee21b5dc3b1971194f66e741442683da9d9015f3535458b69b1a231ddba9dedc1c3008bdf45b6b5d8d55f70d016836a1ffcf797c8e87451a3aea994e9a8bf28339910570d2c5fd5cf258e13649667da0fb5597144ba9beaae4488fab4bf92db02dd8a567a3448fbd4994c7ef6e94c1d94fe246a50dd0d4254dbde51ae8f0c135961175d68913beb0dbd725206beb1510ebb44319a9bdcb8949f46cf187faa8ff4095ec2ced4080e9510e16eac28ab16d2b52eef8131b6bb14059566c7b40ec939c3d9da8c07cea2a41943d2b0f2c46935e9d91e0f60933e70e83362e381f8c77bcf5462a8e951b2d268e27c0942c85ef832e731d9c0c72911fb8a5ad85e0d710b48d54d2c1ca5de57b3cc28c7ab7504c11e3ed03a68509159b8ca0b2be181a3ca748cd02969b94907c2687fca03fb6423854627f0c54f8af5b84630c34ec70815063c8ca0303bd6d97f53e2437a177381eb10ec1108d87285d3669fec1b2f31acc0f5663e888cabc8aeda7ca34f377377c7100edf49a914538835a916a0f84bfb5754fe3313c801168f806675b9813c3c3c5a52cbde1b907b2922ecda1db0a81108622e3517aea76f0debee7c452bef87f78394e0d9a85b90db51fd5d953a528d12ce517deef93b518ebc26197818238481940e1b8747f8d3e3398403837fe86a5c67a708c40e6c89275c1f9d07cfd5cee1d0379275899b1cda60b71f1ebe48867864529cd72e8437c01e71fd06c5c5b88752378932aaefc5dfb8580b00ba024cf132cfc2960d50aa0b33e3683f7f193accdd3ee2d0c47724165a0698d5098112ffa058ee93aa3b692ccbfd34274763c74f831c91fb84f7be645b0a00630226659d48e49da81a6d78f4478ad25458d91aae203a9b7413e65d7ae0b837312d09368852ef44960f71e9a2f915cfaa1b0848f2ef1dd6a7656bbfb0247a1f34e1b4d55c83578f2ba3eab5f94c878341e7c05d6a79a6e8c1024cebe808a09e1f202ecd024dfdd939d57ce4ed5a48d6a9b2df40b18d1f2e8b214e172fd05aa5159b71849bef0c9f576255a646453042c4d47e93ae8e0242e58c92fbdfe6748f4787c3ef1da49f0baa841ebbfe490cefca35910db567e59453824299cd26e625fbcfff898261de4f57e54ef909b2694adf79efec260f423055d48e38ed6e177550f6eae88f2f8618348396d006826349612401b40a318a29b5bcbc26e387944b31a852bc9c9cbf3947c9ecab7a9d22b57567c344947d734cfe39742632ff637c63f8134da78e499454cd2bb8c5faaabc32a5508e8cb053b49420f53a2fd3bc5496a2300e758f8f5e128e3edb039267e426b863aff638a460579e29be2c9938a2a273949152d0a83f757cdafbc664abefd59297f5dd112d47724e28f52a9660f9def5be26a5afc022e69c37dda79656042651c7bddefeaadabae7dd8ed9232f5e037cf586f5dcc319e18ceb90e7ce62b9ab270fbb62b29578b40614fa0dfba6a22a1cc2a3cc06e5c48d9ed3c145f3306e4e2f44812d908d558740b932229db5fccab7d43c53cd18063ec26da594fd0b2f4536b5dcb8b6c1fba1cf907140cda17207a9ba8a185cce514849f48c455574ab110750da0ec415e1e4279fbc63c298336f87b4b4776430195a4ee37f6a265792eb8d32e02ad6611a68cbe13202cc937fc5b3b8503ed59ee75ecf8a11f62d17e3ac0a797f9192217ae30a3ca3361d92cae64d1e00e8dad64c7ac5071df5a77b8cfb7b9e32b19d6c2c435bda45ec7e9bdd1cded92048bc65b346f427dbfe30561b14d73ea105c3866798524be7f211a58ae5db271441368dc68e95add6cb60b66135d3da6000acb5941c3e78c399886c71d9d9e401f9608bcf4e20fb024456d24054f96d7430eb3560e5dba6039190a855f9cfa3e0602a3fd4b7ecf70f7762e07ad1495b82ca660ffd82d1be4d9c098c42a70915d37157c27c7fc07b9eba5dad6bb798b76fe20df121d38ad3c1a33b8b707b1080e34bdd137dd73320a96ecd1d77ad5f73dac3b9a495fdd887c0ed81abb889d665b20fa0eea5ae0fabf7c4660604a3d767b281b8ff54a41af67da99a68598bfeb7060c40db6944cfb5a73058d31832b981b28e5c27c485feeb4a0d5913df851eb935c10b21c0e97f149040972ace826d5d55e09c70f9e43c3e57bfaa84ecbd44e5a4309511a8e5c73d4f7a5a05cc33598b1d5ce596d564b843ca60040358e4ca652d30b8dc3b00e73a3f284578321471cfc12316a80e1d77261598b540a14613100323f11e2bfd1db94d99e7a4cea7c18d82ef0b04eacc956bc032a6c0f3e7c6c0415f9d7ff18a7e72a60c0ec33779b6c4789616c0767294ca898a50ffc7887a4c7376c7d28eb0b74c29b4e399d99fcf91be83c922aabe8065533724c9d82f819bc7a7ebcfe3586b8e2ccde8a0e0ef4fa32e78d1ac90654e70fcb565e81dbe5e51801f501a379e98a74bd31e358950ecd8b5da2232bf90d48c1979d88c429ff77df926be757213796e457064fbff5cb7fee41c32159a9cdaa1176cd406f0823abd8c2b8f83dfb96e5e2474d79e30f726c47746520ff4b3227a636d1d24fc19515a63e8333211aa6bc63961eb810ec4830d16baacd52f96eb3d16adc4128500eda2188d88d9ef0235531455eed0657874b425d6ba68a67e3905ab6f4f729aa9ced5ceb96cd183806a6c3720e907f6c7b226c0fe15219c2ff3320c2e6880ad016dc8bdd911d60ea77d971ed05ca154b0e5ee7d6ebc28b86a66baedca6d39939943bff1d8b39dea87a59fecc6279f9b117b04562db7e952b516a91a364a3b57f9f51324764b4e2c50e0dd2b4a62d19fa665be338e0071edc2725a4a775e9eb0a9e1d01482ed9009e2b17deae69740399203d231b2cb54635aab4a5bc71c1d75d5c27a0e850ad7c39a38c2658d72e8bac7e9fd4f351ad427faafebf7beed212a2fae3cc0c811cb54c468d9aacc303567a5ab03d8c00007c80085b5d39285bb161d8db8de11ec6dce9eab7b7dadd892a4f25e3382a4fe72ce2b309d02ceeadb8daa6e28f4baf8535e7dbb888005651bb5f434ec32b45042363bc424dc3b3441fcc12cef6779ca4032835a225a4196aa952ed12eebd4712fe385dd933fc4110de767d0f9127e7cd815d613a454c56f3be15526c6af0cddae6a7ff375d283871b8761e1cc63f3ada963c127bcb528f971b50ebe6da93b36c1c0b11b7a677c3a2a5a09f2e9350b509f22a51e9c1f3e11383e703b9053ddb5884e9a5804b51fa06f7fbb2ddb8a2d72bebcced8d80834780cfcc578e0e2d0219b4d120b3587db65809709197a0c9f5f5262b091fbbf15f4767206f85406e2fad15c29407243834872d55f13a42a9745822b317edb26488e8517de1c61d5003776faa94fb2d851b4c914dfafea5f0228ce3c2c795511ea5d1bc2b47ee56f56cafd0670e81ee59d2a6125075e98d475f671eca2020d96b7cc33167fde43aa045ef9d71db070d02e642bab72d0e9ac64be602228d8e1e91e9486765c2bf6cfccd723564edbbf13a44809d5a03ae5800bde612ec4dc2a96cb9b8de34998b2ba891549d956f333eb2da9a67312d77c46cb1135694e582a4ac41d9eeb4ff87047e12418f9896ffc567c67a4d172203d79077b901ff42a34dadcbf4b80eacf84093206c563d377f30e427fcff6e1e8ad572e2e4dfc3def367feaacf526fcc75cf81d013d24d51adc630db4a51053e70ce6f482f4c41d973b68dac37214e9315556e5fba8dcd68bcaa24256045ada481af6dfd80b01336ba5405b3a6f810eccff2f79e640b8ec1871140f0b773b70f13fad81121fb16f4a92db25d29206c00b3768e47dbe827257e5901c62e2509438ac6596722d9882893e2ea8b1191e09a6638eaae77c8b52c5eba0c3fa2230e48510a1b810259101d75bc488bffdfe1a9c6da9e05e149ce2e9b865db0d884f1028f03c84d947cd33895d8581c83ec55431b340b7fb04cb36d187fe6bc204f6bc390aeec4c949ff0d3db4c1c5b85909f838cf3a56b5d610036a0cc851f836ad72b73377b6eb6a869b802d1c07c424dea55f91e88defff0f07a856a2ba15070f19d5fc5858ac33e233713a1a8445e3255bf43aea9c7cc18f1c225c4b194a333d42c4bb72c994a877b5ae840f1a4f52c9d3bb3afb187b251d1c68f380a5dbd1689a78d98e7edc49014ad7c79708758d8e23c5082298627e38f1e19e1623a8b7e12a6435deae6698f0015d8e2e1e918ab06d060dacad0d6cc6d835619fe361d5e8cde40565b76913a904b7e7c60ddfcce6afc9e4676ca526a68920bcf8fee9d5055ca360d390524ac6aee07060220e13f82d53d3048b7eb0657db4597bf9ad73b1963dee280f181d3d9428baa692e2486112a308c7c5e81f98dacc516909df9df934edc8db18b7d49afc2e00c863dfeb70362571bc9cf0c4c179df7b4ab5ae4737a611966cf9c3593d6731e31ac048f046f78a2ded8c71a5bd422fc7b68239175555896d42563c8cc5b950fd28fa54db2e0cc6cded799f087befa8acd68eea3644b2711259296667530c42e8ee3dab02ce2fe770e68fbbf12e1c274ad54bbd95d16530abfca59d268bd02d5a78d9a5bd91127fcb2bca57436f7bcbffc08422ec54f887fcdd84a81ea0228d75bcca42f2d4b5bd138f5c0821ffb185cbe6c1750b3de7ef6775898c6695e11bfbe2db80e0a500841c45514ee4bd2e84809cd3046eb820c9c96976a90732eebbd3023d02cb7d67f9cc891f8ba370037fd97ea0c5132ce63354c0e7fb7921602680da18f7dda895a287a9393d5", 0xf44}], 0x2) 36.169425264s ago: executing program 4 (id=6366): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) 34.103598931s ago: executing program 4 (id=6379): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x50}, 0x4004804) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/45, 0x304000, 0x800, 0x1, 0x2}, 0x20) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r3) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x14, r4, 0x1}, 0x14}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="080002"], 0x24}}, 0x0) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@GTPA_FAMILY={0x5, 0xd, 0x28}, @GTPA_O_TEI={0x8, 0x9, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8885}, 0x6cc12780ef89af44) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r8 = socket$kcm(0x10, 0x2, 0x10) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r8, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000006c0)={0x2c, r9, 0x103, 0x70bd25, 0x25dfdbff, {}, [@GTPA_VERSION={0x8}, @GTPA_FAMILY={0x5, 0xd, 0x1a}, @GTPA_LINK={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84880}, 0x4000024) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) r15 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r12, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x5c, r15, 0x809, 0x70bd29, 0x3, {}, [{{0x8, 0x1, r14}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r13}}}]}}]}, 0x5c}}, 0x4004000) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x50, r9, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010100}, @GTPA_LINK={0x8, 0x1, r13}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_PEER_ADDR6={0x14, 0xb, @private2={0xfc, 0x2, '\x00', 0x1}}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r7, 0x3b70, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'}) r16 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r16, 0x800452d3, &(0x7f0000000100)) 33.958673518s ago: executing program 4 (id=6381): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x0, 0xd, 0x2, "134604cea4ddbc704c17bc74772190f5070001ebfffdfffffee793000000e000", 0x41415270}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000364000/0x1000)=nil, 0x400000, 0x2, 0x2}) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000bc0)={0x0}, 0x1, 0x0, 0x0, 0x8}, 0x4004010) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$vim2m(0x0, 0x8, 0x2) sendmsg(0xffffffffffffffff, &(0x7f0000002c40)={0x0, 0x0, 0x0}, 0x0) ioctl$NILFS_IOCTL_GET_SUSTAT(r2, 0x80306e85, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1d0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x81105a, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000ac0), r4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r5, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000200)={0x0, 0x100000, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r9, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r3) 33.712756303s ago: executing program 4 (id=6384): r0 = syz_open_dev$sndmidi(&(0x7f0000003ac0), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0xc0385720, &(0x7f0000000180)) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x101102, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r2, 0x84, 0x7d, &(0x7f0000000840)=""/4127, &(0x7f0000000000)=0x101f) r3 = open(&(0x7f00009e1000)='./file0\x00', 0x48141, 0x8) fcntl$setlease(r3, 0x400, 0x1) fcntl$getflags(r3, 0x11) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r4) sendmsg$NFC_CMD_SE_IO(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)={0x14, r5, 0x105, 0x70bd2e, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x200010d4}, 0x4000000) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f0000000080)) r6 = syz_open_dev$video(&(0x7f0000000000), 0x75, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r6, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0xf00, 0xf, 0x3, @stepwise={{0x5, 0x7ff9}, {0x2, 0xfff}, {0xffffffff, 0xd}}}) 33.236089458s ago: executing program 4 (id=6389): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, r0) (async) ioprio_get$pid(0x2, r0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) (async) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB=' \n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) dup3(r4, r3, 0x0) (async) r5 = dup3(r4, r3, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x4}, 0x1c) socket$packet(0x11, 0x2, 0x300) (async) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'geneve0\x00', 0x0}) sendto$packet(r8, &(0x7f00000001c0)="05", 0x1, 0x240458d1, &(0x7f0000000200)={0x11, 0x88a8, r9, 0x1, 0x85, 0x6, @broadcast}, 0x14) ptrace(0x10, r6) ptrace$pokeuser(0x6, r6, 0xd8, 0x40a54e) (async) ptrace$pokeuser(0x6, r6, 0xd8, 0x40a54e) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x28, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x17}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) write$char_usb(r5, &(0x7f0000000740)="8102188b5bd4b5f95ff463a513d9e70f54d26286e88c2b8030e5946a48e91b11619ce79440200eb99d842bd5d0c95966015d722c98cf44fabe2bb72dd029cf091ac77327b715b88efac6f21ed9931a37443f71d9251bf07f054227d7ba020e131fa439700f7a528e1fa15d316650e6b67fcb6e6fe17a83f8f75253b4572b831afd6c5e1d6577cd4603515bb9a44b40800951710d7ff283635482ed3732aebcd2cdff00c02796a975faa0ae0f8868e165a1e58f4da49d6d835d9aee2a4ad849a8539cf96ee96432bda3f6371ab81f1564b208778e70bc1435562544d24dbc0755a701103d25c5345321c7f0c7d056dfbb9094cced3cd6426cc290f418d1942211eb4103e44a4ebfef35a01c8aa1b8f4af7741820a00c1f127c1ab067885c5e5def79a1beb76f1864704dd30714190f90652bd12dc490f8fc1aba8cbd820bade3b325ac3d89e484bbfea5042bcef3218906176ab7d28eddd3e6a45ecd6e7d54fc4813ccb5de98c741bf3984603297e7ca450b8941233a21934fdaebdbec6824d0045172f7d551216b6c3bf71be0165f5ab4626575817da88096ce73e63f6459ed84c6c54113e7b3a9d76b4c3e688328f1e3d2141892b6f54899ff9930496ea1bea31356c3759f60cf47768c8c5f1b4e7e28dae6b1b761857cde803d8ef4ba79d55c756383836d99b6b0f97aab508d8673da8925e32f777f89093ce4bac7ccd8fc2d552168becebe07e9a09241762583e9b7bdbe5ef3da2b34a4936dae5177c1b99e0eff0f39322c0654368f0ccb1b9a876230a70c064ffd792999e6bda6db90d96ce07954697b27d66726ae7de3f59673584d7ad2fe70db02e11a0087dacc31c99927a020652dde73d32ceeaffafcee5a497e3c3b3e9140ca50088038eed458fde40384cd533415bb6b828838e8820e84e5eb843c84d9a0cd4e17aed42e7d16e0f73b94e0e6ed06982d05f0518f6107ce217be457a2c2ffb3fdf9d8c7de99745aec3779251037efd732afc2bf9557ca19bb6a0a44eb1ddef0347cb1c1ff074cfe44eecccd092435f5a1f43bd7c3a8c27a7a73863b72bba3defedfccedc63c5ab353ca85386c9a1edf33041ddd3145d3331a8649fba295a6f3e1889346eefab0192377449ce5370605740805193052de0cda1587d61b0a858168b883b3d88b90f4f77334895869852f95989663c304c749d2a9bf5d21dd91e40f76683b873626a537788bbf87ea6fde5cf2d2baa35a07394db158402c84304a9e9384670c594acdc3fb2cf39a5705c118331fa441fe64be19b531596e4c203065f8401a448665b1ba82290e2119959f7252436dd740062d0851e3776fc4c0ed3c7bc35eded46d5fd1fe31b2f07a14befd725a1b6fb653c96675889c5f31db3fb22e8baf27ca27de7b2e61df960c793b2c3b98a1e85e51f160ba544e4aa1a4dcb425da6b4c2d9647313fb4aa2336557b3a4b1e3570ff3e3e9567e327ff61d2b8cedc44674bd30486466149cf9b1354ee6a6e14e2523d78e8f40a290bfe7aa3e485b196f9c3aa282a723da90b43a4c1467ad353d4316f0f7b8e2d665400d7e29e6c8a436e20abf0e4aef4127e2bdfe58b94a1c7de511b1fde62e5c78f99a32f1461baa13432650395383cc09182589a94811d905f82a6d0bd0e7af7233387c02f5afee0b67fd2c7d1ae93199ac4862297571466340feaf9be0f2565278f0c1c86a982ea1e3a1919af54a88258954e48940a1b2bce4bbd3ea6de1e296054313464b78dab48efb8a437cceb42dbd074ed46c24a676431365f1dc9ff6ae6b946d9c752db0fb71f0f4f593d059b4b2b4149c1d2a47769dc43fbb7c32597576d22fa43751302eccee55a2a760e9cf36fef491568918bd9bf05fccff040b624dd7a13996b1c3003f9af3bbdc7b0c72220346055d8c1896aa28614a29e08792bc6e773c02647c12a108c1253460355d2fe1fa725a28a6784a403df0b7af8ffc503c2c3c71427f8b6d911344345b772acc69fa8932c76c3d1870071edbac002db9c17d9f34d14c168eb239bd82033044f9cb8b765c7e152b3bb372caa8b5de03b78667a321dcf4ffd6a269031369ae4ed01eeda69798c3d8d7831425750ace8bedcc598d7279e822817968af291fb01b3b759f24ca7d721fd375476cdfd0e34a117f0a5433f0254abfa96f809aff30d8c004ed64c299648e707252c47bb107d0b0ffc2e764d9603564e39a3dda5f4d887c171d1e7c5df2e72a322aeb09ffeaaec253b1efb33e440b393e6e467ee52205c2156b54fc4f3be18625ba09c782bff11d3c501247bb33cc58838cd55e252a2ac621c62be0b347d32194ecaa7cb293b5534d0c875f1e6e1a367b89a157cb4b89ae868a13e25291a5af441fa284d7eb361277a743e44b370978bbf3ae42b63db46805d5e54d690e902c7ea9f19f5969705178f4723e01b4f835fbc2bcb9e9dcc1c1b5de20ee3d5ada1188a04f316fe1a7e9020f33c242ab06ff28bd68a94113e7b07675a19e4c7fe14def843897d892e354b87894d4b988d91c00f26155106a909374a980c67a5466496f444f73f151a8c881cc58fcf03b472f010c470e03d7902494880389169544f037ce071ebcf653cc905e6996571181e2b576a7babe2ca7b510271e135ab5871e9e304be675948e9930b2e081ad4aadd17a1a4dd9203772a631d96d3d8f31d191983f0908b79ba0fdf5c6fd7c11e214c27637930a6581c9b347de631078db0a0b954788a6622d99604fbf20c4a653d03fa200fc1d914a0d3a587c05d0fde1e132d9051d8fca49f923e042d749ca7cb099eea3dd52d5b698514cea4f9ae579ff3972eb796c49e62dfdedf14f626dc9c86b24ccd5aaa89aad11e48b42fb2e80c37706469914aa6ecda82e16aa72eb620d9387ac073bc71d8bafe02fd413eae4c48d8fca9b1634132116fa18ca5cba7a2a08b27258b9223f21c7b62864f1c0c812cb44278251dd8fc45d7d21fb7d713917be58e7f727cfd832c96bb528e70976e4f6292255789e083e27bf655b0e38a474308d1fca4b164d54928794747ae63cba1f243e95ffe0f1e87168193d479ec495b42cd51968564018b81b14435a6ef80c46ed624092f514431c653792a1548415497adcc66ec967f0afcba3bc700087d9f6f9acc77edd8268498a6bc4c003c93a65bfaf6343b9f50f1be90b228a919d9e4485982090e68b09e55ed34a6d08ffaf7bc3144345b7d294b38801d4a2f312780d8ac651ac95dfac24b828708d3238f87e6bb58950525ed6d27d136414817c8f8b3d794c60a5376f04a4526ed5c8e319bf504b8385f3f5d4d6f51a0608b7948bb3a901a3c89ac92924d6eaeaa69cc7c83a89add0c465c43f3bd31fc047fd52860642917fd0bab32deb41008ae16fe293e4e98b7865e22e9cb3d1402bd5629eeee375dd92bc9cbe16d55fdf9165b52d6cbc2c6b4d99d671167dfa6ca253dde2b5cd8233f4d65ea90ca81685ab9b6befdbc2bc951dffbf9dca5443834bec57dba2b479c5c23c0257002061ac256abaad5953104786e8b650299923f8a954f2d45bd3a4c8b71bde5af305e2e687346ca660147c18a38611af3e51c4c1e3c349130b44c34bbaa5735133e372a8c57af5c4521b0d86e4e2f6a31a05a1bdf86d6f146ad284894453994b82b615555d2e9031157d2f1bcc22163e89bbeef3ed534ec71d8caacab8cd6b20f3c2c8457d73d180ffaf7f7eac4c6248db0db019e51826603fce8122c27a33326d6e517d92acaa0ae60eb34acd46ed45620e1a151375c5337023ae84a1ad79034596cb9b9de64f8da7a056cd96b4fbbe85ccfdc3d1522dc8f8b0e4aebd2a289ace939ff5ea138cf4a10eb47a5ac4af9072785e3f6cb41250e604e5120dbb07fec58aba9e928391cb0b30d44410d88956ea88b5d6260ba675cd7e92a54667d99ec292b3603f4719878987a8be300d5bf6130e1a2541f62d79ed4d77bcab989a55cba488576338475f5c852089b9840d6400fe872e19c602cfba4cc7d505c1655eeda471667efc37aa792982e8ccfe49a9676bc237e0eecc2e769a1650abb2ad2023e88f3960f653fe42e0a0ee0f6f9fffd37bc39ce77186498d8976d02b422c0f6d933520a617501fdfaa830a7314d90905eb81b69114283996238700aa727e5c49066188ebdb58dff3c06e320995a34dd93ab1d1a4547bda4051a2f995317e25e35cb6e7696e1af603815db47222ef68d6a1b35f3de76613fbe39f334a1477dd7bb478e820dc97a535d0905d77efeaa4b196cae574f5227faf800e6700ad96a02c4967473bdc391231fae9df3f1cd8ef1bbcfe55b41d2ace540cba9d958fb7689f2993c5c0ade6083caae295bb6b3564a90f28d343ba13ea13d64be2c6bbdb0e8462abad98d3745c23cb934dbdbb118ef8109d1bba70d0927d1df13904ab583caf49524a6c4d952c43f2b3b9d6bc61ec71e8aa73fdaa095e42052c5b9383c1d2e346248917dd35d9649b105ab322e546150e512e8e162cbaf16433c75e0c5f5bc01a40dee422453db7c63e5423c1b0081838fa4edc3aa3766c9e8b26ff75b59610a27f2e4575d47a8abfcf4e46f87a593393759b0090ce59c484a41f2fa5555cd6281f450ce7f24d22af2e6d7a385adaec96ca8c5de61007c8e355310af1f22f3a7c3267ccc382ca20054ea51cfc6c1c6c2a0c399a69a531c215a8a70a67b7a683bab2e9694012cbdc09871561441f29e0fe680079d2fdcd0d21bcf050c369fbee64aeba57d5861e1be81a5cbb5012c6963a38d2b93f4841dab571d9b59759d320ab70dd62d3f85a1926db224760a26b4ac96e944199c7827abbaf5f5270122d91fa3f0eab440966e4638fe5e0a1e7c2d16b753d4f19acf0252c70151b1881d2eb8775d02ac5c0a5e4734c00c5a7b6c6c7835220cdb151bcd8cd16ea06d1e1d4f0a7725b453038e6560d8c9b969f748911d43e679fccbf62040090fa907208e7ed69b41cb351afae04478f173309af5a4757deb05934208971aab0d8e0f895a4e04d1fb568b6c603c837165fc6ad3ecc6aeb4ed6bb479ec21bc2ffe3d69a214f78231276a7b45fa9b320ca1bcaf9cf8d48361aefd1d0540eaf7c3cd12ad8229bde59e789dc1078329d9d7f34df3b671a91b84922af7a55369f294f1b0952f03f0ffe8274aff2517a3bc495b0f58d8775901f0124fa8da24d67d4c471b1fec84195de8e2e4127a2032c5d506bca88d4bc3db9ce83c8be2f1d3c2f4655a1bcaf6c257d180e10c376cfbbb87a2dd02ca779e288a22f41fb573ec3d5ad50ab1ee365101acdbe6e62dd95af8b87eca768be52bd9a1a6f054e8f7bec8269201e587158cf355d5644d4a524fd155b431d76b91df63f974232df0ca112380fee24936570748735c3d39f72d84fb0fed49a9001addddb9cfbef0b2c32a1535e16d47c434f6ee919934b90c22982eb1145db50f454e2eebf1307750e232e583ffac11f55a5b5677c26d6c41d76bddde9b60a85b20e31a8e5456fec184116f3cf8925d26ba297c31f16e63245753bedce6b17756e5d691c371ddd54241490e46b9f17ad340b3042096a650c597f56eeea25b6d128a940fedf08013ef5af25e94da12f3383c320ec7426594fdd4a05578b01a5b48246a75e4fd24d590550852c912fc52a00c72553660503395671649ff8f4b04d892e2e7eae0e5835e458505fead95db9964f4dfda8c5b40eb573de7b6849c1051a43c34472ad6ff1c5ca506d2a765c9e48a4a46b0fc107f285f0145e38d495da5a2df3c7a80274255c4aa5659a05a57b65f1555036e12b28f283402deff5b549", 0x1000) ioctl$HIDIOCGRDESC(r2, 0x90044802, 0x0) 32.916646778s ago: executing program 37 (id=6389): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, r0) (async) ioprio_get$pid(0x2, r0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) (async) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB=' \n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) dup3(r4, r3, 0x0) (async) r5 = dup3(r4, r3, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x4}, 0x1c) socket$packet(0x11, 0x2, 0x300) (async) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'geneve0\x00', 0x0}) sendto$packet(r8, &(0x7f00000001c0)="05", 0x1, 0x240458d1, &(0x7f0000000200)={0x11, 0x88a8, r9, 0x1, 0x85, 0x6, @broadcast}, 0x14) ptrace(0x10, r6) ptrace$pokeuser(0x6, r6, 0xd8, 0x40a54e) (async) ptrace$pokeuser(0x6, r6, 0xd8, 0x40a54e) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x28, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x17}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) write$char_usb(r5, &(0x7f0000000740)="8102188b5bd4b5f95ff463a513d9e70f54d26286e88c2b8030e5946a48e91b11619ce79440200eb99d842bd5d0c95966015d722c98cf44fabe2bb72dd029cf091ac77327b715b88efac6f21ed9931a37443f71d9251bf07f054227d7ba020e131fa439700f7a528e1fa15d316650e6b67fcb6e6fe17a83f8f75253b4572b831afd6c5e1d6577cd4603515bb9a44b40800951710d7ff283635482ed3732aebcd2cdff00c02796a975faa0ae0f8868e165a1e58f4da49d6d835d9aee2a4ad849a8539cf96ee96432bda3f6371ab81f1564b208778e70bc1435562544d24dbc0755a701103d25c5345321c7f0c7d056dfbb9094cced3cd6426cc290f418d1942211eb4103e44a4ebfef35a01c8aa1b8f4af7741820a00c1f127c1ab067885c5e5def79a1beb76f1864704dd30714190f90652bd12dc490f8fc1aba8cbd820bade3b325ac3d89e484bbfea5042bcef3218906176ab7d28eddd3e6a45ecd6e7d54fc4813ccb5de98c741bf3984603297e7ca450b8941233a21934fdaebdbec6824d0045172f7d551216b6c3bf71be0165f5ab4626575817da88096ce73e63f6459ed84c6c54113e7b3a9d76b4c3e688328f1e3d2141892b6f54899ff9930496ea1bea31356c3759f60cf47768c8c5f1b4e7e28dae6b1b761857cde803d8ef4ba79d55c756383836d99b6b0f97aab508d8673da8925e32f777f89093ce4bac7ccd8fc2d552168becebe07e9a09241762583e9b7bdbe5ef3da2b34a4936dae5177c1b99e0eff0f39322c0654368f0ccb1b9a876230a70c064ffd792999e6bda6db90d96ce07954697b27d66726ae7de3f59673584d7ad2fe70db02e11a0087dacc31c99927a020652dde73d32ceeaffafcee5a497e3c3b3e9140ca50088038eed458fde40384cd533415bb6b828838e8820e84e5eb843c84d9a0cd4e17aed42e7d16e0f73b94e0e6ed06982d05f0518f6107ce217be457a2c2ffb3fdf9d8c7de99745aec3779251037efd732afc2bf9557ca19bb6a0a44eb1ddef0347cb1c1ff074cfe44eecccd092435f5a1f43bd7c3a8c27a7a73863b72bba3defedfccedc63c5ab353ca85386c9a1edf33041ddd3145d3331a8649fba295a6f3e1889346eefab0192377449ce5370605740805193052de0cda1587d61b0a858168b883b3d88b90f4f77334895869852f95989663c304c749d2a9bf5d21dd91e40f76683b873626a537788bbf87ea6fde5cf2d2baa35a07394db158402c84304a9e9384670c594acdc3fb2cf39a5705c118331fa441fe64be19b531596e4c203065f8401a448665b1ba82290e2119959f7252436dd740062d0851e3776fc4c0ed3c7bc35eded46d5fd1fe31b2f07a14befd725a1b6fb653c96675889c5f31db3fb22e8baf27ca27de7b2e61df960c793b2c3b98a1e85e51f160ba544e4aa1a4dcb425da6b4c2d9647313fb4aa2336557b3a4b1e3570ff3e3e9567e327ff61d2b8cedc44674bd30486466149cf9b1354ee6a6e14e2523d78e8f40a290bfe7aa3e485b196f9c3aa282a723da90b43a4c1467ad353d4316f0f7b8e2d665400d7e29e6c8a436e20abf0e4aef4127e2bdfe58b94a1c7de511b1fde62e5c78f99a32f1461baa13432650395383cc09182589a94811d905f82a6d0bd0e7af7233387c02f5afee0b67fd2c7d1ae93199ac4862297571466340feaf9be0f2565278f0c1c86a982ea1e3a1919af54a88258954e48940a1b2bce4bbd3ea6de1e296054313464b78dab48efb8a437cceb42dbd074ed46c24a676431365f1dc9ff6ae6b946d9c752db0fb71f0f4f593d059b4b2b4149c1d2a47769dc43fbb7c32597576d22fa43751302eccee55a2a760e9cf36fef491568918bd9bf05fccff040b624dd7a13996b1c3003f9af3bbdc7b0c72220346055d8c1896aa28614a29e08792bc6e773c02647c12a108c1253460355d2fe1fa725a28a6784a403df0b7af8ffc503c2c3c71427f8b6d911344345b772acc69fa8932c76c3d1870071edbac002db9c17d9f34d14c168eb239bd82033044f9cb8b765c7e152b3bb372caa8b5de03b78667a321dcf4ffd6a269031369ae4ed01eeda69798c3d8d7831425750ace8bedcc598d7279e822817968af291fb01b3b759f24ca7d721fd375476cdfd0e34a117f0a5433f0254abfa96f809aff30d8c004ed64c299648e707252c47bb107d0b0ffc2e764d9603564e39a3dda5f4d887c171d1e7c5df2e72a322aeb09ffeaaec253b1efb33e440b393e6e467ee52205c2156b54fc4f3be18625ba09c782bff11d3c501247bb33cc58838cd55e252a2ac621c62be0b347d32194ecaa7cb293b5534d0c875f1e6e1a367b89a157cb4b89ae868a13e25291a5af441fa284d7eb361277a743e44b370978bbf3ae42b63db46805d5e54d690e902c7ea9f19f5969705178f4723e01b4f835fbc2bcb9e9dcc1c1b5de20ee3d5ada1188a04f316fe1a7e9020f33c242ab06ff28bd68a94113e7b07675a19e4c7fe14def843897d892e354b87894d4b988d91c00f26155106a909374a980c67a5466496f444f73f151a8c881cc58fcf03b472f010c470e03d7902494880389169544f037ce071ebcf653cc905e6996571181e2b576a7babe2ca7b510271e135ab5871e9e304be675948e9930b2e081ad4aadd17a1a4dd9203772a631d96d3d8f31d191983f0908b79ba0fdf5c6fd7c11e214c27637930a6581c9b347de631078db0a0b954788a6622d99604fbf20c4a653d03fa200fc1d914a0d3a587c05d0fde1e132d9051d8fca49f923e042d749ca7cb099eea3dd52d5b698514cea4f9ae579ff3972eb796c49e62dfdedf14f626dc9c86b24ccd5aaa89aad11e48b42fb2e80c37706469914aa6ecda82e16aa72eb620d9387ac073bc71d8bafe02fd413eae4c48d8fca9b1634132116fa18ca5cba7a2a08b27258b9223f21c7b62864f1c0c812cb44278251dd8fc45d7d21fb7d713917be58e7f727cfd832c96bb528e70976e4f6292255789e083e27bf655b0e38a474308d1fca4b164d54928794747ae63cba1f243e95ffe0f1e87168193d479ec495b42cd51968564018b81b14435a6ef80c46ed624092f514431c653792a1548415497adcc66ec967f0afcba3bc700087d9f6f9acc77edd8268498a6bc4c003c93a65bfaf6343b9f50f1be90b228a919d9e4485982090e68b09e55ed34a6d08ffaf7bc3144345b7d294b38801d4a2f312780d8ac651ac95dfac24b828708d3238f87e6bb58950525ed6d27d136414817c8f8b3d794c60a5376f04a4526ed5c8e319bf504b8385f3f5d4d6f51a0608b7948bb3a901a3c89ac92924d6eaeaa69cc7c83a89add0c465c43f3bd31fc047fd52860642917fd0bab32deb41008ae16fe293e4e98b7865e22e9cb3d1402bd5629eeee375dd92bc9cbe16d55fdf9165b52d6cbc2c6b4d99d671167dfa6ca253dde2b5cd8233f4d65ea90ca81685ab9b6befdbc2bc951dffbf9dca5443834bec57dba2b479c5c23c0257002061ac256abaad5953104786e8b650299923f8a954f2d45bd3a4c8b71bde5af305e2e687346ca660147c18a38611af3e51c4c1e3c349130b44c34bbaa5735133e372a8c57af5c4521b0d86e4e2f6a31a05a1bdf86d6f146ad284894453994b82b615555d2e9031157d2f1bcc22163e89bbeef3ed534ec71d8caacab8cd6b20f3c2c8457d73d180ffaf7f7eac4c6248db0db019e51826603fce8122c27a33326d6e517d92acaa0ae60eb34acd46ed45620e1a151375c5337023ae84a1ad79034596cb9b9de64f8da7a056cd96b4fbbe85ccfdc3d1522dc8f8b0e4aebd2a289ace939ff5ea138cf4a10eb47a5ac4af9072785e3f6cb41250e604e5120dbb07fec58aba9e928391cb0b30d44410d88956ea88b5d6260ba675cd7e92a54667d99ec292b3603f4719878987a8be300d5bf6130e1a2541f62d79ed4d77bcab989a55cba488576338475f5c852089b9840d6400fe872e19c602cfba4cc7d505c1655eeda471667efc37aa792982e8ccfe49a9676bc237e0eecc2e769a1650abb2ad2023e88f3960f653fe42e0a0ee0f6f9fffd37bc39ce77186498d8976d02b422c0f6d933520a617501fdfaa830a7314d90905eb81b69114283996238700aa727e5c49066188ebdb58dff3c06e320995a34dd93ab1d1a4547bda4051a2f995317e25e35cb6e7696e1af603815db47222ef68d6a1b35f3de76613fbe39f334a1477dd7bb478e820dc97a535d0905d77efeaa4b196cae574f5227faf800e6700ad96a02c4967473bdc391231fae9df3f1cd8ef1bbcfe55b41d2ace540cba9d958fb7689f2993c5c0ade6083caae295bb6b3564a90f28d343ba13ea13d64be2c6bbdb0e8462abad98d3745c23cb934dbdbb118ef8109d1bba70d0927d1df13904ab583caf49524a6c4d952c43f2b3b9d6bc61ec71e8aa73fdaa095e42052c5b9383c1d2e346248917dd35d9649b105ab322e546150e512e8e162cbaf16433c75e0c5f5bc01a40dee422453db7c63e5423c1b0081838fa4edc3aa3766c9e8b26ff75b59610a27f2e4575d47a8abfcf4e46f87a593393759b0090ce59c484a41f2fa5555cd6281f450ce7f24d22af2e6d7a385adaec96ca8c5de61007c8e355310af1f22f3a7c3267ccc382ca20054ea51cfc6c1c6c2a0c399a69a531c215a8a70a67b7a683bab2e9694012cbdc09871561441f29e0fe680079d2fdcd0d21bcf050c369fbee64aeba57d5861e1be81a5cbb5012c6963a38d2b93f4841dab571d9b59759d320ab70dd62d3f85a1926db224760a26b4ac96e944199c7827abbaf5f5270122d91fa3f0eab440966e4638fe5e0a1e7c2d16b753d4f19acf0252c70151b1881d2eb8775d02ac5c0a5e4734c00c5a7b6c6c7835220cdb151bcd8cd16ea06d1e1d4f0a7725b453038e6560d8c9b969f748911d43e679fccbf62040090fa907208e7ed69b41cb351afae04478f173309af5a4757deb05934208971aab0d8e0f895a4e04d1fb568b6c603c837165fc6ad3ecc6aeb4ed6bb479ec21bc2ffe3d69a214f78231276a7b45fa9b320ca1bcaf9cf8d48361aefd1d0540eaf7c3cd12ad8229bde59e789dc1078329d9d7f34df3b671a91b84922af7a55369f294f1b0952f03f0ffe8274aff2517a3bc495b0f58d8775901f0124fa8da24d67d4c471b1fec84195de8e2e4127a2032c5d506bca88d4bc3db9ce83c8be2f1d3c2f4655a1bcaf6c257d180e10c376cfbbb87a2dd02ca779e288a22f41fb573ec3d5ad50ab1ee365101acdbe6e62dd95af8b87eca768be52bd9a1a6f054e8f7bec8269201e587158cf355d5644d4a524fd155b431d76b91df63f974232df0ca112380fee24936570748735c3d39f72d84fb0fed49a9001addddb9cfbef0b2c32a1535e16d47c434f6ee919934b90c22982eb1145db50f454e2eebf1307750e232e583ffac11f55a5b5677c26d6c41d76bddde9b60a85b20e31a8e5456fec184116f3cf8925d26ba297c31f16e63245753bedce6b17756e5d691c371ddd54241490e46b9f17ad340b3042096a650c597f56eeea25b6d128a940fedf08013ef5af25e94da12f3383c320ec7426594fdd4a05578b01a5b48246a75e4fd24d590550852c912fc52a00c72553660503395671649ff8f4b04d892e2e7eae0e5835e458505fead95db9964f4dfda8c5b40eb573de7b6849c1051a43c34472ad6ff1c5ca506d2a765c9e48a4a46b0fc107f285f0145e38d495da5a2df3c7a80274255c4aa5659a05a57b65f1555036e12b28f283402deff5b549", 0x1000) ioctl$HIDIOCGRDESC(r2, 0x90044802, 0x0) 8.008901362s ago: executing program 9 (id=6491): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120120004106cd40cd060d012b1f1bd5000000eb09070000010056710be3ed6bc86cee9196dc00800009dfff038140060905870318729ada3d1c35bdf4710894615d642c81"], 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@mcast2, @rand_addr=0x64010100, 0x8, 0xf}}) 8.007607902s ago: executing program 7 (id=6492): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x74}, 0x1, 0x0, 0x0, 0x840}, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 7.543952646s ago: executing program 6 (id=6494): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) write$char_usb(r0, &(0x7f0000000280)='L', 0x1) 7.050853901s ago: executing program 7 (id=6496): r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x4000, 0x0) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000001c0)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2007c15a2f4479d3f04e80db35dbc480b543fa510374efd748875681f727b41f903726cb095796bf01d3f23d7027a9716b89d9c0ab84e451d570ce2a863d6c5673c2bf99f8655c5a8e6799ed812c7d3451562d1d9ed97b5411faa0812452572124232ecf2204063059c748f099716ad4b4984467efe19724c5959fd4e07c26a770fd561adf648b458e54ea64c0f82ad11c3ff6a22c77101768bc2c6b61bccd5f7f39aa14aa9ae2e358afe97192471bb47c9734225fff183eddaad009efa683c9d88d0000", @ANYRES16=r3, @ANYBLOB="43082cbd7000fbdbdf25040000001400018008000500030000000600010002000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000084c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020025642532000000000900010073797a30000000000800054000000002"], 0x40c4}}, 0x0) rseq(&(0x7f0000000040), 0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x9) (async) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000880)='ns\x00') exit(0x6) (async) fchdir(r5) (async) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async, rerun: 64) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2, 0x204031, 0xffffffffffffffff, 0xffffd000) (rerun: 64) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f0000000200)={0x3, 0x80}) (async, rerun: 64) sendmsg$NFQNL_MSG_VERDICT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000001000000000000000000000005000004"], 0x14}, 0x1, 0x0, 0x0, 0x2405c005}, 0x20008890) (rerun: 64) 6.930504794s ago: executing program 7 (id=6497): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa5688a828008100200086dd6d00200000081100000000000000000000202a0000000000ff020000002c000000000000000000014f194e20"], 0x46) 6.582491216s ago: executing program 7 (id=6500): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2, 0xfffffffe}, 0x1c, 0x0, 0x0, 0x0, 0x120}}], 0x1, 0x4000005) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x10800, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x82}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/6, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 6.385661938s ago: executing program 7 (id=6501): r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b"], 0xfc}, 0x1, 0x0, 0x0, 0x2000c010}, 0x20000080) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000), 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000040)=0x7) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e1e, 0xfffffffd, @rand_addr=' \x01\x00', 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup/syz1\x00', 0x1ff) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) r7 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x180) ioctl$CEC_ADAP_S_LOG_ADDRS(r7, 0xc05c6104, &(0x7f00000000c0)={"0400", 0x8, 0x6, 0x2, 0x0, 0x6, '\x00', '\x00\x00d\x00', "0500", "fffffff3", ["50d59404000100", "ff0100", "0c432d8b5c781543204000"]}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r6, 0xc0884113, &(0x7f0000000080)={0x1, 0xfffffffe, 0x9, 0x8, 0x7a65, 0x0, 0x26, 0x0, 0x2, 0x7, 0xfffffffe, 0x2}) r8 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newtclass={0x3c, 0x28, 0x4, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0xa}, {0xd}, {0xb, 0xfff2}}, [@c_dsmark={{0xb}, {0xc, 0x2, @TCA_DSMARK_VALUE={0x5, 0x5, 0x9}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0xc048014) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES8=r7], 0x0}, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) syz_usb_control_io(r8, 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000240)={0x0, @aes128, 0x0, @desc1}) ioctl$BTRFS_IOC_BALANCE(r4, 0x5000940c, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='bridge0\x00', 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) 6.314452902s ago: executing program 8 (id=6502): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) mount$9p_virtio(0x0, 0x0, 0x0, 0x4, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x40) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, 0x0, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)="34a9de6bd7bf6861118f95f1f8e5e8f18261e600e62712f1627bfff46fb8cff18515f5c6855b6de7e907186049b489cb4deb83ce69f22808fdab041f50311c50e1ee8ccede125d11e0682c", 0x4b}, {&(0x7f0000000180)="80526345ed25dcb502741b2277fe7b926fbb8e90d1eb2cc8734a6b456f03667269d32f9a3adf67022fadbf79ef333b3d705a9d6e0b9b863ab227e12b99e2558932ee7485f12048def3e745aa0d77336a6aaa4cfa352760a83694eecfa5fe1e33e92d9a33c7455b4019bbd312add6a8cf4d2f58e302bdc8f0956c5bca26b40e0000000000000000", 0x87}, {&(0x7f0000000780)="c037fbb324ac1cb0c52deeb75abc2304c2975e61d6ad33966a27618ef99f65b5607d3884168a33c3e7948985f354b612851e6d3e11fca8f7e5f98e3be9612bf228d401a4e955c3a23479eebf2c5a96c388b6aee7342cd74d940bb0fd7d04dfb1a3e09ba2e8f618320de3c868b081138e83ede914dd9e5c58bef2f8db0e4f6a6faf1209c2eaf0fd790e0dceb539fcb9f94ebc51ad9727c8754d4eb41182d63e76dda6a2578457ae5940752c254c1497ccf08dcbd2544268c081175cbe890480dda065b7cf1b559276832fbab4b28d8f1b4c50c1b49d4f6303f2aa3b5ad3c54c299790e1dd1c8a6756718cd1f631c733a39c5126fa879888508bd666686cd41060ffa21b89d5e4c086d8744289e99b3628b05267423de88026486cf678e73e96835ee1edd3757ed5c53818b520a5eec4e714e803d1d92376b6bbe1f9ec0bd40d5613eb5e0971104236b27627b9162a88996560beabf8ac148d625049267ddbb7c9bb00b51008887a29b150981d731da43f8fec201b1d33064ee499aae0b43587bbe56b4536471de991029c5ecf9a77b17cff450302a7d3e17fdaf50eb4dc4cee1c754eb1c06567194d8b42153a6defbd287ef506eb0b0e23fb44c4449618751c9477f4ac1c03709249af0ee53b", 0x1cc}], 0x3, &(0x7f0000000300)}}], 0x2, 0x20004840) ioctl$F2FS_IOC_DECOMPRESS_FILE(r0, 0xf517, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) syz_usb_connect(0x0, 0x10b, &(0x7f00000002c0)=ANY=[], 0x0) 4.791754614s ago: executing program 9 (id=6503): pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x122000, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x880000, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@noextend}, {@access_client}], [{@uid_eq={'uid', 0x3d, r3}}]}}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f0000000240)={0x0, 0x9, 0xff17, 0xffff, 0x3ff, 0x2}) r6 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x29, 0x8, 0x9, 0x6, 0x21, @dev={0xfe, 0x80, '\x00', 0x16}, @private0, 0x7800, 0x80, 0x7, 0x9}}) setsockopt$MRT6_ADD_MIF(r6, 0x29, 0xca, &(0x7f0000000340)={0x1, 0x1, 0x9, r7, 0x6dae}, 0xc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000380)={0x88, @private=0xa010102, 0x4e23, 0x2, 'fo\x00', 0x0, 0x401, 0x2e}, 0x2c) r9 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000003c0)=""/217, 0xd9}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/103, 0x67}, {&(0x7f0000000580)=""/80, 0x50}, {&(0x7f0000000600)=""/210, 0xd2}, {&(0x7f0000000700)=""/14, 0xe}, {&(0x7f0000000740)}, {&(0x7f0000000780)=""/91, 0x5b}, {&(0x7f0000000800)=""/20, 0x14}, {&(0x7f0000000840)=""/207, 0xcf}], 0xa, &(0x7f0000000a00)=""/237, 0xed}, 0x10022) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, &(0x7f0000000b40), &(0x7f0000000b80)=0x4) r10 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) r11 = dup(r10) syz_kvm_setup_cpu$x86(r1, r11, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000c40)=[@text64={0x40, &(0x7f0000000bc0)="66400f6289f8000000400f00cf0f0facb5aa95ffffaa0f320f35b9690900000f32c74424004a510000c7442402d8000000c7442406000000000f011424c744240029010000c744240262000000ff1c24410f005805c4e2fd4517", 0x5a}], 0x1, 0x10, &(0x7f0000000c80)=[@dstype3={0x7, 0x4}], 0x1) ioctl$KVM_SET_BOOT_CPU_ID(r11, 0xae78, &(0x7f0000000cc0)) mount(&(0x7f0000000d00)=@sr0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000d80)='aio\x00', 0x1040050, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002040)={&(0x7f0000000dc0)=@isdn={0x22, 0x8, 0x4, 0x4, 0x10}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000000e40)="c077b0c912fd1aced2830f1b3929a3513b5771d185693b31f0a78964f35aee48186a8a6aca31e0a74ec5624d017ac7eb1df9a658b7a9ed12a2e46a71fbb66eb0a63fcbbc913707b319505524f423962c41e56f334da21528d89e5d8ed0a70aace59ec54b01824e5170c4fe8218d43470ed660c5a9df7277fef743100f280b54f450f99a685e32c61c8ae2ba9f82b76216852d9d07a55dfb4b6817ce5304675bf2c2d64748da86404ae0ca62f0d8e305777b8223543f593870d47c453aba3aad01796cacd586a8cc9089374f3cf62a1cef0cba4a5e615f12cf00ae702bd4563781ec7af2028874779761ec31da39d6338141c50adc77a2a0431473a0a9382133decaedc059ed9269709d294d623bc70fd96359fc42486d1917423a8b28f24a202b88606789cf53f7c41ca2f7464803855ec9abb77119ceeeeb53432782ecfd6940e3225c028027ca9ffe136150d7665cabbcf5e771a46a32193d19ea9ff0572d7172789c4404ccd342dfddc1bcdbd736f2d1eee1f0585728df69e1b69be0a033a6fc2740f42f446247f9f6c7a9e178b0ecbea6f0fec016bf75f17a2ecb12ba4cfed60e4ce5564e70934f569421d7533efa48163ea610cfe46a7e5f409a365c359080602cfddbbe7dd19f3d49dc4e065b0296d70fe7ebafc3f5bf330b8e789137a7a465c7147a9857a0d21a685412d5f32a6dbde002b021f9d0f70cda93f2adf72e25b71441c886cb7b22839858cd1619d04c844a367381ee66dea79b0be119a01eef68fa09db339db9240f17e561d70cccf74e8f7c712e11951fd555b85c0edbbe25ad54d753c06a9bdaf90548bbfc24b1324b200a5922c17d681ba42383ba626426c997174341576a4a2edd8d3a357ad2e89f90e2e7c7ebedcb661cf75bb068cdab788b950e62cc15258ec1ce485f52133151b2bb82f07e808e91068300cc7314e97a60147f4b58448b53c970f4857e6b45c9432706b8dbfa7928339e92821188e6acd656db05d6f0ba6670cded7d5b1bf1561a0c7053bd6524bf3c61d7a2fabbfc213f5e2ab1cc5ed869d29e35daa7ccc5317d6c6265e3bfb8907d6cbb7ec8c5f0a4f6ba89006cea9b69fdb387081562a0490b53aaf0f7aff767ce42837a27934cf959c0df3022779e1dd48125fe08bcd929c76b58edf29e67a42aec3b9958e947f95117f0e8b5837151af8f9e8f902d733089dc89f4037f0f7ba24d69ffdaefaf02a50dacb2936ea6a58defea8393d5be130bef746c68a994d557dfd76a60f33350296046df8bf880b2bc650ad11f326952f9a553ed5e2f685d01becba1a035359d6442e35d907ca3eff1ede96d78301ad0ec148ea154856e65f3b9c811f6f0e3d20d57e3ea0babc84ad50f65c974f367c89d2eae03d540e26102616e21244733324a3940d29ba75bfc591dea889fb952fd200f64da27bdd90724f54882c98dcb0216d3bad30923064cb244cffa6910dc3f5b078a7d6aeb39ebf4241fcc98a5d2dd46e71218d296ed31340c48ee7cbe6a4cd14570a325d1aaa99c5d226d95ad22904e3203a09ec4a8cff84dc23ec3b697280c1139fab9bc805bf5a23d85bdb5d497724253557f25f2a7d47f6373d02773e939189f8b29621631b16f099aa2734eb82cd71312158ca8bccac9a6d4276831c2dc9a8e5874abdde66b0873d69f44efbe3a5d75be8929187d95cdaae062d2805597bd65a4db0888581385985bc19ef9a1e83f65d61baeb44be32dff32e4ef8084b4f52fcfc7c701e53230cfde87107bf35d9b917a190acfa43f4ab0c03465a8f5fddd39cf631a48628f69ea6dad7923b3019f4abd2ea3119278297ab6ee1f471e291d9c86dd725b49eb44c6e1735fbda286261d617e1541baa9e1a16ad899fbfcd9c73acf8e074629a31baf339a78efa99b0bf73d020e4b8d47d227da2a5aeea00ca0a7e7605765263cb3bc8b04c46b9de2951196e555168e1f7cba42f85e0eefeb1d435b05669dc0ea57e98b171d10ddba1848c1f2b77feac2d75d02577bad062385c505a08d20d39906530fbd7f5192dadd8343ebf5fd8d66098803f41275699ac451893d88a4cabaffcd85d001d52563446ff90371ae06380e192c318fa1f5816c9bce8fb0841c1bca885026283fa9e4fbc4abc85879be5a4d01df00e07365a8b188ef998157d152fafc60f579f30d38d12aca3c170a3a4078c7529dc85a1fc78040af429d09055c403b61b7c1f154660cf79832a5bd2049511e4bd4eb185ad13439f2a26086541c1802c5b21bdc36262a99c676e9f3af378da43efced660fb8ffd61efadb0570728054f157f56cf583c783a11a6694176afcbe25abe0f3b6a57d027c721f311ab22f3942f8cb3b55d6fd3615f1e2a7d1cd233666398169f2133acb7ea3ad611c47f534f2bf8a1beb48273653da595d29216b4526b654a75da404c84cf07c51f33fa38f35b9d8a9e7abfe19c0bf3030793a1e739dad43fb1e4e02cf895b19b35f753198bbaf7037dedca47ea14b286d4ed5c29ebfb867eb0c4463544957963ee4c6ce13a113e0aeadb31e700218b1feed9f0deb5f4385df9aba9e8605c2b46f1dcfe8c488e1977a424f2d665c5e06d8fc334b7320413856b64985dccf5f449aff51092fa56c40ee75f672ae52fd6214c59edcd8472b6b01ca136fea0ce0cf5c830921fb51b810a077aef3bd04c20c6d7da9fd4733009f038613105e512365a08f6c31de2175599389ecb2de8091c3d9eafc539a11ece4b8151d01ccc42d380c5aed7c66d0ef292af4fe1a67dd7cff3ab8ee6fcf6f5d9e2a289be01e96ab3f7f89ecedf649eb21e299f2b59bad9216fa616fe9e68793c8c89504ef591f374cf11ac113998ababe11b53696c4c240db048636c243f0374c865b5491ba2f3e7c0c065538c25c3f19fac5e9d7b7404f5523a4ee4ed217b3994a49621497ad9abd7ca9ed5c83cb6128ab42df2a87897770ca971bd914f608938d0baedafbe61cd212f4b6cb9ba95880e23bb21e31a527c8f2e53c62e82095dfb687377f6247d4553377c09b4dddc11e683a9b3e3a1613eb09acfbc084891a12307807ef930fa1cb11b9cdd56eff04f1f379931aa88106e095f9d07a8db31c9db464ce26a570f12817f5f2ff294c2db92aee3fa6c843ae20d743e891bb63be4538d3f4d43952a8826fbd3943511754ba93bdf01f81290d4f56ea869b13923adee88806f5321dccd321bc90a93cdf42df1e9f923b054b01ef2ece4e0789d30c14a034e00205687fb1e74c7b7bb4f37a5337ce828af584788ba52d619a5f88a0e667aecaa214a7bc914853487d849bf06d70f6378bd546ddcb26a6c850fa310f6c46f945aeb3e2a33ad03fd8b494b476407269a01d8c471e7a20e8b7558b5411439d36af1667994b56adb9a350140c01448d79a5a7817af9c332d275abea8153a0b922d921440cda72f8c985b049661094547fa57e4bf1067ac745053105b0375bb83d0f7fea07c591dff6f2f02fe9f3fb13aad76c79a2d305edb6d2db4644b73f733e5e29a3a912faa3e075d3e373746eccd7d7a1e8fb6f160009aa707661a66830b6ce4e70a49ebdcec32c64cc88fbce68d54ad585d3e1a6be1e102acb19c40ae42b916eff22731e4a1c3ab4d868fc3709ae5f47df8257aa6ad5bc3adb0281a48bc3be9111a0b3f805820b57e43aaa93705a54665fb6ceb6f2b84d3ef52854b8f285d580ab1c93cee5f7ca51eba4ef21117d800a6104bdb7c117021cb4cc00fc9bc70b5a4ccab31a80761179a1ba6e1c09770e5656a6ee6f0b9c087577c7955b8dff8e3d451c28667d202f09675baa0ee3885d50aabb7da50a1492aab65209ad90035a916458c3296f8e00a0ea5e3119976a5b411501c0c8771c69eb10b5b9aa824b2a49b45df8167dae4210b907632f7a1e7c884fb7941ca79fa0fa6cfd95b4d6d4c77ab18ac670dfcdef096f8b6399e1d3d176df878524a7af4daa17d926a02326fbe04676fbf99cb11d3976f8c2fef923d269a2ad435a5222adf61896be350afe7288aa8804c757a4191d523fcd25627be34fba2ee01ae29c2d1efa1f09831b775f96842c99e07383517a1e47f7635894b0eadbad0bc28d240f4434e7c99f66018f9562e0c6a5044c82c7003f2f38cb2e41f0eeb5466837e20071025290d5bac42922fe133826c244099d0168251641c57b538422e75f1d3571193a76b7f0f8292701335df65dd4e2d9275f3c927c174010e6d882d2e41226d38bf4fb91ce503670b2da50687e822a7c7de721fa471427e2abb4ae112ae8f35a3ca21ca81c42433fb0852a3a8cd63d5ffa607d81ea247c43136bb7f59db5d50ef4b996e71bd6e143bb7ea519651baa9f6d841bd44a4b0a937583297ce9b06f9c638e2e28462d474d7612b5a7f73ac80681799cf57b0ce2a06b8419ae04d102149f7ef8a80ddc30ca63e458dcbede0ef0e9a7e5dd6258565ce56a65c3480e83be1c83d242db9ef9f3b00d4ebb45dec7e8e7ad311ed34db5596f17ca9b317ac0876dd991e3ab0c79bf63a1a2bd5bea4349f4abace611300f3a78e9bcda3adf0f82feb56621279c2746267027f1cd56d7975cce29a7d97e88339815f115c764e6ff8df360293e4312aa6da19b9d536a33a0854653079b455e8cc759b8bf640a9aafe4357c8d7836926537c7ed149e4b180cb1885c2b8ba49fa3ea7bf2cf44a178d8165c6a2b21ed8f1db77c2ee1651bc675e942fab07e86222268cd4f6d80817585b0134dc66685754447c37b4ffa97f270456af14da254a9cf9d3da6d24f86ebc2638f0f41dc4fd45d51e65a8a7dd2b00b842ad29289d1bda799eb797d745e1bb918c2de8600995446a36c666f50092bbd251556c14bff6163a66d50a91d788ccdf18e6b6629d1c04e03e72c81f2d593ddd9ad96b74616ffb9798281bd9fe817523403b53001989fa5be9573ad4dce30899136bcc989bc5d0211c37bea7ef1662bcc4487c90deafe1da688dc962a03e7ae0fbd12a8f46c85138912e7f3d5457aa4a2d7e738c26f6e817aea91ef81b81427b15c6a82cf3db1f5f95aaf4c21c3cc313738404d23b4dba0d7487250a4277aa03742eee632720e65e63a4f13039bff527ae4e4b900a4f6d50cb935cdffbafde36ce20d94da8e781108e5e4a638ede23f1262131d9fe5945a54b76833a87ce6d622e110f9764892e7b919ebe84052d1b4c52b01fe797b2579263f04ee992efd793d24a718d10b2cc9d9dce9501fcf958f3b433d9cfe934ce7765c0547e3e57f1e379e83d6631c722bd21d853152f4fa234cd245949376d163adc25f409baee900fa29d1279867e575002458cbabc17c5d0d7389986873b01d1f608ec1c946ea4dd8fd635b06c3345d3561141e10ea8b55779190cda56e1bf8b52bd043ee289f6f505fbdf868c199d76b37b4ccce814b02ed177d821ee683d876214c7ca3095b18ff60d029bbabf863b6c86e39b58b170893977c2d29551c6c1781d7a28d373c7498cdfc8ffe6f21ce3ec57899d88a5ad228d96f75db7cf3afe8e5fa72f140eaa3c76e8d9eb22f898ed65776bce52154fd229d1c42e6f5664a53e80b410416c8bb07bfeb80749b9d8e3675ac95601ea4bd8c8aeb0d9e565f649d551cd3e8123feaea2c90dff19862da252d2e54decfa7e29d46d050264769d4022ca8030413008e5e2f74cf66512e7b4f274fd39ea75801d3c8bfd1b0ecae98e17683b8c4d78ea1626444d597c9d7567a70199c3a4614ebdc34539d2cc701384461f306f3a4c854f31e58e6e4a527858b46e9703bf57ad363058fcf80f867587ceee4f29b0f0adc4999e0f74", 0x1000}], 0x1, &(0x7f0000001e80)=[{0xb0, 0x116, 0x100, "e04a9c99efc936e883dad3916c5b6306089be68958f0f75bcf7f7ebef5c7006beff5cf0aca8c0b4fa51ecb20c2e836c2eb38d72ed0a88322c36cd7221dc07bba1538dd060c748a82ad46fc18c3011734eb4e56b4c84a30b0eed036943afec78fc356b70aa376c339c405df2119f8a1fc58c1667584a720b45b1da41524cfd3a20c585f2b7919d60d6c1b595cad3be3046a8c92f22fdee14e855e5c7d5b"}, {0x58, 0x10d, 0x0, "5d8f29c2095367ad190ecddb68865cac6a3786a56c9f4aff13368d4a15db27fc7fd71b9545c7a501ac6a9aee2d345d993460bedd8052738a2fc5dc608d557ea877"}, {0x88, 0x11, 0x2, "67d777cd5ba90c4175c185fd332497afe8918162ab3d51258570e14c0d220913906ff0000b17f72c8f2b0b86683e5dea5b71dc16f4353d597673c3f1a786f8089345be46d9d738b9cffaf13ac158b153765f90e5704d52591e66182bc31674d4bf1973935725da5eb786513bc4eac93c15182ce5c55883"}], 0x190}, 0x20000040) ioctl$IOMMU_IOAS_ALLOC(r11, 0x3b81, &(0x7f0000002080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000020c0)={0x48, 0x2, r12}) ioctl$NS_GET_OWNER_UID(r11, 0xb704, &(0x7f0000002200)=0x0) mount$fuseblk(&(0x7f0000002140), &(0x7f0000002180)='./file0\x00', &(0x7f00000021c0), 0x810, &(0x7f0000002240)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r13}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x8}}, {@max_read={'max_read', 0x3d, 0x5}}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x600}}, {@default_permissions}], [{@smackfsdef}, {@obj_user={'obj_user', 0x3d, 'noextend'}}, {@obj_role={'obj_role', 0x3d, 'wfdno'}}, {@context={'context', 0x3d, 'unconfined_u'}}, {@smackfshat={'smackfshat', 0x3d, '^,*%'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x4437}}, {@smackfshat={'smackfshat', 0x3d, '}*(.\'[[{-'}}, {@smackfsroot={'smackfsroot', 0x3d, '%:\\{\\{&}\\'}}]}}) r14 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r14, 0x84, 0x6d, &(0x7f0000002400)={0x0, 0x2e, "2e9db3eb60cb75b882605f82c2c686240bc0e91160e0a82417cfdf329d3e9b8d9473ff704864ea48cb5e8d850890"}, &(0x7f0000002440)=0x36) setsockopt$IP_VS_SO_SET_ADDDEST(r11, 0x0, 0x487, &(0x7f0000002480)={{0x2b, @rand_addr=0x64010101, 0x4e23, 0x0, 'lblc\x00', 0x0, 0x9, 0x52}, {@private=0xa010101, 0x4e24, 0x3, 0x3, 0x9, 0x7}}, 0x44) sendto$inet(r11, &(0x7f0000002500)="fd56f5e86f55a243fdebec92c7b4e0e527025f33c9ef", 0x16, 0xc080, &(0x7f0000002540)={0x2, 0x4e21, @loopback}, 0x10) 4.393650595s ago: executing program 6 (id=6504): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x74}, 0x1, 0x0, 0x0, 0x840}, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3.807231481s ago: executing program 9 (id=6505): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="606282f3964044fe958f6ce24cfd756d7a9caa4e6423773e30e382103e7807b7a8695966c8363d6f86ef7aa333fa858474cf44700b9b8929ce20672315ddb824acfbb22db7a6daa7b85fc884c8595e18baf5b516e87b1bf3874efbcf6e00db4fa38962a35fe522145cdfa5287f0e99845b56bade731aaeb4740df3520c8002d6dee45b33ce25a06efb5ba00ab9c909cf043cb8d5937de4e4abe43004c547", 0x9e}, {&(0x7f0000000100)="c9974beea79ec3015e9c09e503cdf428539c3ad578c7ad2d8a0415ffb6922900340aeecfc57f7f5129392917201b3590932eec4cdad35644bb51f3432ccc360a21a3505d1e2c41d5dc9861180f6ac3ebfd781f3f3648f2ef74a4035f630aa2087fdd577b893701f172db607019649513eb45c7c004071f", 0x77}, {&(0x7f00000002c0)="f29e5c083552c4c37d5cb31b6cdfa2111a5fa5c31543a5bf49a24e3c72eede0082f9b855cca47aeec27a9c43e7abb12c50df2727fd2ec1e0ef7f8dbdbf498e1f820d4558fa89445d1ce88fe373f7be2d3d03eec8170550ebc9e1235b6d833b17a05d13109d182c7f8f3c3a52ab150b95f81e7f747be6b4302a04283359c3c98d2b40e095271e12cc76073af4bbcc32912660fe4a51dbd9630b08", 0x9a}], 0x3, 0x0, 0x0, 0x1f000801}, 0x4000000) 3.762475056s ago: executing program 9 (id=6506): r0 = syz_create_resource$binfmt(&(0x7f00000001c0)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) r2 = fsopen(&(0x7f00000000c0)='gadgetfs\x00', 0x0) timer_create(0x2, 0x0, &(0x7f0000000140)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_settime(r3, 0x0, &(0x7f00000000c0)={{0x0, 0x3938700}}, &(0x7f0000000100)) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r2, 0x0, 0x0) symlinkat(&(0x7f0000000040)='./file0/file0\x00', r4, &(0x7f0000000080)='./file0\x00') syz_usb_connect(0x1, 0x24, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x68, 0xed, 0x81, 0x8, 0x923, 0x10f, 0xb1cd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xc5, 0x92, 0x40, 0x7d, "", [{{0x9, 0x4, 0xd3, 0xe2, 0x0, 0x3d, 0x25, 0xd5, 0x6}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) symlinkat(&(0x7f0000000180)='./file0\x00', r4, &(0x7f0000000140)='./file0\x00') quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f0000000000)=@sr0, 0x0, 0x0) 3.456287436s ago: executing program 6 (id=6507): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x7, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r1, 0x0, 0x0, 0x30, 0x0, @in6={0x1b, 0x0, 0x7, @empty, 0x3aa7}, @ib={0x1b, 0xffff, 0x0, {}, 0x0, 0xfffffffffffffffc, 0x6}}}, 0x118) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = memfd_create(&(0x7f0000000a00)='\xcdT\xea\x1fd\x1a6\x13\xeb\xce(}\x91Q\x02\x00E\x88-\x00', 0x0) pwritev(r3, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1, 0x3, 0x0) sendfile(r2, r3, 0x0, 0x8000fb00) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f00000005c0), r1, 0x2}}, 0x18) 3.365833233s ago: executing program 6 (id=6508): r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000080)=""/13, 0xd}, {&(0x7f0000000240)=""/142, 0x8e}, {&(0x7f0000000300)=""/207, 0xcf}, {&(0x7f0000000480)=""/170, 0xaa}, {&(0x7f0000000540)=""/104, 0x68}], 0x5, &(0x7f0000000640)=""/115, 0x73}, 0xb}, {{&(0x7f00000006c0)=@hci, 0x80, &(0x7f0000001b00)=[{&(0x7f0000000740)=""/41, 0x29}, {&(0x7f0000000780)=""/250, 0xfa}, {&(0x7f0000000880)=""/4096, 0x1000}, {&(0x7f0000001880)=""/167, 0xa7}, {&(0x7f0000001940)=""/109, 0x6d}, {&(0x7f00000019c0)=""/80, 0x50}, {&(0x7f0000001a40)=""/26, 0x1a}, {&(0x7f0000001a80)=""/110, 0x6e}], 0x8}, 0x2fdf}, {{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000001b80)=""/249, 0xf9}], 0x1, &(0x7f0000001cc0)=""/3, 0x3}, 0x2}], 0x3, 0x40, &(0x7f0000001dc0)={0x77359400}) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x3c) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bde5a44070275290f515410203010902120001008000000904"], 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xd1, 0x0, 0x0, @loopback, @private=0xa010100}}}}) syz_usb_connect(0x2, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006df57108e2042414ebc7010203010902380003960000000904cc070002"], 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f5, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000140)={'erspan0\x00', r3, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0x91}, @multicast2}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000000)={'tunl0\x00', r3, 0x700, 0x7800, 0xffff, 0x8001, {{0xa, 0x4, 0x0, 0x28, 0x28, 0x68, 0x0, 0x10, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x4, 0x0}, {[@timestamp_addr={0x44, 0x14, 0x6f, 0x1, 0x7, [{@local, 0x8}, {@local, 0x5}]}]}}}}}) 3.138553322s ago: executing program 7 (id=6509): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000001100), 0x5, 0x0) lseek(r1, 0x5, 0x1) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x40, 0x9, 0x95, {0x95, 0x9, "2e3b37d1192fc06990c9c4fb835b63346353de28b767d945f2a483c5ac20cc24ed3979b81985dcd2cb657885ccdaf13ee0960d8134306093e4d9e284e1c9aa71f8b90491a59f0dc277105dd952d69d3435913082008f9ded3551d6d30a9aaa81cb549d9815a4d08731a3d24304df3139adc97c2fa8b8d8a727bca639589335ac7dc0e071e6efc19bff2b8682d83898357ee3b0"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xce5}}, &(0x7f0000000140)={0x0, 0x22, 0x10, {[@local=@item_4={0x3, 0x2, 0xa, "9e3ecffd"}, @local=@item_4={0x3, 0x2, 0xc, "91b03526"}, @main=@item_4={0x3, 0x0, 0x9}, @local=@item_012={0x0, 0x2, 0x8}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0xc, 0x3, 0x1, {0x22, 0xaf2}}}}, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x20, 0x14, 0xa4, "318585ba120309a9a67499e97cc7686e5c987aadeb5707464e2d78f44915b720a7a6c874bc7dcdd2e15ee5b7649c7b70acace6ccc5698226c00d2bcb45b3c839502d1e1a698c2ddaab9292360ff478df9d5d77ad653af7b41831b14a6379c4a5ce2fe68a3bd724bb65d1958fcb6819c96811f62d7e624f77dffbee821d1218b9840ee69974349018057f1324ca24d8a2b0e8554c292637eecac5aa0f6b1fa9267e22325c"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x86}, &(0x7f00000003c0)={0x20, 0x1, 0xf9, "e7fdf7dbd7801b6692e48190dbff3b59cb57ac89ee90ed2e74d5ba4635ac548c247f767ab9a1960ad8f9db75233e60d24a2309fb32f240e4fd2c04d6bc4fb60b8a32a957688812683f5e00c0e885ee9f2fb557f0a4cddc2e3f40640b9d6e76ba2d32e289fe221f3f0f3f2e2b7dbedc58fd56165fe632ffbf8e9d2375c72b42a26155648182bfca7cb24ecdaac430c152e00b0ef6721838c39778ff930b8b33021a5ffe25117fbf618d29ecab0add0bc4508e8c6b5fec813492f46538c0af4f375b801f9a35e86ef32081a3ad039ab1430e704404e828fcd62b9d9556da4b12f9016b09435faa314b59090344cc2e2fae0801993bbd6314fdc5"}, &(0x7f00000004c0)={0x20, 0x3, 0x1, 0xe}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000000)=0x10, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) sendto$packet(r2, &(0x7f0000000340)="05030006e8fe", 0x6, 0x10, &(0x7f0000000a80)={0x11, 0x88a8, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) recvfrom$packet(r2, 0x0, 0x0, 0x40, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000007c0)={0x1c, &(0x7f0000000200)={0x40, 0xf}, 0x0, 0x0}) 2.990200019s ago: executing program 8 (id=6510): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a09040000000000000000020000000900010073797a30000000000900020073797a320000000038000000080a050000000000000000000200000a0c00034000000000000000420900020073797a32000000000900010073797a30"], 0x8c}}, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x41, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r3, &(0x7f0000004940)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e24, @private=0xa010102}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000300)='.%', 0x2}], 0x1}}], 0x2, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000180)=0x6b) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x6b) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000240)={0x6, 0x101, 0x206, 0x2, 0x754d, 0x6, 0x9, 0xf, r5}, 0x20) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000100)={r5, @in6={{0xa, 0x4e20, 0x7bf3, @remote, 0x3fe0000}}}, 0x84) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) getpid() (async) r6 = getpid() process_vm_readv(r6, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) 2.604991257s ago: executing program 8 (id=6511): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) (async) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000000140)={@my=0x0, 0x9e57}) (async) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000000140)={@my=0x0, 0x9e57}) r3 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x0, 0x5, 0x7, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) accept$alg(r4, 0x0, 0x0) (async) r5 = accept$alg(r4, 0x0, 0x0) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f00000004c0)={0x0, 0x10, "0948ca94a1cbe2a6c2b19c7f52685346"}, &(0x7f0000000340)=0x18) (async) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f00000004c0)={0x0, 0x10, "0948ca94a1cbe2a6c2b19c7f52685346"}, &(0x7f0000000340)=0x18) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f00000022c0)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)='{', 0x1}], 0x1, 0x0, 0x0, 0x4048170}], 0x1, 0x20008004) accept(r5, 0x0, 0x0) (async) accept(r5, 0x0, 0x0) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x3e) (async) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x3e) syz_usb_connect$midi(0x0, 0x24, &(0x7f0000001cc0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x47f, 0xc010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x3, 0xe0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x30, 0x9e}}}}}]}}, 0x0) 2.382049551s ago: executing program 9 (id=6512): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) write$char_usb(r0, &(0x7f0000000280)='L', 0x1) 1.872572549s ago: executing program 6 (id=6513): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r3, 0x4048aecb, &(0x7f00000034c0)) ioctl$KVM_SET_NESTED_STATE(r3, 0x4048aecb, &(0x7f0000008140)=@svm={0x0, 0x1, 0x1080, {0x6000}, {"35dcee95debee7956912e8b98bb2f672a98ea4696d54103e3c2f64bf04409b4fcb730ffe1896fcbe0f91b4a4054bc5483e8df02d83bd120bc0feb2742f66a60bb2017264e5c95ed705a5bcb876d0a79c91fa7a58e08f3f1dd48524abc825dd135669259328fdee05b578e1dda3da3e11f2a737b3ca1ec25cece028aaec8471d6a4d2d24591222b516a8e2418ba29437124c19da8805020a42ff1280c267a190fdcac73380a54e83efce437668a9c386a62167a73c350b61158b16e1a3ae4e542aff0b7a867e3eb96cc2418c05a34c7e2834bdea3291b94861ad61f66db68f5811659672d4f844edfaa70c8884eed708fa4e7d951def87fba69beaa44c7e8ec22c2a823d2b44b70afe4db084ee5fb74108d8b9013b855c9a8447b2713bc75286297896446113728f4c827746426fcb4cf939ae92e2670800768b918e173fd77c8b4a7caf3d8ef68d47a31763cd64d26b50e54a76b645c0eb6798cc7e51c97449eba15edb63b95f8167e70c2ad09539a86273c5b5b3fe2dda80dd99f666944b199e09773dc51623367010c6035539f43de811dc64f078cff7ae47ce39a1f4d5fb6efa83aa8236f65eb89ccd76e8d486dfe76483bd7af4ac44c5c94c510a99739a7bb4fd09be86bbe65c0c6f32401afd6f1300bb71f53985477eb3ee549e97a9d673d67f7f41c44e02268fa47622477f8b5b5510f27a3229e9082c33be4ab9a8b8d9c7f4f3b79131b854877f22e3a195ed9665d415dfcf5e1f8f28c5f3146d304bca612b72fd99d0d631ef970e310cf9258314dcc426c827cd35085ac3d9845a9e6c18d3dcfa800c639390800fb88dbcd4dc7134df3a525043ab5d8a6ca7003905c91fdea85294bf278c9624652971209ed2c5e7e5b0b4bd33545e230c6eda4a366f9363b73f23ba0ec39c17ea5b22f8def26d1c4f799636df466b381909bf9aaf5dff381ab186663051fa0345a6ac7eaf0b069011a38628d3971ae779f936a5bc3679cdb63d49e5079c43e7168eae8a92c4ff2039bbaabc8aa45e971dfa973867ac4025149417feabf060f579f722decc129da0f78453de9101491076ddd3e87d5622889197c8c609a75b92ac681e304eea317f3138c2f257436b7912c12205b0dc91d05a841e88cae1d0b4dba650eb5880784b5e04b6d2327393e604c4c0651a8b2987a1bc7ba612643190dfb2a08d44ece9adf1bc728bb30f8e44cc7e375fe90f5eae6023f16d5e816be268cc6e5141ee82210a2dbf3f437f4f17503c8c075a17690a48f9234409c5dba4756c3a1743600e26562e4734309a552a3f1a22af84197f0c49de60238e726ddf058ddc2afb84a875ee607271ddd92e68650f1ae65a4059d203cb030790caa335b80f32ef08300c2f81a46b1465d5364a4dbad9b818ac3c3cf54fdee13c9b7a51ec47eed5107978a5258d540face3be9a977edd1e3db6a638333e8aa2872dcecff95b54a3cfd1d9dff396440d8bd2e3acad45eba8bbf3e74b3db7e4b94e53b29dc92dce8118c18813c5941956077ec025436340375f3efff78d1252b908c2281a084c444bc06f9c1bf1e3e654ae4ea7ffeb995b69571ce1ed6582fe3ae03a8ea1287e0414e64ed3748e2f8210fc87576f06d5fcaa1ba309f51e940e856133064d486d25b19a6ee43d310120e0790220af8df9c6c8836c43db10d62abad7d11a64d2bcd7077bf54e5e46ac3ea3deec0cca8605b6d1e41b5340d8831f99fe73fd8391d62fa9c920384f92c878366beefdafa49259794eaba3c36ea56e79e801fd109570a3a8ba75b87ba69b86be2797d3935babe29e331fa19356abf3946196f6f44143ed7c294456b7ebb9576e49a21538c93ff110ea49af801d4d7b4ba9dfba0a3b4bc08e7dab2410f6d8746f5dacfad0986066263d58e69ca7ed92b55668743a2c66321c59ecdff77bd0f0e3ca41e2aef7ec24b191e2f83db3caa9fffc09e14467f9c99a43889c13163885458e4bb391724a73c4e1882f3df89cb85cf2cd3c230567b1553a93ee57f9d566410905190b0208c2403cb3e695f9acb74354ba9300522e771bb57d1a35979361ddba6615e6d31a1cc006caa3be7238098d353ade7596e46708c0663c5d6e87c263093d8b5db02ddd79b1322a7148b60c720c3793731beea9ace95cd1f9e1a5e9af044d2c2c3ac81027c22982024a16bf05308566d91127c6ee12db859ff3d92dc17d800f5bf35c3a47cc73266a82fec0f828ece7cd480c1f0940e66921348861e110d01a07c50503d92aa9d81950d5b9a10ad7fed718873576afa5fe1c2a0bfd3fa905031ba8f9747fc2f0250325f68378118911dbfa4c8ff4937bc2ebd3f7c835c2efa68e8a4392759e2ac3c9db0af1d3a930e97ccf30db9c86799bf4c211f2bfcbc2f27f86559f00843a8b7b7a4c8e7f13312f2157465482afd8dfe879d0016591fcba7e99ad87de28975a8fc885de421849073e64e72f030eea4f21ee045906049ca9d54b839e82abca5b5af17d1d23961f7ac3cae5df77d8a56f6b82799685842cd7116cd2b73d093d37f2d01c60c1702ea20ed911df8c2d1087c8be78ca9df13d5ffceed809baf9761c5e1313631c357b13a12222f5f367f4c2b922fb252ce7269c9c5f91756db4e4a9d7d6a2f249e30df0bf7868bdce5ee3258eb4d783d148de6b5a730b157886414954c81da05ed69009445f96759db429b810cc8d54cd2a26c1db0bfb6d6a3e330be0395f3362058cf9d1da4ac20020b24bca924f6a5f70940181dd256718f57d0643d264c74928400d1ed5c861e8fd5421f75c6b3048c0f5d0170d8bf7f675981683a323cffd6f833112685347db66c4aa60b85ddb5c9dcbea7988d8bc108b3e1837ce96514bc330cfaf4d0cd8c9168a22552067be1638bf2a7cdc8d261c2bcf3b691839cceb40272d294fe3ee6cba1372cf9631ea2b2796158528f5d1e656d0cf0a00c805ffd8cfa2e6d145d0ca1125d38ae5d5767c59b0d8d3cf0f9cb73582760b7f3f7d21547a99a87b093e6eba86de8b7dc041f6871f2a3b8788907ff7e0f56f9563ecb456bfa78c8249e938541bd13d2de5df1deed5ebfca089de4210ea843b0f8d758dba01e409d72af4ae40a75430689b3054422f84bee6ee23fcb9f8db9c904bf075277f6b2a0902ac06bee389304fcf94705e3b5ba6185a3834e9126757fddfe341d1d2c1ca638d708b624883fa7b7b5992ed0601cb560ad8d6063a8e756baa21749d8738b9ba6465328a2722ea49b1462d0ec5a045f4dc0d5d0392059ca1bed6c14757d071c3311fd5f50ba7b539199f5ee7faa5b6c6d7c216f404933b55647402642ed47a7c47f8e0c095f2ad0e59ce0a9c72a4fe6a7fc87c947c70c4f7f3091c9bd48493b9ae87756ca4fdf87505c4f15e3b9c068b2246479be279bea7ee81c215392e035d5714cd807fb9a3e85001ddf1a6ac86648bf4d2be6079f44090f21488f2871e1fa68d3636e393b73624ba5ca4469e43ab5c88b992fa7f2ae35ad5235232ef0d27a4ac82efdf778074242d394392c9ee252e8b32580848414de02e6b00577fab4c9df7fc5ea12333d5429d1d7893bdddb5c0f7bece6e28cd59beed6f1fd6e7ec16281af99841f510b4d6099208af0905df117d5abf806b054f110a7e6d0bd4761e66c50aa125995207d20797b7277eedfdbb27857e0b8f5ad909170ed2190d1e1a0ea328db9e755b9920c111ce4ea85d432858842ed8ddc1335fa5913b5c21e1fb3348df06b6c1a12ca61941cbb6515110efcab334980e063241f105187b54dbea698ef05b0eb21fe08209a9582abe46f92f3d6b9e5f79ca6bee5fdaada49d7ddc3556060881fb6fd9c71d5bc561c6562dbc5db2c8acef02e6a3560ed73dff195ce9cb33307185fceb35516c328c6e6685c8149463d54f0cf450e873e8eb1f4c281e66df4e393576372d0e0d40fc4410351ad008d6d2ec22b15ac0471f6cad94f8ba7f485612ae91588a032f8ea485deca3a24c4e263ee956cb54b211173d912188b283c4e48c0bad4e39158a9b8b1fcd0469bbe1d187d8721fb13d96a88e1d27b7e4699de02060ad6329bf414e3d46318e2e4b9535a03e105baa56e9906f862c1b86ae2ab41c32772897cb456eba216ce08804c710c53635003776099ac28149230c5bfbeec5d472fd190e8ffce322ba3ac808304ee4a177464947dd83c953a8ef21ffe0190fc782439f8ec4d5292f7fda4b1fa828956e352d2d3a92059f58ff4a521ca57b6a56418aba4b43a63347a3b93215725ba202ddb7cf76695509fbbbdaa85a5142d89276cf63eda2a957183d82cf1154fc82d8607293196ffc81a63c6b25106ec7a9a12577bb7749dbda058e171641232d54d81ec3dbd65626da1bd7366cd14a469f462b989ee9ec3db620e40a3bd7034969a0e9af34ea1a029640e8ac842ea5f404c52c9bf089c7d2856a793632d04f7f6cf5fb9b391bbdafccfea9b33dc7cfb587ac8c70f5cbe0d921cd7744f131a73165702388d07e9c03b61b08d930331620a6e6b45579b2e88088a25cfb9c633cb4e37364036d072f1fcdc4c3a56c55c117a39e338457652bc8089e852e7763ed6df523fd7c9cb34387f449e3b3683c8b1542a83997c14af5f71bb167fcf68566255cce7a619b0cd2f9f4f2ee3ca838c65e7ca10bfe5165f91539788eafb0613f48de7f515bcd0ec7eb8135db93e22f9a73b27f75d248506f8b61e4820146519b3db8d70c5bd7a8ea28cc6fd32bcb4a483c8c238c73da9efe1c0d43775980b30f9e376e8b391fdd789e3279a1ca7730ba97a0cc13ba8f08f9df449a9295ac129cd4b730dbd9a0627f92abd4f5202bb8327a68817e9bcd3205060db9a24b008ced0e9edd77e12206e31d6b435529c7b516333c12be5c9d5a1a28228320719412059ef818056693105b779daf59416439445d1490d68dc3ae556d65ff53f1f0028b6256b4f9deda40f69b4e35ba0cdca218099f6d4c9547e221fda960296bb72f4d514c77a8710ecbe4b87864d47357f1742bf9cecc946f2a08b61baf2db644d886abfff4e754452fe8c368e268b0af917b4f1060c3f0e992e3f11b000f27b28b5730e2e8ada20cda550ee4612fd41eeccd0693fa62c7a61b4f1e70702906403ea5eb3e6adb5cea44f30818c91d1fb4d1f5e730ad3eef27c286cfb670fb70dccb2c3c6f013fa6d3ff047b868005b7a61bd94576dca79650e93d59973aec0c614ee58753874559722459e021e5ef0e1c4ad38c54ca7516ca0f44993d4f4d9101cbff7fd326c1f346b85cb1680b2fa49f3a060a6325b4f6ef5ae2e0e217e68c12b4b9b0520f2c10a8805e226c0eb290b8c0b7130fe224efa9bb1a1768c679ab3e83d37d79c3f51c13e4e5d718b13a5a9fcd50f33700cd2223f74c6d5ad55f70d794a5579e5ed1399b9f4ad57ade549a0c06f02a4933793eba70f7f162ee11df149cfe70730ddc5fa32c19d73afeb377633da09ad81c7f6eed01d170bf4b5d255a84122ad50e5cfdd3791543115eadd13e079d228c49682cc1e4592d81a778ce81f41ad36782080bfdefae08049104dea0773edfbce4d387f7428b666008824c094258921d82387f3f3b110ac96a65b856aa8b71abdffb1ff771406623983e70c12ce80afbe00495f442ad7712df19c4c1bb629f4be6e051fb4097a04bfaa1dcb73c0ebd3b3efe54586eed8eb5d8381144452e2132d0abfa42ae866cdb0f5ab31da6cf55f086c347f68cd9855abef0416154b71090382093762e0c085b3922ce6ca56c480c3d6660337f6fea1db316c4aa1cf1b9e875ec94e8f00db0d5cdcf459c986847"}}) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d3, &(0x7f0000000100)) 1.360508358s ago: executing program 6 (id=6514): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000300)={0xa, 0x4e23, 0x42, @mcast2, 0xfffffffe}, 0x1c) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000040)=0x2, 0x4) r5 = syz_open_dev$hiddev(&(0x7f0000000080), 0x3ff, 0x408000) ioctl$HIDIOCGFIELDINFO(r5, 0xc038480a, &(0x7f0000000100)={0x1, 0x200, 0xffffffff, 0x10, 0x10, 0x4, 0x1a64705, 0x1000, 0x9, 0x200, 0x4, 0xe, 0xad, 0x3ff}) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 1.15664563s ago: executing program 8 (id=6515): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x74}, 0x1, 0x0, 0x0, 0x840}, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 441.977142ms ago: executing program 9 (id=6516): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000080)={0x9, 0x7}) ppoll(&(0x7f00000000c0)=[{r0, 0x8085}, {r1, 0x4430}, {r0, 0x44a3}], 0x3, &(0x7f0000000140)={0x77359400}, &(0x7f0000000180)={[0xf]}, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x7, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in6={0x1b, 0x0, 0x7, @empty, 0x3aa7}, @ib={0x1b, 0xffff, 0x0, {}, 0x0, 0xfffffffffffffffc, 0x6}}}, 0x118) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e20, @multicast2}}, 0x1, 0xfe, 0x2, 0x31, 0x1, 0x1, 0x7}, 0x9c) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f00000005c0), r2, 0x2}}, 0x18) 117.324065ms ago: executing program 8 (id=6517): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa5688a828008100200086dd6d00200000081100000000000000000000202a0000000000ff02000000002c0000000000000000014f194e20"], 0x46) 0s ago: executing program 8 (id=6518): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_init_net_socket$ax25(0x3, 0x2, 0x3) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x80000008, 0x0, 0x5, 0xc0, 0xfffffffc, 0x4, 0x4000001}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$TIOCMIWAIT(r0, 0x5453, 0x300fff2) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000003640)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x4c004}], 0x1, 0x8010) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x501041, 0x0) write$binfmt_aout(r4, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000dc0)={0x0, 0x1, 0x3, 0x1, 0xfe, "0062ba92600000f73809630400"}) timer_create(0x1, &(0x7f0000000040)={0x0, 0x10, 0x2, @thr={&(0x7f00000001c0)="90f1175a6b69b32b81fb89a72087c868e66d28dc9cbdb0b170c0a3d108adfbcd732dda87c65c9aba1032113b4c75695dc7069d9926", &(0x7f00000000c0)="d153f8663f19f528426f1c21701e5ca7e287325ef4d8e37fb9965607fa5e7a7e15822ab57d79c0a7325fa4d5fa0d5265b5a12f455b7beeedf0ed4659af4b6dceb5e4abfaccfc827875903d3f48df6fd90dffa94854c0ce76eee578e6407edeea89abe196d186b48a2da366a177a5f145b3fb3ffc165228e6528502362f7e5dc7067e72aa05daa25f3493dca1d9af20711ba69a09a2fd98463f9d279c4a2ae9f997c4647e20478d008b9b02fd206e67543fdc7b2ecb24806a361d30d771dd596c1abfac9dd122001d410dae35b1f2a87a9bc65c92633b4fc9c6640928b2ab8a1369fb32"}}, &(0x7f0000000200)=0x0) clock_gettime(0x2, &(0x7f0000000240)={0x0, 0x0}) timer_settime(r5, 0x0, &(0x7f0000000280)={{}, {r6, r7+60000000}}, &(0x7f00000002c0)) r8 = syz_open_pts(r4, 0x900) r9 = dup3(r8, r4, 0x80000) read$watch_queue(r9, &(0x7f0000002d40)=""/4093, 0xfdef) kernel console output (not intermixed with test programs): ][ T5856] usb 7-1: 5:0: failed to get current value for ch 1 (-22) [ 957.892440][T23638] loop3: unable to read partition table [ 957.899242][T23638] loop3: partition table beyond EOD, truncated [ 957.913107][T23638] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 957.924154][ T5956] usb 5-1: Using ep0 maxpacket: 32 [ 957.944959][T13153] usb 9-1: USB disconnect, device number 12 [ 957.952039][ T5956] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 957.974679][ T5956] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 957.999252][ T5956] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 958.050243][ T5956] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 958.091242][ T5956] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 958.138011][ T5956] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.159945][ T5956] usb 5-1: Product: syz [ 958.172789][ T5956] usb 5-1: Manufacturer: syz [ 958.173709][ T5856] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 958.185609][ T5956] usb 5-1: SerialNumber: syz [ 958.197188][T23641] Bluetooth: hci1: service_discovery: expected 36 bytes, got 7 bytes [ 958.260945][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 958.284454][ T5856] usb 7-1: USB disconnect, device number 71 [ 958.312864][ T5956] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input74 [ 958.501860][T23636] kvm: apic: phys broadcast and lowest prio [ 958.545167][ T5956] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 958.562396][ T5956] (id 0x00) [ 958.571466][T23647] netlink: 212408 bytes leftover after parsing attributes in process `syz.8.6158'. [ 958.639894][ T5956] rc_core: IR keymap rc-imon-pad not found [ 958.648031][ T5956] Registered IR keymap rc-empty [ 958.655771][ T5956] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 958.667418][ T5956] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 958.692391][ T5856] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 958.749406][ T5956] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 958.777220][ T5956] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input75 [ 958.793794][ T5956] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:54> initialized [ 958.852932][ T2162] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 958.863598][ T5856] usb 7-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice= 0.00 [ 958.879147][ T5856] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.931417][ T5856] usb 7-1: config 0 descriptor?? [ 958.965126][ T5956] usb 5-1: USB disconnect, device number 54 [ 958.967305][ T5856] ftdi_sio 7-1:0.0: FTDI USB Serial Device converter detected [ 958.993100][T23654] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6160'. [ 959.008723][ T5856] usb 7-1: Detected SIO [ 959.017076][ T5856] usb 7-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 959.036448][ T2162] usb 9-1: config 0 has an invalid interface number: 11 but max is 0 [ 959.052751][ T2162] usb 9-1: config 0 has no interface number 0 [ 959.060289][ T2162] usb 9-1: config 0 interface 11 altsetting 245 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 959.073043][ T2162] usb 9-1: config 0 interface 11 altsetting 245 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 959.087057][ T2162] usb 9-1: config 0 interface 11 has no altsetting 0 [ 959.097626][ T2162] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 959.119538][ T2162] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.155480][ T2162] usb 9-1: config 0 descriptor?? [ 959.172809][ T2162] keyspan 9-1:0.11: Keyspan 2 port adapter converter detected [ 959.214459][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 81 [ 959.243146][T23643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.257147][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 82 [ 959.257229][T23643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.289008][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 1 [ 959.298890][ T5856] usb 7-1: USB disconnect, device number 72 [ 959.301943][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 2 [ 959.317214][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 85 [ 959.327326][ T5856] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 959.334764][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 5 [ 959.380338][ T5856] ftdi_sio 7-1:0.0: device disconnected [ 959.381922][ T2162] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 959.420736][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 83 [ 959.448267][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 84 [ 959.474286][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 3 [ 959.494552][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 4 [ 959.510626][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 86 [ 959.523928][ T2162] keyspan 9-1:0.11: found no endpoint descriptor for endpoint 6 [ 959.550175][ T2162] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB2 [ 959.586821][ T2162] usb 9-1: USB disconnect, device number 13 [ 959.616486][ T2162] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 959.660089][ T2162] keyspan_2 ttyUSB2: Keyspan 2 port adapter converter now disconnected from ttyUSB2 [ 959.690282][ T2162] keyspan 9-1:0.11: device disconnected [ 960.038816][ T2162] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 960.102988][ T5856] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 960.199091][ T2162] usb 9-1: Using ep0 maxpacket: 16 [ 960.206375][ T2162] usb 9-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 960.218394][ T2162] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 960.235298][ T2162] usb 9-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 960.246491][ T2162] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 960.252469][ T5935] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 960.256427][ T2162] usb 9-1: Product: syz [ 960.274963][ T5856] usb 5-1: unable to get BOS descriptor or descriptor too short [ 960.283677][ T2162] usb 9-1: Manufacturer: syz [ 960.295624][ T5856] usb 5-1: not running at top speed; connect to a high speed hub [ 960.298421][ T2162] usb 9-1: SerialNumber: syz [ 960.312123][ T5856] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 960.326495][ T2162] usb 9-1: config 0 descriptor?? [ 960.334726][ T5856] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 960.343109][ T2162] appledisplay 9-1:0.0: Could not find int-in endpoint [ 960.358711][T23676] Bluetooth: hci1: service_discovery: expected 36 bytes, got 7 bytes [ 960.360131][ T2162] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 960.369565][T23676] FAULT_INJECTION: forcing a failure. [ 960.369565][T23676] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 960.392740][T23676] CPU: 0 UID: 0 PID: 23676 Comm: syz.7.6169 Tainted: G L syzkaller #0 PREEMPT(full) [ 960.392763][T23676] Tainted: [L]=SOFTLOCKUP [ 960.392774][T23676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 960.392787][T23676] Call Trace: [ 960.392792][T23676] [ 960.392798][T23676] dump_stack_lvl+0xe8/0x150 [ 960.392822][T23676] should_fail_ex+0x412/0x560 [ 960.392842][T23676] _copy_to_user+0x31/0xb0 [ 960.392855][T23676] simple_read_from_buffer+0xe1/0x170 [ 960.392881][T23676] proc_fail_nth_read+0x1bb/0x230 [ 960.392902][T23676] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 960.392920][T23676] ? rw_verify_area+0x2a6/0x4d0 [ 960.392937][T23676] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 960.392957][T23676] vfs_read+0x20c/0xa70 [ 960.392974][T23676] ? fdget_pos+0x246/0x320 [ 960.392992][T23676] ? __pfx___mutex_lock+0x10/0x10 [ 960.393009][T23676] ? __pfx_vfs_read+0x10/0x10 [ 960.393028][T23676] ? __fget_files+0x2a/0x420 [ 960.393046][T23676] ? __fget_files+0x3a0/0x420 [ 960.393060][T23676] ? __fget_files+0x2a/0x420 [ 960.393080][T23676] ksys_read+0x150/0x270 [ 960.393092][T23676] ? __pfx_ksys_read+0x10/0x10 [ 960.393108][T23676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.393129][T23676] do_syscall_64+0x15f/0xf80 [ 960.393145][T23676] ? trace_irq_disable+0x3b/0x140 [ 960.393160][T23676] ? clear_bhb_loop+0x40/0x90 [ 960.393174][T23676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.393186][T23676] RIP: 0033:0x7f88f615d04e [ 960.393199][T23676] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 960.393210][T23676] RSP: 002b:00007f88f709dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 960.393224][T23676] RAX: ffffffffffffffda RBX: 00007f88f709e6c0 RCX: 00007f88f615d04e [ 960.393233][T23676] RDX: 000000000000000f RSI: 00007f88f709e0a0 RDI: 0000000000000003 [ 960.393240][T23676] RBP: 00007f88f709e090 R08: 0000000000000000 R09: 0000000000000000 [ 960.393248][T23676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 960.393255][T23676] R13: 00007f88f6416038 R14: 00007f88f6415fa0 R15: 00007ffe5b2810f8 [ 960.393274][T23676] [ 960.394749][ T5856] usb 5-1: string descriptor 0 read error: -22 [ 960.591217][T23662] syzkaller1: entered promiscuous mode [ 960.597045][ T5856] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 960.641446][T23662] syzkaller1: entered allmulticast mode [ 960.643197][ T5935] usb 7-1: Using ep0 maxpacket: 32 [ 960.671544][ T5856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 960.682275][ T5935] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 960.693244][ T5935] usb 7-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 960.706420][ T5947] usb 9-1: USB disconnect, device number 14 [ 960.707481][ T5935] usb 7-1: config 0 interface 0 has no altsetting 0 [ 960.726823][ T5856] usb 5-1: 0:2 : does not exist [ 960.744910][ T5935] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 960.758974][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 960.768576][ T5935] usb 7-1: Product: syz [ 960.779189][ T5935] usb 7-1: Manufacturer: syz [ 960.784429][ T5935] usb 7-1: SerialNumber: syz [ 960.797760][ T5935] usb 7-1: config 0 descriptor?? [ 961.246432][ T5935] gs_usb 7-1:0.0: Configuring for 1 interfaces [ 961.451338][T23687] FAULT_INJECTION: forcing a failure. [ 961.451338][T23687] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 961.469130][T23687] CPU: 1 UID: 0 PID: 23687 Comm: syz.8.6173 Tainted: G L syzkaller #0 PREEMPT(full) [ 961.469160][T23687] Tainted: [L]=SOFTLOCKUP [ 961.469168][T23687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 961.469178][T23687] Call Trace: [ 961.469186][T23687] [ 961.469195][T23687] dump_stack_lvl+0xe8/0x150 [ 961.469228][T23687] should_fail_ex+0x412/0x560 [ 961.469261][T23687] prepare_alloc_pages+0x22a/0x650 [ 961.469291][T23687] __alloc_frozen_pages_noprof+0x12f/0x380 [ 961.469317][T23687] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 961.469343][T23687] ? __pfx_policy_nodemask+0x10/0x10 [ 961.469367][T23687] ? __lock_acquire+0x6b5/0x2cf0 [ 961.469400][T23687] alloc_pages_mpol+0x235/0x490 [ 961.469426][T23687] alloc_pages_noprof+0xac/0x2a0 [ 961.469451][T23687] pte_alloc_one+0x22/0x370 [ 961.469473][T23687] __pte_alloc+0x25/0x1a0 [ 961.469498][T23687] do_pte_missing+0x2cd2/0x33f0 [ 961.469521][T23687] ? __pmd_alloc+0x40a/0x5c0 [ 961.469539][T23687] handle_mm_fault+0x1bd7/0x3170 [ 961.469570][T23687] ? handle_mm_fault+0xee/0x3170 [ 961.469603][T23687] ? __pfx_handle_mm_fault+0x10/0x10 [ 961.469642][T23687] ? __lock_acquire+0x6b5/0x2cf0 [ 961.469669][T23687] ? lock_mm_and_find_vma+0xa7/0x340 [ 961.469689][T23687] do_user_addr_fault+0x75b/0x1340 [ 961.469716][T23687] exc_page_fault+0x6a/0xc0 [ 961.469743][T23687] asm_exc_page_fault+0x26/0x30 [ 961.469762][T23687] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 961.469781][T23687] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 4d 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 961.469797][T23687] RSP: 0018:ffffc90004edfab8 EFLAGS: 00050202 [ 961.469815][T23687] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 961.469827][T23687] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90004edfbd0 [ 961.469835][T23687] RBP: ffffc90004edfcb0 R08: ffffc90004edfbe7 R09: 1ffff920009dbf7c [ 961.469843][T23687] R10: dffffc0000000000 R11: fffff520009dbf7d R12: ffff888022aa2000 [ 961.469852][T23687] R13: dffffc0000000000 R14: ffffc90004edfbd0 R15: 0000200000000100 [ 961.469881][T23687] _copy_from_user+0x7a/0xb0 [ 961.469901][T23687] rfcomm_dev_ioctl+0x1b4/0x21d0 [ 961.469930][T23687] ? kasan_quarantine_put+0xbb/0x1f0 [ 961.469956][T23687] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 961.469982][T23687] ? tomoyo_path_number_perm+0x219/0x630 [ 961.470006][T23687] ? do_vfs_ioctl+0x1166/0x1530 [ 961.470021][T23687] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 961.470040][T23687] sock_do_ioctl+0x101/0x320 [ 961.470072][T23687] ? __pfx_sock_do_ioctl+0x10/0x10 [ 961.470095][T23687] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 961.470138][T23687] sock_ioctl+0x5c6/0x7f0 [ 961.470156][T23687] ? __pfx_sock_ioctl+0x10/0x10 [ 961.470173][T23687] ? __fget_files+0x2a/0x420 [ 961.470188][T23687] ? __fget_files+0x3a0/0x420 [ 961.470209][T23687] ? __fget_files+0x2a/0x420 [ 961.470237][T23687] ? bpf_lsm_file_ioctl+0x9/0x20 [ 961.470258][T23687] ? __pfx_sock_ioctl+0x10/0x10 [ 961.470283][T23687] __se_sys_ioctl+0xfc/0x170 [ 961.470300][T23687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.470313][T23687] do_syscall_64+0x15f/0xf80 [ 961.470327][T23687] ? trace_irq_disable+0x3b/0x140 [ 961.470347][T23687] ? clear_bhb_loop+0x40/0x90 [ 961.470370][T23687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.470388][T23687] RIP: 0033:0x7f357019c819 [ 961.470407][T23687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.470422][T23687] RSP: 002b:00007f3570ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 961.470440][T23687] RAX: ffffffffffffffda RBX: 00007f3570415fa0 RCX: 00007f357019c819 [ 961.470454][T23687] RDX: 0000200000000100 RSI: 00000000400452c9 RDI: 0000000000000004 [ 961.470466][T23687] RBP: 00007f3570ff7090 R08: 0000000000000000 R09: 0000000000000000 [ 961.470477][T23687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 961.470489][T23687] R13: 00007f3570416038 R14: 00007f3570415fa0 R15: 00007ffcfeac7e68 [ 961.470521][T23687] [ 962.167359][T23318] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 962.182387][ T5935] gs_usb 7-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 962.193607][ T5856] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 962.208719][ T5856] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 962.219226][ T5935] gs_usb 7-1:0.0: probe with driver gs_usb failed with error -22 [ 962.230306][ T5856] usb 5-1: 5:0: failed to get current value for ch 1 (-22) [ 962.278000][ T5856] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 962.323644][ T5856] usb 5-1: USB disconnect, device number 55 [ 962.406282][ T5935] usb 7-1: USB disconnect, device number 73 [ 962.741019][T23699] loop3: detected capacity change from 0 to 7 [ 962.750081][T23699] Dev loop3: unable to read RDB block 7 [ 962.758437][T23699] loop3: unable to read partition table [ 962.765057][T23699] loop3: partition table beyond EOD, truncated [ 962.771920][T23699] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 963.543714][ T2162] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 963.552826][ T5947] usb 7-1: new high-speed USB device number 74 using dummy_hcd [ 963.729830][ T5947] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 963.740507][ T5947] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.749466][ T5947] usb 7-1: Product: syz [ 963.754218][ T5947] usb 7-1: Manufacturer: syz [ 963.759487][ T5947] usb 7-1: SerialNumber: syz [ 963.776094][ T5947] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 963.811507][T17336] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 964.244388][ T5935] usb 7-1: USB disconnect, device number 74 [ 964.862165][T23723] FAULT_INJECTION: forcing a failure. [ 964.862165][T23723] name failslab, interval 1, probability 0, space 0, times 0 [ 964.877541][T23723] CPU: 1 UID: 0 PID: 23723 Comm: syz.6.6184 Tainted: G L syzkaller #0 PREEMPT(full) [ 964.877572][T23723] Tainted: [L]=SOFTLOCKUP [ 964.877581][T23723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 964.877593][T23723] Call Trace: [ 964.877601][T23723] [ 964.877610][T23723] dump_stack_lvl+0xe8/0x150 [ 964.877649][T23723] should_fail_ex+0x412/0x560 [ 964.877681][T23723] should_failslab+0xa8/0x100 [ 964.877703][T23723] ? ptlock_alloc+0x20/0x70 [ 964.877729][T23723] kmem_cache_alloc_noprof+0x87/0x650 [ 964.877755][T23723] ? alloc_pages_mpol+0x3c0/0x490 [ 964.877785][T23723] ptlock_alloc+0x20/0x70 [ 964.877810][T23723] pte_alloc_one+0x7a/0x370 [ 964.877833][T23723] __pte_alloc+0x25/0x1a0 [ 964.877866][T23723] do_pte_missing+0x2cd2/0x33f0 [ 964.877900][T23723] ? __pmd_alloc+0x40a/0x5c0 [ 964.877931][T23723] handle_mm_fault+0x1bd7/0x3170 [ 964.877971][T23723] ? handle_mm_fault+0xee/0x3170 [ 964.878004][T23723] ? __pfx_handle_mm_fault+0x10/0x10 [ 964.878044][T23723] ? __lock_acquire+0x6b5/0x2cf0 [ 964.878075][T23723] ? lock_mm_and_find_vma+0xa7/0x340 [ 964.878107][T23723] do_user_addr_fault+0x75b/0x1340 [ 964.878151][T23723] exc_page_fault+0x6a/0xc0 [ 964.878179][T23723] asm_exc_page_fault+0x26/0x30 [ 964.878198][T23723] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 964.878218][T23723] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 4d 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 964.878236][T23723] RSP: 0018:ffffc90005947ab8 EFLAGS: 00050202 [ 964.878255][T23723] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 964.878269][T23723] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90005947bd0 [ 964.878282][T23723] RBP: ffffc90005947cb0 R08: ffffc90005947be7 R09: 1ffff92000b28f7c [ 964.878296][T23723] R10: dffffc0000000000 R11: fffff52000b28f7d R12: ffff888033c8d000 [ 964.878309][T23723] R13: dffffc0000000000 R14: ffffc90005947bd0 R15: 0000200000000100 [ 964.878342][T23723] _copy_from_user+0x7a/0xb0 [ 964.878364][T23723] rfcomm_dev_ioctl+0x1b4/0x21d0 [ 964.878393][T23723] ? kasan_quarantine_put+0xbb/0x1f0 [ 964.878420][T23723] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 964.878446][T23723] ? tomoyo_path_number_perm+0x219/0x630 [ 964.878484][T23723] ? do_vfs_ioctl+0x1166/0x1530 [ 964.878507][T23723] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 964.878535][T23723] sock_do_ioctl+0x101/0x320 [ 964.878564][T23723] ? __pfx_sock_do_ioctl+0x10/0x10 [ 964.878589][T23723] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 964.878633][T23723] sock_ioctl+0x5c6/0x7f0 [ 964.878663][T23723] ? __pfx_sock_ioctl+0x10/0x10 [ 964.878690][T23723] ? __fget_files+0x2a/0x420 [ 964.878712][T23723] ? __fget_files+0x3a0/0x420 [ 964.878736][T23723] ? __fget_files+0x2a/0x420 [ 964.878763][T23723] ? bpf_lsm_file_ioctl+0x9/0x20 [ 964.878783][T23723] ? __pfx_sock_ioctl+0x10/0x10 [ 964.878809][T23723] __se_sys_ioctl+0xfc/0x170 [ 964.878829][T23723] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.878858][T23723] do_syscall_64+0x15f/0xf80 [ 964.878883][T23723] ? trace_irq_disable+0x3b/0x140 [ 964.878906][T23723] ? clear_bhb_loop+0x40/0x90 [ 964.878930][T23723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.878949][T23723] RIP: 0033:0x7f874bf9c819 [ 964.878968][T23723] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 964.878982][T23723] RSP: 002b:00007f874ce55028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 964.879001][T23723] RAX: ffffffffffffffda RBX: 00007f874c215fa0 RCX: 00007f874bf9c819 [ 964.879014][T23723] RDX: 0000200000000100 RSI: 00000000400452c9 RDI: 0000000000000004 [ 964.879027][T23723] RBP: 00007f874ce55090 R08: 0000000000000000 R09: 0000000000000000 [ 964.879038][T23723] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 964.879049][T23723] R13: 00007f874c216038 R14: 00007f874c215fa0 R15: 00007fff0f536138 [ 964.879082][T23723] [ 965.318187][T23693] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 965.362234][T17336] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 965.363920][T23724] syzkaller1: entered allmulticast mode [ 965.370104][T17336] ath9k_htc: Failed to initialize the device [ 965.394574][ T5935] usb 7-1: ath9k_htc: USB layer deinitialized [ 965.538296][T23724] sp0: Synchronizing with TNC [ 965.589653][T23724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 965.600284][T23724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 965.847579][T23735] loop2: detected capacity change from 0 to 7 [ 965.862702][T23735] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 965.868968][T23735] loop2: partition table partially beyond EOD, truncated [ 965.877227][T23735] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 965.950465][T13153] usb 9-1: new full-speed USB device number 15 using dummy_hcd [ 965.960636][T23737] loop3: detected capacity change from 0 to 7 [ 965.982265][T23737] Dev loop3: unable to read RDB block 7 [ 965.989851][T23737] loop3: unable to read partition table [ 965.997445][T23737] loop3: partition table beyond EOD, truncated [ 966.002688][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 966.005487][T23737] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 966.071328][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 966.122161][T13153] usb 9-1: unable to get BOS descriptor or descriptor too short [ 966.137249][T13153] usb 9-1: not running at top speed; connect to a high speed hub [ 966.149528][T13153] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 966.161453][T13153] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 966.181335][T13153] usb 9-1: string descriptor 0 read error: -22 [ 966.188582][T13153] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 966.199663][T13153] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.229630][T13153] usb 9-1: 0:2 : does not exist [ 966.396991][ T2162] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 966.557184][ T2162] usb 5-1: device descriptor read/64, error -71 [ 966.685960][ T2162] usb usb5-port1: attempt power cycle [ 966.938877][T23751] syzkaller1: entered promiscuous mode [ 966.945622][T23751] syzkaller1: entered allmulticast mode [ 967.048763][ T2162] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 967.070786][ T2162] usb 5-1: device descriptor read/8, error -71 [ 967.191559][T23753] binder: 23752:23753 ioctl 8040552c 200000000000 returned -22 [ 967.325880][T13153] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 967.337763][ T2162] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 967.344016][T13153] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 967.358272][T13153] usb 9-1: 5:0: failed to get current value for ch 1 (-22) [ 967.371367][ T2162] usb 5-1: device descriptor read/8, error -71 [ 967.387235][T23757] sctp: [Deprecated]: syz.7.6196 (pid 23757) Use of int in maxseg socket option. [ 967.387235][T23757] Use struct sctp_assoc_value instead [ 967.420611][T23758] sctp: [Deprecated]: syz.7.6196 (pid 23758) Use of int in maxseg socket option. [ 967.420611][T23758] Use struct sctp_assoc_value instead [ 967.439828][T13153] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 967.451658][T23757] kernel profiling enabled (shift: 4) [ 967.498712][ T2162] usb usb5-port1: unable to enumerate USB device [ 967.542162][T13153] usb 9-1: USB disconnect, device number 15 [ 967.798873][ T2162] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 967.957594][ T2162] usb 7-1: device descriptor read/64, error -71 [ 968.192506][T23768] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 968.199596][T23768] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 968.239777][ T2162] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 968.258320][T23768] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 968.271253][T23768] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 968.282929][T23773] loop2: detected capacity change from 0 to 7 [ 968.283489][T23768] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 968.292384][T23773] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 968.296828][T23768] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 968.302738][T23773] loop2: partition table partially beyond EOD, truncated [ 968.319493][T23768] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 968.321761][T23773] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 968.338109][T23768] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 968.352581][T23768] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 968.371108][T23768] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 968.406175][ T2162] usb 7-1: device descriptor read/64, error -71 [ 968.411933][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 968.534400][ T2162] usb usb7-port1: attempt power cycle [ 968.909282][ T2162] usb 7-1: new high-speed USB device number 77 using dummy_hcd [ 968.955063][ T2162] usb 7-1: device descriptor read/8, error -71 [ 969.087599][T23786] netlink: 'syz.7.6206': attribute type 1 has an invalid length. [ 969.097312][T23786] netlink: 224 bytes leftover after parsing attributes in process `syz.7.6206'. [ 969.230480][ T5856] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 969.243918][ T2162] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 969.293672][ T2162] usb 7-1: device descriptor read/8, error -71 [ 969.411572][ T2162] usb usb7-port1: unable to enumerate USB device [ 969.421218][ T5856] usb 9-1: Using ep0 maxpacket: 16 [ 969.429839][ T5856] usb 9-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 969.447343][ T5856] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 969.467596][ T5856] usb 9-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 969.478345][ T5856] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.489026][ T5856] usb 9-1: Product: syz [ 969.493732][ T5856] usb 9-1: Manufacturer: syz [ 969.499171][ T5856] usb 9-1: SerialNumber: syz [ 969.508852][ T5856] usb 9-1: config 0 descriptor?? [ 969.516954][ T5856] appledisplay 9-1:0.0: Could not find int-in endpoint [ 969.525547][ T5856] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 969.738559][T23781] syzkaller1: entered promiscuous mode [ 969.739319][T23794] openvswitch: netlink: Key type 270 is out of range max 32 [ 969.746956][T23781] syzkaller1: entered allmulticast mode [ 969.807179][T13153] usb 9-1: USB disconnect, device number 16 [ 970.029362][T23804] 8021q: VLANs not supported on ip_vti0 [ 970.276467][ T2162] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 970.297771][ T5861] Bluetooth: hci0: command 0x0406 tx timeout [ 970.457597][ T2162] usb 5-1: Using ep0 maxpacket: 32 [ 970.467011][ T2162] usb 5-1: config index 0 descriptor too short (expected 146, got 18) [ 970.476293][ T5861] Bluetooth: hci1: command 0x0c1a tx timeout [ 970.476311][ T5161] Bluetooth: hci3: command 0x0405 tx timeout [ 970.495211][ T2162] usb 5-1: config 5 has an invalid interface number: 19 but max is 0 [ 970.515167][ T2162] usb 5-1: config 5 has no interface number 0 [ 970.524918][ T2162] usb 5-1: config 5 interface 19 has no altsetting 0 [ 970.535631][ T2162] usb 5-1: New USB device found, idVendor=0c45, idProduct=624e, bcdDevice=a0.4d [ 970.546899][ T2162] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.555853][ T5161] Bluetooth: hci4: command 0x0c1a tx timeout [ 970.563087][ T2162] usb 5-1: Product: syz [ 970.567745][ T2162] usb 5-1: Manufacturer: syz [ 970.572837][ T2162] usb 5-1: SerialNumber: syz [ 970.860302][ T2162] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:624e [ 970.875410][ T2162] gspca_sn9c20x: Write register 1000 failed -71 [ 970.896015][ T2162] gspca_sn9c20x: Device initialization failed [ 970.917522][ T2162] gspca_sn9c20x 5-1:5.19: probe with driver gspca_sn9c20x failed with error -71 [ 970.936680][ T2162] usb 5-1: USB disconnect, device number 60 [ 971.160255][T23824] syzkaller1: entered promiscuous mode [ 971.167464][T23824] syzkaller1: entered allmulticast mode [ 971.387295][ T5917] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 971.575171][ T5917] usb 9-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 971.585700][ T5917] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.594874][ T5917] usb 9-1: Product: syz [ 971.599876][ T5917] usb 9-1: Manufacturer: syz [ 971.605948][ T5917] usb 9-1: SerialNumber: syz [ 971.616659][ T5917] r8152-cfgselector 9-1: Unknown version 0x0000 [ 971.625594][ T5917] r8152-cfgselector 9-1: config 0 descriptor?? [ 971.953682][ T5856] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 972.084539][ T5917] r8152-cfgselector 9-1: Needed 1 retries to read version [ 972.093018][ T5917] r8152-cfgselector 9-1: Unknown version 0x0000 [ 972.100236][ T5917] r8152-cfgselector 9-1: No union descriptors [ 972.113893][ T5856] usb 5-1: Using ep0 maxpacket: 16 [ 972.135901][ T5856] usb 5-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 972.155019][ T5856] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 972.172646][ T5856] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 972.185960][ T5856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 972.195096][ T5856] usb 5-1: Product: syz [ 972.200279][ T5856] usb 5-1: Manufacturer: syz [ 972.205681][ T5856] usb 5-1: SerialNumber: syz [ 972.215826][ T5856] usb 5-1: config 0 descriptor?? [ 972.228232][ T5856] appledisplay 5-1:0.0: Could not find int-in endpoint [ 972.241774][ T5856] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 972.405355][ T2162] r8152-cfgselector 9-1: USB disconnect, device number 17 [ 972.442982][T23833] syzkaller1: entered promiscuous mode [ 972.449734][T23833] syzkaller1: entered allmulticast mode [ 972.477949][T17336] usb 5-1: USB disconnect, device number 61 [ 972.488506][ T5935] usb 7-1: new high-speed USB device number 79 using dummy_hcd [ 972.520162][ T5161] Bluetooth: hci0: command 0x0406 tx timeout [ 972.648289][ T5935] usb 7-1: Using ep0 maxpacket: 8 [ 972.657048][ T5935] usb 7-1: unable to get BOS descriptor or descriptor too short [ 972.666802][ T5935] usb 7-1: config 3 has an invalid interface number: 229 but max is 0 [ 972.675897][ T5935] usb 7-1: config 3 has no interface number 0 [ 972.682780][ T5935] usb 7-1: config 3 interface 229 has no altsetting 0 [ 972.690959][ T5161] Bluetooth: hci1: command 0x0c1a tx timeout [ 972.690972][ T5861] Bluetooth: hci3: command 0x0405 tx timeout [ 972.706137][ T5935] usb 7-1: New USB device found, idVendor=05ac, idProduct=0263, bcdDevice=b7.2c [ 972.716273][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 972.725149][ T5935] usb 7-1: Product: syz [ 972.729717][ T5935] usb 7-1: Manufacturer: syz [ 972.735102][ T5935] usb 7-1: SerialNumber: syz [ 972.776482][ T5161] Bluetooth: hci4: command 0x0c1a tx timeout [ 972.966451][ T5935] input: bcm5974 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:3.229/input/input77 [ 972.984583][ T5197] bcm5974 7-1:3.229: could not read from device [ 973.015785][ T5197] bcm5974 7-1:3.229: could not read from device [ 973.032217][ T5935] usb 7-1: USB disconnect, device number 79 [ 973.132493][ T5849] udevd[5849]: Error opening device "/dev/input/event4": No such file or directory [ 973.154592][ T5849] udevd[5849]: Unable to EVIOCGABS device "/dev/input/event4" [ 973.198940][ T5849] udevd[5849]: Unable to EVIOCGABS device "/dev/input/event4" [ 973.212286][ T5849] udevd[5849]: Unable to EVIOCGABS device "/dev/input/event4" [ 973.221522][ T5849] udevd[5849]: Unable to EVIOCGABS device "/dev/input/event4" [ 973.501891][T23849] loop2: detected capacity change from 0 to 7 [ 973.522685][T23849] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 973.553519][T23849] loop2: partition table partially beyond EOD, truncated [ 973.573400][T23849] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 973.724968][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 974.053436][ T5935] usb 7-1: new full-speed USB device number 80 using dummy_hcd [ 974.144299][ T5856] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 974.193737][T23870] netlink: 'syz.7.6238': attribute type 8 has an invalid length. [ 974.222047][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 974.246285][ T5935] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 974.256580][ T5935] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.280920][ T5935] usb 7-1: config 0 descriptor?? [ 974.308533][ T5935] hub 7-1:0.0: USB hub found [ 974.327406][ T5856] usb 5-1: Using ep0 maxpacket: 16 [ 974.340684][ T5856] usb 5-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 974.364792][ T5856] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 974.387274][ T5856] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 974.397999][ T5856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.426444][ T5856] usb 5-1: Product: syz [ 974.431266][ T5856] usb 5-1: Manufacturer: syz [ 974.437227][ T5856] usb 5-1: SerialNumber: syz [ 974.445293][ T5856] usb 5-1: config 0 descriptor?? [ 974.454325][ T5856] appledisplay 5-1:0.0: Could not find int-in endpoint [ 974.462863][ T5856] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 974.520031][ T5935] hub 7-1:0.0: 1 port detected [ 974.672611][T23862] syzkaller1: entered promiscuous mode [ 974.678861][T23862] syzkaller1: entered allmulticast mode [ 974.700977][ T2162] usb 5-1: USB disconnect, device number 62 [ 974.913652][ T5161] Bluetooth: hci1: command 0x0c1a tx timeout [ 974.986565][ T5935] usb 7-1: USB disconnect, device number 80 [ 974.999299][ T5161] Bluetooth: hci4: command 0x0c1a tx timeout [ 975.243922][ T30] audit: type=1326 audit(1775199119.521:7410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23879 comm="syz.8.6241" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f357019c819 code=0x0 [ 975.383115][T23883] loop2: detected capacity change from 0 to 7 [ 975.393855][T23883] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 975.401543][T23883] loop2: partition table partially beyond EOD, truncated [ 975.409908][T23883] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 975.476516][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 976.257844][T23904] loop3: detected capacity change from 0 to 7 [ 976.276266][T23904] Dev loop3: unable to read RDB block 7 [ 976.283578][T23904] loop3: unable to read partition table [ 976.289993][T23904] loop3: partition table beyond EOD, truncated [ 976.298559][T23904] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 976.391919][T23908] netlink: 60 bytes leftover after parsing attributes in process `syz.6.6251'. [ 976.402753][T23908] netlink: 60 bytes leftover after parsing attributes in process `syz.6.6251'. [ 976.863586][T23921] Bluetooth: hci1: service_discovery: expected 36 bytes, got 7 bytes [ 976.991700][T23923] loop2: detected capacity change from 0 to 7 [ 977.006191][T23923] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 977.017144][T23923] loop2: partition table partially beyond EOD, truncated [ 977.025410][ T2162] usb 7-1: new full-speed USB device number 81 using dummy_hcd [ 977.036254][T23923] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 977.104986][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 977.213991][ T2162] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 977.245327][ T2162] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 977.262854][ T2162] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.285259][ T2162] usb 7-1: config 0 descriptor?? [ 977.313376][ T2162] hub 7-1:0.0: USB hub found [ 977.512053][ T2162] hub 7-1:0.0: 1 port detected [ 977.745426][ T5856] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 977.838930][T23937] loop3: detected capacity change from 0 to 7 [ 977.848715][T23937] Dev loop3: unable to read RDB block 7 [ 977.857171][T23937] loop3: unable to read partition table [ 977.864192][T23937] loop3: partition table beyond EOD, truncated [ 977.872369][T23937] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 977.928447][ T5856] usb 9-1: Using ep0 maxpacket: 8 [ 977.944920][ T5856] usb 9-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 977.967963][ T2162] usb 7-1: USB disconnect, device number 81 [ 977.974152][ T5856] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.025097][ T5856] usb 9-1: Product: syz [ 978.033591][ T5856] usb 9-1: Manufacturer: syz [ 978.046288][ T5856] usb 9-1: SerialNumber: syz [ 978.062891][ T5856] usb 9-1: config 0 descriptor?? [ 978.093192][ T5856] gspca_main: se401-2.14.0 probing 047d:5003 [ 978.277496][T23941] syzkaller1: entered promiscuous mode [ 978.285168][T23941] syzkaller1: entered allmulticast mode [ 978.522206][ T5856] gspca_se401: ExtraFeatures: 48 [ 978.531978][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.542779][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.554912][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.562778][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.571531][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.578175][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.585176][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.597904][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.606326][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.614531][ T5856] gspca_se401: Frame size: 0x0 1/16th janggu [ 978.745782][T23933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 978.761389][T23933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.813149][T23954] netlink: 88 bytes leftover after parsing attributes in process `syz.6.6268'. [ 979.028352][ T5856] input: se401 as /devices/platform/dummy_hcd.8/usb9/9-1/input/input78 [ 979.043999][T23958] exFAT-fs (loop6): unable to read boot sector [ 979.053459][T23958] exFAT-fs (loop6): failed to read boot sector [ 979.062272][T23958] exFAT-fs (loop6): failed to recognize exfat type [ 979.067135][ T5856] usb 9-1: USB disconnect, device number 18 [ 979.615756][ T5935] usb 7-1: new high-speed USB device number 82 using dummy_hcd [ 979.666465][T23966] loop3: detected capacity change from 0 to 7 [ 979.674738][T23966] Dev loop3: unable to read RDB block 7 [ 979.681278][T23966] loop3: unable to read partition table [ 979.703874][T23966] loop3: partition table beyond EOD, truncated [ 979.724058][T23966] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 979.808094][ T5935] usb 7-1: Using ep0 maxpacket: 16 [ 979.831757][ T5935] usb 7-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 979.852540][ T5935] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 979.883221][ T5935] usb 7-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 979.903210][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.930034][ T5935] usb 7-1: Product: syz [ 979.947995][ T5935] usb 7-1: Manufacturer: syz [ 979.966808][ T5935] usb 7-1: SerialNumber: syz [ 979.987015][ T5935] usb 7-1: config 0 descriptor?? [ 980.024880][ T5935] appledisplay 7-1:0.0: Could not find int-in endpoint [ 980.047842][ T5935] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 980.233698][T23963] syzkaller1: entered promiscuous mode [ 980.240368][T23963] syzkaller1: entered allmulticast mode [ 980.280795][ T5903] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 980.290750][ T5917] usb 7-1: USB disconnect, device number 82 [ 980.463488][ T5903] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 980.484309][ T5903] usb 9-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=7d.08 [ 980.488179][T23985] input: syz0 as /devices/virtual/input/input79 [ 980.509205][ T5903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.531450][ T5903] usb 9-1: Product: syz [ 980.553867][ T5903] usb 9-1: Manufacturer: syz [ 980.566852][ T5903] usb 9-1: SerialNumber: syz [ 980.582407][ T5903] usb 9-1: config 0 descriptor?? [ 980.596202][ T5903] gm12u320 9-1:0.0: [drm:gm12u320_set_ecomode] *ERROR* Misc. req. error -22 [ 980.607200][ T5903] gm12u320 9-1:0.0: probe with driver gm12u320 failed with error -5 [ 980.622197][ T5903] usb-storage 9-1:0.0: USB Mass Storage device detected [ 980.652700][ T5903] usb-storage 9-1:0.0: device ignored [ 980.849884][ T5856] usb 9-1: USB disconnect, device number 19 [ 981.076896][T24000] loop2: detected capacity change from 0 to 7 [ 981.116141][T24000] loop2: [CUMANA/ADFS] p1 [ADFS] p1 [ 981.132880][T24000] loop2: partition table partially beyond EOD, truncated [ 981.151854][T24000] loop2: p1 size 3435008204 extends beyond EOD, truncated [ 981.257144][ T6426] udevd[6426]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 981.573171][T24017] netlink: 24 bytes leftover after parsing attributes in process `syz.8.6284'. [ 981.666349][T24021] sg_write: data in/out 294879/136 bytes for SCSI command 0x2-- guessing data in; [ 981.666349][T24021] program syz.8.6285 not setting count and/or reply_len properly [ 981.947313][T17336] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 982.137460][T17336] usb 9-1: Using ep0 maxpacket: 16 [ 982.145632][T17336] usb 9-1: config 0 has an invalid interface number: 34 but max is 0 [ 982.159425][T17336] usb 9-1: config 0 has no interface number 0 [ 982.166314][T17336] usb 9-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 982.190605][T17336] usb 9-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 982.204949][T17336] usb 9-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 982.215589][T17336] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.225123][T17336] usb 9-1: Product: syz [ 982.229981][T17336] usb 9-1: Manufacturer: syz [ 982.235558][T17336] usb 9-1: SerialNumber: syz [ 982.246180][T17336] usb 9-1: config 0 descriptor?? [ 982.260606][T24021] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 982.269311][T24021] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 982.319240][ T5947] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 982.494664][T24021] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 982.507836][T24021] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 982.517968][ T5947] usb 5-1: unable to get BOS descriptor or descriptor too short [ 982.530198][ T5947] usb 5-1: not running at top speed; connect to a high speed hub [ 982.549233][ T5947] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 982.562123][ T5947] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 982.578568][ T5947] usb 5-1: string descriptor 0 read error: -22 [ 982.585869][ T5947] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 982.596163][ T5947] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.629263][ T5947] usb 5-1: 0:2 : does not exist [ 982.732432][T17336] asix 9-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 982.958479][T17336] asix 9-1:0.34 (unnamed net_device) (uninitialized): invalid PHY address: 166 [ 983.203976][T17336] usb 9-1: USB disconnect, device number 20 [ 983.211864][ T5161] Bluetooth: hci0: command 0x0406 tx timeout [ 983.221768][ T5917] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 983.232937][ T5917] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 983.490980][T24035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 983.520850][T24035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 983.856676][ T5947] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 983.893191][ T5947] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 983.927324][ T5947] usb 5-1: 5:0: failed to get current value for ch 1 (-22) [ 983.947772][T24091] FAULT_INJECTION: forcing a failure. [ 983.947772][T24091] name failslab, interval 1, probability 0, space 0, times 0 [ 983.962517][T24091] CPU: 1 UID: 0 PID: 24091 Comm: syz.8.6292 Tainted: G L syzkaller #0 PREEMPT(full) [ 983.962552][T24091] Tainted: [L]=SOFTLOCKUP [ 983.962559][T24091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 983.962577][T24091] Call Trace: [ 983.962585][T24091] [ 983.962594][T24091] dump_stack_lvl+0xe8/0x150 [ 983.962628][T24091] should_fail_ex+0x412/0x560 [ 983.962662][T24091] should_failslab+0xa8/0x100 [ 983.962683][T24091] ? __pmd_alloc+0xc1/0x5c0 [ 983.962709][T24091] kmem_cache_alloc_noprof+0x87/0x650 [ 983.962757][T24091] __pmd_alloc+0xc1/0x5c0 [ 983.962789][T24091] handle_mm_fault+0xe96/0x3170 [ 983.962830][T24091] ? handle_mm_fault+0xee/0x3170 [ 983.962865][T24091] ? __pfx_handle_mm_fault+0x10/0x10 [ 983.962906][T24091] ? __lock_acquire+0x6b5/0x2cf0 [ 983.962939][T24091] ? lock_mm_and_find_vma+0xa7/0x340 [ 983.962972][T24091] do_user_addr_fault+0x75b/0x1340 [ 983.963015][T24091] exc_page_fault+0x6a/0xc0 [ 983.963044][T24091] asm_exc_page_fault+0x26/0x30 [ 983.963063][T24091] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 983.963084][T24091] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 4d 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 983.963100][T24091] RSP: 0018:ffffc90003d1fab8 EFLAGS: 00050202 [ 983.963119][T24091] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 983.963132][T24091] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90003d1fb70 [ 983.963145][T24091] RBP: ffffc90003d1fcb0 R08: ffffc90003d1fb87 R09: 1ffff920007a3f70 [ 983.963159][T24091] R10: dffffc0000000000 R11: fffff520007a3f71 R12: ffff88804dc98000 [ 983.963173][T24091] R13: dffffc0000000000 R14: ffffc90003d1fb70 R15: 0000200000000100 [ 983.963207][T24091] _copy_from_user+0x7a/0xb0 [ 983.963228][T24091] rfcomm_dev_ioctl+0x132/0x21d0 [ 983.963257][T24091] ? kasan_quarantine_put+0xbb/0x1f0 [ 983.963285][T24091] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 983.963311][T24091] ? tomoyo_path_number_perm+0x219/0x630 [ 983.963341][T24091] ? tomoyo_path_number_perm+0x219/0x630 [ 983.963374][T24091] ? do_vfs_ioctl+0x1166/0x1530 [ 983.963397][T24091] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 983.963426][T24091] sock_do_ioctl+0x101/0x320 [ 983.963456][T24091] ? __pfx_sock_do_ioctl+0x10/0x10 [ 983.963481][T24091] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 983.963525][T24091] sock_ioctl+0x5c6/0x7f0 [ 983.963555][T24091] ? __pfx_sock_ioctl+0x10/0x10 [ 983.963583][T24091] ? __fget_files+0x2a/0x420 [ 983.963606][T24091] ? __fget_files+0x3a0/0x420 [ 983.963630][T24091] ? __fget_files+0x2a/0x420 [ 983.963658][T24091] ? bpf_lsm_file_ioctl+0x9/0x20 [ 983.963680][T24091] ? __pfx_sock_ioctl+0x10/0x10 [ 983.963706][T24091] __se_sys_ioctl+0xfc/0x170 [ 983.963737][T24091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.963757][T24091] do_syscall_64+0x15f/0xf80 [ 983.963778][T24091] ? trace_irq_disable+0x3b/0x140 [ 983.963800][T24091] ? clear_bhb_loop+0x40/0x90 [ 983.963827][T24091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.963846][T24091] RIP: 0033:0x7f357019c819 [ 983.963865][T24091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 983.963881][T24091] RSP: 002b:00007f3570ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 983.963899][T24091] RAX: ffffffffffffffda RBX: 00007f3570415fa0 RCX: 00007f357019c819 [ 983.963914][T24091] RDX: 0000200000000100 RSI: 00000000800452d3 RDI: 0000000000000004 [ 983.963926][T24091] RBP: 00007f3570ff7090 R08: 0000000000000000 R09: 0000000000000000 [ 983.963938][T24091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 983.963950][T24091] R13: 00007f3570416038 R14: 00007f3570415fa0 R15: 00007ffcfeac7e68 [ 983.963983][T24091] [ 984.533442][ T5947] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 984.548147][T24099] fuse: Unknown parameter '017777777777777777777770x0000000000000004' [ 984.588281][ T5947] usb 5-1: USB disconnect, device number 63 [ 985.428807][ T5917] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 985.428893][ T5161] Bluetooth: hci3: command 0x0405 tx timeout [ 985.444474][ T5917] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 986.857118][T24121] syzkaller1: entered promiscuous mode [ 986.863416][T24121] syzkaller1: entered allmulticast mode [ 987.907975][ T5161] Bluetooth: hci1: command 0x0c1a tx timeout [ 987.914949][ T5917] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 987.921788][ T5917] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 988.275158][T24130] FAULT_INJECTION: forcing a failure. [ 988.275158][T24130] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 988.290373][T24130] CPU: 0 UID: 0 PID: 24130 Comm: syz.4.6304 Tainted: G L syzkaller #0 PREEMPT(full) [ 988.290405][T24130] Tainted: [L]=SOFTLOCKUP [ 988.290412][T24130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 988.290424][T24130] Call Trace: [ 988.290432][T24130] [ 988.290441][T24130] dump_stack_lvl+0xe8/0x150 [ 988.290477][T24130] should_fail_ex+0x412/0x560 [ 988.290522][T24130] prepare_alloc_pages+0x22a/0x650 [ 988.290552][T24130] __alloc_frozen_pages_noprof+0x12f/0x380 [ 988.290580][T24130] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 988.290606][T24130] ? __pfx_policy_nodemask+0x10/0x10 [ 988.290629][T24130] ? __lock_acquire+0x6b5/0x2cf0 [ 988.290672][T24130] alloc_pages_mpol+0x235/0x490 [ 988.290701][T24130] alloc_pages_noprof+0xac/0x2a0 [ 988.290725][T24130] pte_alloc_one+0x22/0x370 [ 988.290749][T24130] __pte_alloc+0x25/0x1a0 [ 988.290775][T24130] do_pte_missing+0x2cd2/0x33f0 [ 988.290809][T24130] ? __pmd_alloc+0x40a/0x5c0 [ 988.290839][T24130] handle_mm_fault+0x1bd7/0x3170 [ 988.290883][T24130] ? handle_mm_fault+0xee/0x3170 [ 988.290915][T24130] ? __pfx_handle_mm_fault+0x10/0x10 [ 988.290957][T24130] ? __lock_acquire+0x6b5/0x2cf0 [ 988.290989][T24130] ? lock_mm_and_find_vma+0xa7/0x340 [ 988.291023][T24130] do_user_addr_fault+0x75b/0x1340 [ 988.291065][T24130] exc_page_fault+0x6a/0xc0 [ 988.291093][T24130] asm_exc_page_fault+0x26/0x30 [ 988.291113][T24130] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 988.291134][T24130] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 4d 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 988.291151][T24130] RSP: 0018:ffffc90003d1fab8 EFLAGS: 00050202 [ 988.291170][T24130] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 988.291182][T24130] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90003d1fb70 [ 988.291192][T24130] RBP: ffffc90003d1fcb0 R08: ffffc90003d1fb87 R09: 1ffff920007a3f70 [ 988.291203][T24130] R10: dffffc0000000000 R11: fffff520007a3f71 R12: ffff888022b63000 [ 988.291214][T24130] R13: dffffc0000000000 R14: ffffc90003d1fb70 R15: 0000200000000100 [ 988.291245][T24130] _copy_from_user+0x7a/0xb0 [ 988.291262][T24130] rfcomm_dev_ioctl+0x132/0x21d0 [ 988.291283][T24130] ? kasan_quarantine_put+0xbb/0x1f0 [ 988.291307][T24130] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 988.291327][T24130] ? tomoyo_path_number_perm+0x219/0x630 [ 988.291351][T24130] ? tomoyo_path_number_perm+0x219/0x630 [ 988.291376][T24130] ? do_vfs_ioctl+0x1166/0x1530 [ 988.291395][T24130] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 988.291420][T24130] sock_do_ioctl+0x101/0x320 [ 988.291445][T24130] ? __pfx_sock_do_ioctl+0x10/0x10 [ 988.291464][T24130] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 988.291500][T24130] sock_ioctl+0x5c6/0x7f0 [ 988.291526][T24130] ? __pfx_sock_ioctl+0x10/0x10 [ 988.291547][T24130] ? __fget_files+0x2a/0x420 [ 988.291566][T24130] ? __fget_files+0x3a0/0x420 [ 988.291584][T24130] ? __fget_files+0x2a/0x420 [ 988.291606][T24130] ? bpf_lsm_file_ioctl+0x9/0x20 [ 988.291622][T24130] ? __pfx_sock_ioctl+0x10/0x10 [ 988.291642][T24130] __se_sys_ioctl+0xfc/0x170 [ 988.291666][T24130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.291683][T24130] do_syscall_64+0x15f/0xf80 [ 988.291702][T24130] ? trace_irq_disable+0x3b/0x140 [ 988.291720][T24130] ? clear_bhb_loop+0x40/0x90 [ 988.291739][T24130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.291754][T24130] RIP: 0033:0x7f9e38d9c819 [ 988.291769][T24130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 988.291781][T24130] RSP: 002b:00007f9e39be8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 988.291796][T24130] RAX: ffffffffffffffda RBX: 00007f9e39015fa0 RCX: 00007f9e38d9c819 [ 988.291807][T24130] RDX: 0000200000000100 RSI: 00000000800452d3 RDI: 0000000000000004 [ 988.291817][T24130] RBP: 00007f9e39be8090 R08: 0000000000000000 R09: 0000000000000000 [ 988.291827][T24130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 988.291836][T24130] R13: 00007f9e39016038 R14: 00007f9e39015fa0 R15: 00007fff1423c478 [ 988.291861][T24130] [ 990.301646][ T5161] Bluetooth: hci4: command 0x0c1a tx timeout [ 990.302212][ T5917] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 990.327412][ T5917] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 990.346017][T24136] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 990.560793][T24134] netlink: 'syz.4.6306': attribute type 1 has an invalid length. [ 990.579610][T24134] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6306'. [ 991.586916][T24176] FAULT_INJECTION: forcing a failure. [ 991.586916][T24176] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 991.610073][T24176] CPU: 0 UID: 0 PID: 24176 Comm: syz.6.6317 Tainted: G L syzkaller #0 PREEMPT(full) [ 991.610106][T24176] Tainted: [L]=SOFTLOCKUP [ 991.610113][T24176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 991.610123][T24176] Call Trace: [ 991.610132][T24176] [ 991.610142][T24176] dump_stack_lvl+0xe8/0x150 [ 991.610178][T24176] should_fail_ex+0x412/0x560 [ 991.610211][T24176] _copy_to_user+0x31/0xb0 [ 991.610234][T24176] ucma_query+0x1464/0x1a10 [ 991.610272][T24176] ? unwind_next_frame+0xa6/0x2550 [ 991.610298][T24176] ? __pfx_ucma_query+0x10/0x10 [ 991.610354][T24176] ? aa_file_perm+0x192/0x15e0 [ 991.610387][T24176] ? __lock_acquire+0x6b5/0x2cf0 [ 991.610421][T24176] ? aa_file_perm+0x50e/0x15e0 [ 991.610443][T24176] ? aa_file_perm+0x192/0x15e0 [ 991.610477][T24176] ? __might_fault+0xaf/0x130 [ 991.610505][T24176] ? __might_fault+0xaf/0x130 [ 991.610551][T24176] ucma_write+0x24e/0x2f0 [ 991.610578][T24176] ? __pfx_ucma_write+0x10/0x10 [ 991.610599][T24176] ? security_file_permission+0x75/0x260 [ 991.610637][T24176] ? rw_verify_area+0x255/0x4d0 [ 991.610665][T24176] ? __pfx_ucma_write+0x10/0x10 [ 991.610690][T24176] vfs_write+0x29a/0xb90 [ 991.610716][T24176] ? __pfx_vfs_write+0x10/0x10 [ 991.610736][T24176] ? __fget_files+0x2a/0x420 [ 991.610763][T24176] ? __fget_files+0x2a/0x420 [ 991.610785][T24176] ? __fget_files+0x3a0/0x420 [ 991.610808][T24176] ? __fget_files+0x2a/0x420 [ 991.610842][T24176] ksys_write+0x150/0x270 [ 991.610864][T24176] ? __pfx_ksys_write+0x10/0x10 [ 991.610890][T24176] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.610912][T24176] do_syscall_64+0x15f/0xf80 [ 991.610937][T24176] ? trace_irq_disable+0x3b/0x140 [ 991.610960][T24176] ? clear_bhb_loop+0x40/0x90 [ 991.610985][T24176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.611004][T24176] RIP: 0033:0x7f874bf9c819 [ 991.611023][T24176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 991.611040][T24176] RSP: 002b:00007f874ce55028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 991.611062][T24176] RAX: ffffffffffffffda RBX: 00007f874c215fa0 RCX: 00007f874bf9c819 [ 991.611076][T24176] RDX: 0000000000000018 RSI: 00002000000001c0 RDI: 0000000000000003 [ 991.611094][T24176] RBP: 00007f874ce55090 R08: 0000000000000000 R09: 0000000000000000 [ 991.611106][T24176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 991.611118][T24176] R13: 00007f874c216038 R14: 00007f874c215fa0 R15: 00007fff0f536138 [ 991.611150][T24176] [ 991.968368][T24178] netlink: 'syz.8.6318': attribute type 1 has an invalid length. [ 991.977191][T24178] netlink: 224 bytes leftover after parsing attributes in process `syz.8.6318'. [ 992.385635][ T5947] usb 5-1: new full-speed USB device number 64 using dummy_hcd [ 992.558564][ T5947] usb 5-1: unable to get BOS descriptor or descriptor too short [ 992.568095][ T5947] usb 5-1: not running at top speed; connect to a high speed hub [ 992.593576][ T5947] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 992.616251][ T5947] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 992.641514][ T5947] usb 5-1: string descriptor 0 read error: -22 [ 992.653280][ T5947] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 992.675489][ T5947] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.701133][ T5947] usb 5-1: 0:2 : does not exist [ 992.736572][T24206] syzkaller1: entered promiscuous mode [ 992.744083][T24206] syzkaller1: entered allmulticast mode [ 993.047909][ T5956] usb 7-1: new high-speed USB device number 83 using dummy_hcd [ 993.066723][T24212] netlink: 'syz.8.6328': attribute type 1 has an invalid length. [ 993.076798][T24212] netlink: 224 bytes leftover after parsing attributes in process `syz.8.6328'. [ 993.240310][ T5956] usb 7-1: Using ep0 maxpacket: 16 [ 993.248148][ T5956] usb 7-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 993.261932][ T5956] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 993.278659][ T5956] usb 7-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 993.288765][ T5956] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.298702][ T5956] usb 7-1: Product: syz [ 993.303360][ T5956] usb 7-1: Manufacturer: syz [ 993.308686][ T5956] usb 7-1: SerialNumber: syz [ 993.316586][ T5956] usb 7-1: config 0 descriptor?? [ 993.325208][ T5956] appledisplay 7-1:0.0: Could not find int-in endpoint [ 993.334229][ T5956] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 993.541118][T24208] syzkaller1: entered promiscuous mode [ 993.547228][T24208] syzkaller1: entered allmulticast mode [ 993.595309][ T5935] usb 7-1: USB disconnect, device number 83 [ 993.798334][ T5947] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 993.815572][ T5947] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 993.829137][ T5947] usb 5-1: 5:0: failed to get current value for ch 1 (-22) [ 993.867501][ T5947] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 993.912797][ T5947] usb 5-1: USB disconnect, device number 64 [ 993.992496][T24222] FAULT_INJECTION: forcing a failure. [ 993.992496][T24222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 994.007503][T24222] CPU: 0 UID: 0 PID: 24222 Comm: syz.7.6332 Tainted: G L syzkaller #0 PREEMPT(full) [ 994.007525][T24222] Tainted: [L]=SOFTLOCKUP [ 994.007530][T24222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 994.007538][T24222] Call Trace: [ 994.007543][T24222] [ 994.007548][T24222] dump_stack_lvl+0xe8/0x150 [ 994.007573][T24222] should_fail_ex+0x412/0x560 [ 994.007593][T24222] _copy_to_user+0x31/0xb0 [ 994.007606][T24222] simple_read_from_buffer+0xe1/0x170 [ 994.007626][T24222] proc_fail_nth_read+0x1bb/0x230 [ 994.007644][T24222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 994.007662][T24222] ? rw_verify_area+0x2a6/0x4d0 [ 994.007680][T24222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 994.007699][T24222] vfs_read+0x20c/0xa70 [ 994.007716][T24222] ? fdget_pos+0x246/0x320 [ 994.007737][T24222] ? __pfx___mutex_lock+0x10/0x10 [ 994.007764][T24222] ? __pfx_vfs_read+0x10/0x10 [ 994.007792][T24222] ? __fget_files+0x2a/0x420 [ 994.007819][T24222] ? __fget_files+0x3a0/0x420 [ 994.007837][T24222] ? __fget_files+0x2a/0x420 [ 994.007857][T24222] ksys_read+0x150/0x270 [ 994.007870][T24222] ? __pfx_ksys_read+0x10/0x10 [ 994.007880][T24222] ? __pfx_sock_ioctl+0x10/0x10 [ 994.007901][T24222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.007914][T24222] do_syscall_64+0x15f/0xf80 [ 994.007928][T24222] ? trace_irq_disable+0x3b/0x140 [ 994.007961][T24222] ? clear_bhb_loop+0x40/0x90 [ 994.007976][T24222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.007988][T24222] RIP: 0033:0x7f88f615d04e [ 994.008002][T24222] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 994.008012][T24222] RSP: 002b:00007f88f709dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 994.008027][T24222] RAX: ffffffffffffffda RBX: 00007f88f709e6c0 RCX: 00007f88f615d04e [ 994.008036][T24222] RDX: 000000000000000f RSI: 00007f88f709e0a0 RDI: 0000000000000003 [ 994.008043][T24222] RBP: 00007f88f709e090 R08: 0000000000000000 R09: 0000000000000000 [ 994.008050][T24222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 994.008058][T24222] R13: 00007f88f6416038 R14: 00007f88f6415fa0 R15: 00007ffe5b2810f8 [ 994.008076][T24222] [ 994.341758][T24225] FAULT_INJECTION: forcing a failure. [ 994.341758][T24225] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 994.371895][T24225] CPU: 1 UID: 0 PID: 24225 Comm: syz.8.6334 Tainted: G L syzkaller #0 PREEMPT(full) [ 994.371928][T24225] Tainted: [L]=SOFTLOCKUP [ 994.371936][T24225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 994.371948][T24225] Call Trace: [ 994.371957][T24225] [ 994.371965][T24225] dump_stack_lvl+0xe8/0x150 [ 994.372002][T24225] should_fail_ex+0x412/0x560 [ 994.372036][T24225] _copy_to_user+0x31/0xb0 [ 994.372059][T24225] simple_read_from_buffer+0xe1/0x170 [ 994.372093][T24225] proc_fail_nth_read+0x1bb/0x230 [ 994.372124][T24225] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 994.372156][T24225] ? rw_verify_area+0x2a6/0x4d0 [ 994.372187][T24225] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 994.372216][T24225] vfs_read+0x20c/0xa70 [ 994.372244][T24225] ? fdget_pos+0x246/0x320 [ 994.372275][T24225] ? __pfx___mutex_lock+0x10/0x10 [ 994.372305][T24225] ? __pfx_vfs_read+0x10/0x10 [ 994.372337][T24225] ? __fget_files+0x2a/0x420 [ 994.372365][T24225] ? __fget_files+0x3a0/0x420 [ 994.372388][T24225] ? __fget_files+0x2a/0x420 [ 994.372421][T24225] ksys_read+0x150/0x270 [ 994.372444][T24225] ? __pfx_ksys_read+0x10/0x10 [ 994.372472][T24225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.372494][T24225] do_syscall_64+0x15f/0xf80 [ 994.372520][T24225] ? trace_irq_disable+0x3b/0x140 [ 994.372545][T24225] ? clear_bhb_loop+0x40/0x90 [ 994.372571][T24225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.372591][T24225] RIP: 0033:0x7f357015d04e [ 994.372610][T24225] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 994.372625][T24225] RSP: 002b:00007f3570ff6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 994.372647][T24225] RAX: ffffffffffffffda RBX: 00007f3570ff76c0 RCX: 00007f357015d04e [ 994.372662][T24225] RDX: 000000000000000f RSI: 00007f3570ff70a0 RDI: 0000000000000004 [ 994.372675][T24225] RBP: 00007f3570ff7090 R08: 0000000000000000 R09: 0000000000000000 [ 994.372687][T24225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 994.372699][T24225] R13: 00007f3570416038 R14: 00007f3570415fa0 R15: 00007ffcfeac7e68 [ 994.372739][T24225] [ 994.744261][T24232] fuse: Bad value for 'rootmode' [ 995.313333][ T5935] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 995.473624][ T5935] usb 5-1: device descriptor read/64, error -71 [ 995.646338][T24255] netlink: 248 bytes leftover after parsing attributes in process `syz.6.6345'. [ 995.656644][T24255] netlink: 24 bytes leftover after parsing attributes in process `syz.6.6345'. [ 995.669515][T24255] misc userio: Begin command sent, but we're already running [ 995.730093][ T5935] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 995.869014][ T5935] usb 5-1: device descriptor read/64, error -71 [ 995.989296][ T5935] usb usb5-port1: attempt power cycle [ 996.221632][T13153] usb 7-1: new high-speed USB device number 84 using dummy_hcd [ 996.264419][ T5956] usb 9-1: new full-speed USB device number 21 using dummy_hcd [ 996.360617][ T5935] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 996.383505][ T5935] usb 5-1: device descriptor read/8, error -71 [ 996.393496][T13153] usb 7-1: unable to get BOS descriptor or descriptor too short [ 996.402958][T13153] usb 7-1: config 1 has an invalid interface number: 52 but max is 0 [ 996.412805][T13153] usb 7-1: config 1 has no interface number 0 [ 996.420647][T13153] usb 7-1: config 1 interface 52 has no altsetting 0 [ 996.430287][T13153] usb 7-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 996.440689][T13153] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.449830][T13153] usb 7-1: Product: syz [ 996.454667][T13153] usb 7-1: Manufacturer: syz [ 996.455861][ T5956] usb 9-1: unable to get BOS descriptor or descriptor too short [ 996.459811][T13153] usb 7-1: SerialNumber: syz [ 996.475542][ T5956] usb 9-1: not running at top speed; connect to a high speed hub [ 996.485651][ T5956] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 996.497083][ T5956] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 996.511723][ T5956] usb 9-1: string descriptor 0 read error: -22 [ 996.518898][ T5956] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 996.529023][ T5956] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.547049][ T5956] usb 9-1: 0:2 : does not exist [ 996.649308][ T5935] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 996.683157][ T5935] usb 5-1: device descriptor read/8, error -71 [ 996.698426][T13153] ums-karma 7-1:1.52: USB Mass Storage device detected [ 996.797348][T13153] usb 7-1: USB disconnect, device number 84 [ 996.804800][ T5935] usb usb5-port1: unable to enumerate USB device [ 997.329612][T24264] program syz.6.6348 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 997.634113][ T5956] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 997.649760][ T5956] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 997.662942][ T5956] usb 9-1: 5:0: failed to get current value for ch 1 (-22) [ 997.694673][ T5956] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 997.732285][ T5956] usb 9-1: USB disconnect, device number 21 [ 998.256019][T24271] netlink: 20 bytes leftover after parsing attributes in process `syz.8.6350'. [ 998.584197][T13153] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 998.700784][ T5935] usb 7-1: new high-speed USB device number 85 using dummy_hcd [ 998.757519][T13153] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 998.768653][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.781136][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 998.791518][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 998.800854][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.812555][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 998.822746][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 998.830595][ T5856] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 998.841788][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.853915][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 998.863793][ T5935] usb 7-1: Using ep0 maxpacket: 16 [ 998.869749][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 998.878753][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.890261][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 998.901147][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 998.911477][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 998.920434][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.932384][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 998.942243][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 998.949753][ T5935] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 998.959764][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.968754][ T5935] usb 7-1: Product: syz [ 998.973449][ T5935] usb 7-1: Manufacturer: syz [ 998.978824][ T5935] usb 7-1: SerialNumber: syz [ 998.984269][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 998.997145][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 999.007917][ T5935] usb 7-1: config 0 descriptor?? [ 999.013492][ T5856] usb 5-1: Using ep0 maxpacket: 32 [ 999.019348][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 999.034184][ T5935] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 999.044743][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 999.056137][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 999.066053][ T5935] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 999.073157][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 999.082702][ T5856] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 999.093129][T13153] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 999.104344][ T5856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.113519][ T5856] usb 5-1: Product: syz [ 999.118226][T13153] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 999.128041][ T5856] usb 5-1: Manufacturer: syz [ 999.133221][ T5856] usb 5-1: SerialNumber: syz [ 999.139300][T13153] usb 9-1: config 0 interface 0 has no altsetting 0 [ 999.149803][ T5856] usb 5-1: config 0 descriptor?? [ 999.163966][T13153] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 999.174336][T13153] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 999.185999][ T5856] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 999.193982][T13153] usb 9-1: Product: syz [ 999.198620][T13153] usb 9-1: Manufacturer: syz [ 999.204321][T13153] usb 9-1: SerialNumber: syz [ 999.217237][T13153] usb 9-1: config 0 descriptor?? [ 999.226196][T13153] yurex 9-1:0.0: Could not find endpoints [ 999.531910][T13153] usb 9-1: USB disconnect, device number 22 [ 999.677586][ T5935] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 999.989238][ T5935] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 999.998475][ T5935] em28xx 7-1:0.0: board has no eeprom [ 1000.068647][ T5935] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1000.077353][ T5935] em28xx 7-1:0.0: dvb set to bulk mode. [ 1000.084049][ T809] em28xx 7-1:0.0: Binding DVB extension [ 1000.103907][ T5935] usb 7-1: USB disconnect, device number 85 [ 1000.130111][ T5935] em28xx 7-1:0.0: Disconnecting em28xx [ 1000.216967][ T809] em28xx 7-1:0.0: Registering input extension [ 1000.224168][ T5935] em28xx 7-1:0.0: Closing input extension [ 1000.306804][ T5935] em28xx 7-1:0.0: Freeing device [ 1000.472831][T24279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.482978][T24279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.688508][ T5947] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 1000.861705][ T5947] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1000.873266][ T5947] usb 9-1: not running at top speed; connect to a high speed hub [ 1000.884605][ T5947] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1000.896165][ T5947] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1000.913246][ T5947] usb 9-1: string descriptor 0 read error: -22 [ 1000.920422][ T5947] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1000.932901][ T5947] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.955814][ T5947] usb 9-1: 0:2 : does not exist [ 1001.409249][T24295] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1001.418173][T24295] overlayfs: failed to set xattr on upper [ 1001.424676][T24295] overlayfs: ...falling back to redirect_dir=nofollow. [ 1001.432742][T24295] overlayfs: ...falling back to uuid=null. [ 1001.442100][T24295] overlayfs: conflicting lowerdir path [ 1001.651736][ T5856] gspca_ov534_9: reg_r err -71 [ 1001.928025][ T5856] gspca_ov534_9: Unknown sensor 0000 [ 1001.928136][ T5856] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 1001.962517][ T5856] usb 5-1: USB disconnect, device number 69 [ 1002.119340][ T5947] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1002.146303][ T5947] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1002.160700][ T5947] usb 9-1: 5:0: failed to get current value for ch 1 (-22) [ 1002.200946][ T5947] usb 9-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1002.260940][ T5947] usb 9-1: USB disconnect, device number 23 [ 1002.473084][ T5856] usb 7-1: new high-speed USB device number 86 using dummy_hcd [ 1002.633389][ T809] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 1002.643593][ T5856] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1002.655377][ T5856] usb 7-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1002.670293][ T5856] usb 7-1: config 2 interface 0 has no altsetting 0 [ 1002.683545][ T5856] usb 7-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 1002.702002][ T5856] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.713533][ T5856] usb 7-1: Product: syz [ 1002.718227][ T5856] usb 7-1: Manufacturer: syz [ 1002.724956][ T5856] usb 7-1: SerialNumber: syz [ 1002.795668][ T809] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1002.809328][ T809] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1002.819433][ T809] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.838303][ T809] usb 5-1: config 0 descriptor?? [ 1002.850233][ T809] hub 5-1:0.0: USB hub found [ 1002.969577][ T5856] usb 7-1: USB disconnect, device number 86 [ 1003.060129][ T809] hub 5-1:0.0: 1 port detected [ 1003.060780][T17336] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1003.131672][T24322] program syz.7.6368 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1003.244927][T17336] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 1003.261489][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.273065][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.285684][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.300307][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.313289][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.337211][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.347746][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.367553][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.376836][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.388504][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.398596][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.413305][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.422004][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.433545][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.444053][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.458574][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.467971][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.479501][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.489444][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.504206][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.513863][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.552248][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.573994][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.598025][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.607162][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.619993][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.629991][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.651564][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.660490][T17336] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.671977][T17336] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1003.689603][T17336] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1003.704066][T17336] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1003.715786][T17336] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1003.728224][ C0] raw-gadget.2 gadget.4: ignoring, device is not running [ 1003.728929][ T5947] usb 5-1: USB disconnect, device number 70 [ 1003.765607][T17336] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1003.779045][T17336] usb 9-1: Product: syz [ 1003.785521][T17336] usb 9-1: Manufacturer: syz [ 1003.791783][T17336] usb 9-1: SerialNumber: syz [ 1003.820206][T17336] usb 9-1: config 0 descriptor?? [ 1003.850525][T17336] yurex 9-1:0.0: Could not find endpoints [ 1004.169390][T24351] dvmrp1: entered allmulticast mode [ 1004.203212][T24351] dvmrp1: left allmulticast mode [ 1004.215358][ T809] usb 9-1: USB disconnect, device number 24 [ 1004.333990][T24356] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6378'. [ 1004.893683][T24368] netlink: 524 bytes leftover after parsing attributes in process `syz.7.6383'. [ 1005.101123][T24376] tipc: Enabling of bearer rejected, failed to enable media [ 1005.294543][ T809] usb 7-1: new high-speed USB device number 87 using dummy_hcd [ 1005.457133][ T809] usb 7-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.491241][ T809] usb 7-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 1005.519785][ T809] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.528722][ T809] usb 7-1: Product: syz [ 1005.533468][ T809] usb 7-1: Manufacturer: syz [ 1005.538608][ T809] usb 7-1: SerialNumber: syz [ 1005.953120][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1005.982447][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1005.996852][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1006.008383][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1006.021440][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1006.090268][ T5161] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1006.100867][ T5161] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1006.112141][ T5161] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1006.124893][ T5161] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1006.134915][ T5161] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1006.298328][T24382] infiniband syz1: set active [ 1006.312198][T24382] infiniband syz1: added team_slave_0 [ 1006.403767][T24382] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1006.421903][T24382] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1006.442972][T24382] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1006.827449][T24382] RDS/IB: syz1: added [ 1006.843771][T24382] smc: adding ib device syz1 with port count 1 [ 1006.850695][T24382] smc: ib device syz1 port 1 has no pnetid [ 1008.364525][ T5861] Bluetooth: hci0: command tx timeout [ 1010.573804][ T5861] Bluetooth: hci0: command tx timeout [ 1010.913051][ T809] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 1010.920412][ T809] command write [95] error -22 [ 1010.949439][ T809] usb 7-1: USB disconnect, device number 87 [ 1011.450294][ T5917] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 1011.494411][T24408] can: request_module (can-proto-0) failed. [ 1011.642342][ T5917] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 1011.659273][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.670860][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.682897][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.718054][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.749605][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.760904][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.771133][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.785859][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.794857][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.806537][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.816658][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.831579][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.841644][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.854032][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.865166][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.880001][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.888725][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.900339][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.910488][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.924993][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.937263][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.949085][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1011.960463][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1011.962190][ T809] usb 7-1: new full-speed USB device number 88 using dummy_hcd [ 1011.985175][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1011.994435][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.005851][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.017119][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1012.031643][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1012.044231][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.059143][ T5917] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.070375][ T5917] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1012.085010][ T5917] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1012.095536][ T5917] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1012.107468][ T5917] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1012.117031][ T5917] usb 9-1: Product: syz [ 1012.121654][ T5917] usb 9-1: Manufacturer: syz [ 1012.127166][ T5917] usb 9-1: SerialNumber: syz [ 1012.136872][ T5917] usb 9-1: config 0 descriptor?? [ 1012.147241][ T5917] yurex 9-1:0.0: Could not find endpoints [ 1012.167517][ T809] usb 7-1: config 0 has an invalid interface number: 52 but max is 0 [ 1012.183422][ T809] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.205820][ T809] usb 7-1: config 0 has no interface number 0 [ 1012.218226][ T809] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 1012.249796][ T809] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1012.272092][ T809] usb 7-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1012.305282][ T809] usb 7-1: config 0 interface 52 has no altsetting 0 [ 1012.327004][ T809] usb 7-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 1012.337283][ T809] usb 7-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 1012.366299][ T809] usb 7-1: Manufacturer: syz [ 1012.382071][ T809] usb 7-1: config 0 descriptor?? [ 1012.391266][ T809] hub 7-1:0.52: bad descriptor, ignoring hub [ 1012.398706][ T809] hub 7-1:0.52: probe with driver hub failed with error -5 [ 1012.494164][T24393] chnl_net:caif_netlink_parms(): no params data found [ 1012.601894][ T5935] usb 9-1: USB disconnect, device number 25 [ 1012.666148][ T809] synaptics_usb 7-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1012.677577][ T809] synaptics_usb 7-1:0.52: probe with driver synaptics_usb failed with error -5 [ 1012.737309][T24393] bridge0: port 1(bridge_slave_0) entered blocking state [ 1012.745707][T24393] bridge0: port 1(bridge_slave_0) entered disabled state [ 1012.754303][T24393] bridge_slave_0: entered allmulticast mode [ 1012.763403][T24393] bridge_slave_0: entered promiscuous mode [ 1012.773718][T24393] bridge0: port 2(bridge_slave_1) entered blocking state [ 1012.782044][T24393] bridge0: port 2(bridge_slave_1) entered disabled state [ 1012.790005][ T5861] Bluetooth: hci0: command tx timeout [ 1012.796607][T24393] bridge_slave_1: entered allmulticast mode [ 1012.805392][T24393] bridge_slave_1: entered promiscuous mode [ 1012.853071][T24393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1012.882468][T24393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1012.934990][T24393] team0: Port device team_slave_0 added [ 1012.944924][T24393] team0: Port device team_slave_1 added [ 1012.988328][ T5935] usb 7-1: USB disconnect, device number 88 [ 1012.995634][T24393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1013.003691][T24393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1013.037398][T24393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1013.060478][T24393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1013.069086][T24393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1013.098220][T24393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1013.199348][T24393] hsr_slave_0: entered promiscuous mode [ 1013.214371][T24393] hsr_slave_1: entered promiscuous mode [ 1013.228081][T24393] debugfs: 'hsr0' already exists in 'hsr' [ 1013.244540][T24393] Cannot create hsr debugfs directory [ 1013.854376][ T5917] usb 7-1: new full-speed USB device number 89 using dummy_hcd [ 1013.922380][T24393] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1013.997897][T24393] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1014.013083][T24393] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1014.032876][ T5917] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1014.049883][T24393] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1014.058406][ T5917] usb 7-1: not running at top speed; connect to a high speed hub [ 1014.069438][ T5917] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1014.100550][ T5917] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1014.139776][ T5917] usb 7-1: string descriptor 0 read error: -22 [ 1014.150798][ T5917] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1014.185562][ T5917] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.224956][ T5917] usb 7-1: 0:2 : does not exist [ 1014.471206][T24393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1014.503303][T24393] 8021q: adding VLAN 0 to HW filter on device team0 [ 1014.524576][T23310] bridge0: port 1(bridge_slave_0) entered blocking state [ 1014.532558][T23310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1014.554029][T23318] bridge0: port 2(bridge_slave_1) entered blocking state [ 1014.562013][T23318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1014.883793][T24393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1014.892071][ T809] usb 9-1: new full-speed USB device number 26 using dummy_hcd [ 1014.921190][ T5917] usb 7-1: 5:0: cannot get min/max values for control 2 (id 5) [ 1014.941311][ T5917] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1014.961707][ T5917] usb 7-1: 5:0: failed to get current value for ch 1 (-22) [ 1015.017891][ T5917] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 1015.031399][ T5861] Bluetooth: hci0: command tx timeout [ 1015.062823][ T809] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1015.086835][ T809] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1015.104401][ T5917] usb 7-1: USB disconnect, device number 89 [ 1015.109613][ T809] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.156141][ T809] usb 9-1: config 0 descriptor?? [ 1015.189507][ T809] hub 9-1:0.0: USB hub found [ 1015.257791][T24393] veth0_vlan: entered promiscuous mode [ 1015.272731][T24393] veth1_vlan: entered promiscuous mode [ 1015.314951][T24393] veth0_macvtap: entered promiscuous mode [ 1015.326465][T24393] veth1_macvtap: entered promiscuous mode [ 1015.348981][T24393] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1015.366602][T24393] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1015.386489][T23306] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.396599][T23306] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.409291][ T809] hub 9-1:0.0: 1 port detected [ 1015.415612][T23306] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.431596][T23310] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.649425][T23317] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1015.671648][T23317] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1015.727730][T23306] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1015.737561][T23306] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1015.984560][T24469] syzkaller1: entered promiscuous mode [ 1015.995134][T24469] syzkaller1: entered allmulticast mode [ 1016.072754][ C0] raw-gadget.2 gadget.8: ignoring, device is not running [ 1016.074857][ T5947] usb 9-1: USB disconnect, device number 26 [ 1016.258368][T24471] syzkaller1: entered promiscuous mode [ 1016.264554][T24471] syzkaller1: entered allmulticast mode [ 1016.525920][ T5935] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 1016.696157][ T5935] usb 7-1: Using ep0 maxpacket: 32 [ 1016.705359][ T5935] usb 7-1: config 0 has an invalid interface number: 188 but max is 0 [ 1016.728112][ T5935] usb 7-1: config 0 has no interface number 0 [ 1016.734925][ T5935] usb 7-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1016.782171][ T5935] usb 7-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1016.810749][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.835230][ T5935] usb 7-1: Product: syz [ 1016.841410][ T5935] usb 7-1: Manufacturer: syz [ 1016.846595][ T5935] usb 7-1: SerialNumber: syz [ 1016.867660][ T5935] usb 7-1: config 0 descriptor?? [ 1016.878704][T24471] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1017.122254][T24471] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1017.352711][ T5935] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1017.366437][ T5935] asix 7-1:0.188: probe with driver asix failed with error -61 [ 1018.117545][ T5917] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 1018.277650][ T5917] usb 9-1: Using ep0 maxpacket: 8 [ 1018.297090][ T5917] usb 9-1: config 0 has an invalid interface number: 239 but max is 0 [ 1018.325116][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1018.369275][ T5917] usb 9-1: config 0 has no interface number 0 [ 1018.389951][ T5917] usb 9-1: config 0 interface 239 altsetting 0 has an endpoint descriptor with address 0x64, changing to 0x4 [ 1018.403813][ T5917] usb 9-1: config 0 interface 239 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 8 [ 1018.415313][ T5917] usb 9-1: config 0 interface 239 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1018.451633][ T5917] usb 9-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a [ 1018.462592][ T5917] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.472429][ T5917] usb 9-1: Product: syz [ 1018.477127][ T5917] usb 9-1: Manufacturer: syz [ 1018.482894][ T5917] usb 9-1: SerialNumber: syz [ 1018.499872][ T5917] usb 9-1: config 0 descriptor?? [ 1018.506651][T24512] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1018.739704][T24512] netlink: 'syz.8.6416': attribute type 40 has an invalid length. [ 1018.848112][ T5917] ath6kl: Failed to submit usb control message: -71 [ 1018.859526][ T5917] ath6kl: unable to send the bmi data to the device: -71 [ 1018.867636][ T5917] ath6kl: Unable to send get target info: -71 [ 1018.875097][ T5917] ath6kl: Failed to init ath6kl core: -71 [ 1018.884296][ T5917] ath6kl_usb 9-1:0.239: probe with driver ath6kl_usb failed with error -71 [ 1018.901408][ T5917] usb 9-1: USB disconnect, device number 27 [ 1019.504663][ T5935] usb 7-1: USB disconnect, device number 90 [ 1020.054366][T24615] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1020.209956][T24627] syzkaller1: entered promiscuous mode [ 1020.226640][T24627] syzkaller1: entered allmulticast mode [ 1020.744979][T24665] netlink: 'syz.9.6441': attribute type 1 has an invalid length. [ 1021.216863][ T5856] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1021.399151][ T5856] usb 10-1: Using ep0 maxpacket: 32 [ 1021.406362][ T5856] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1021.421541][ T5856] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1021.435029][ T5856] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1021.446187][ T5856] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1021.469275][ T5856] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1021.491702][ T5856] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1021.511460][ T5856] usb 10-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1021.522550][ T5856] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.531610][ T5856] usb 10-1: Product: syz [ 1021.536482][ T5856] usb 10-1: Manufacturer: syz [ 1021.542947][ T5856] usb 10-1: SerialNumber: syz [ 1021.544107][T24700] syzkaller1: entered promiscuous mode [ 1021.548503][ T5935] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 1021.555502][T24700] syzkaller1: entered allmulticast mode [ 1021.572093][ T5856] usb 10-1: config 0 descriptor?? [ 1021.774011][ T5935] usb 9-1: config 0 has an invalid interface number: 127 but max is 1 [ 1021.783354][ T5935] usb 9-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 225 [ 1021.798158][ T5935] usb 9-1: config 0 has no interface number 1 [ 1021.806044][ T5935] usb 9-1: config 0 interface 127 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1021.820980][ T5935] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 29 [ 1021.827108][T17336] usb 10-1: USB disconnect, device number 2 [ 1021.841000][ T5935] usb 9-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 1021.878140][ T5935] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.903280][ T5935] usb 9-1: Product: syz [ 1021.908006][ T5935] usb 9-1: Manufacturer: syz [ 1021.913735][ T5935] usb 9-1: SerialNumber: syz [ 1021.936511][ T5935] usb 9-1: config 0 descriptor?? [ 1021.957874][ T5935] usb-storage 9-1:0.127: USB Mass Storage device detected [ 1021.979917][ T5935] usb-storage 9-1:0.127: Quirks match for vid 1908 pid 1315: 20000 [ 1022.063616][ T5935] usb-storage 9-1:0.0: USB Mass Storage device detected [ 1022.089788][ T5935] usb-storage 9-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 1022.181367][T17336] usb 9-1: USB disconnect, device number 28 [ 1022.852116][T24773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1022.867776][T24773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1022.947610][ T5935] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 1023.086418][ T5917] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 1023.109195][ T5935] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1023.121650][ T5935] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 1023.135446][ T5935] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1023.145731][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.154619][ T5935] usb 7-1: Product: syz [ 1023.159231][ T5935] usb 7-1: Manufacturer: syz [ 1023.164366][ T5935] usb 7-1: SerialNumber: syz [ 1023.269775][ T5917] usb 9-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1023.280085][ T5917] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1023.292290][ T5917] usb 9-1: config 0 descriptor?? [ 1023.394193][T24760] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1023.523095][ T5917] udl 9-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1023.535447][ T5917] [drm:udl_init] *ERROR* Selecting channel failed [ 1023.568769][ T5917] [drm] Initialized udl 0.0.1 for 9-1:0.0 on minor 2 [ 1023.576233][ T5917] [drm] Initialized udl on minor 2 [ 1023.583670][ T5917] udl 9-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1023.600079][ T5917] udl 9-1:0.0: [drm] Cannot find any crtc or sizes [ 1023.613591][T17336] udl 9-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1023.628968][ T5917] usb 9-1: USB disconnect, device number 29 [ 1023.635963][T17336] udl 9-1:0.0: [drm] Cannot find any crtc or sizes [ 1024.053123][T24760] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1024.277346][ T5935] cdc_ncm 7-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1024.289568][ T5935] cdc_ncm 7-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 1024.298768][ T5935] cdc_ncm 7-1:1.0: setting rx_max = 2048 [ 1024.302843][T24825] affs: No valid root block on device nbd8 [ 1024.491288][ T5935] cdc_ncm 7-1:1.0: setting tx_max = 88 [ 1024.534623][ T5935] cdc_ncm 7-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.6-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1024.564289][ T5935] usb 7-1: USB disconnect, device number 91 [ 1024.576970][ T5935] cdc_ncm 7-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.6-1, CDC NCM (NO ZLP) [ 1025.199555][T24886] syzkaller1: entered promiscuous mode [ 1025.207162][T24886] syzkaller1: entered allmulticast mode [ 1025.379764][ T5917] usb 9-1: new full-speed USB device number 30 using dummy_hcd [ 1025.556779][ T5917] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1025.569157][ T5917] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1025.579512][ T5917] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1025.596647][ T5917] usb 9-1: config 0 descriptor?? [ 1025.617355][ T5917] hub 9-1:0.0: USB hub found [ 1025.725821][ T5935] usb 7-1: new full-speed USB device number 92 using dummy_hcd [ 1025.827730][ T5917] hub 9-1:0.0: 1 port detected [ 1025.887961][ T5935] usb 7-1: config 5 has an invalid interface number: 230 but max is 0 [ 1025.897271][ T5935] usb 7-1: config 5 has no interface number 0 [ 1025.904067][ T5935] usb 7-1: config 5 interface 230 altsetting 60 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 1025.916330][ T5935] usb 7-1: config 5 interface 230 has no altsetting 0 [ 1025.926199][ T5935] usb 7-1: New USB device found, idVendor=0424, idProduct=7801, bcdDevice=e0.9e [ 1025.936378][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.946412][ T5935] usb 7-1: Product: syz [ 1025.951243][ T5935] usb 7-1: Manufacturer: syz [ 1025.956327][ T5935] usb 7-1: SerialNumber: syz [ 1025.975421][T24904] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1026.298831][ T5935] usb 7-1: USB disconnect, device number 92 [ 1026.513730][T24875] syzkaller1: entered promiscuous mode [ 1026.521214][T24875] syzkaller1: entered allmulticast mode [ 1026.904821][ T5917] hub 9-1:0.0: hub_ext_port_status failed (err = -71) [ 1026.905541][T22814] usb 9-1: USB disconnect, device number 30 [ 1027.136546][T17336] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 1027.160105][T24964] binder: 24963:24964 ioctl c018620c 200000000140 returned -22 [ 1027.291232][T24972] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6479'. [ 1027.331355][T17336] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1027.350202][T17336] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1027.371726][T17336] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.392222][T17336] usb 7-1: config 0 descriptor?? [ 1027.405607][T17336] pwc: Askey VC010 type 2 USB webcam detected. [ 1027.689572][T17336] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1027.700769][T17336] pwc: recv_control_msg error -71 req 02 val 2700 [ 1027.710026][T17336] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1027.722715][T17336] pwc: recv_control_msg error -71 req 04 val 1000 [ 1027.734492][T17336] pwc: recv_control_msg error -71 req 04 val 1300 [ 1027.743118][T17336] pwc: recv_control_msg error -71 req 04 val 1400 [ 1027.760313][T17336] pwc: recv_control_msg error -71 req 02 val 2000 [ 1027.785989][T17336] pwc: recv_control_msg error -71 req 02 val 2100 [ 1027.795126][T17336] pwc: recv_control_msg error -71 req 04 val 1500 [ 1027.804856][T17336] pwc: recv_control_msg error -71 req 02 val 2500 [ 1027.812929][T17336] pwc: recv_control_msg error -71 req 02 val 2400 [ 1027.820888][T17336] pwc: recv_control_msg error -71 req 02 val 2600 [ 1027.828548][T17336] pwc: recv_control_msg error -71 req 02 val 2900 [ 1027.845621][T17336] pwc: recv_control_msg error -71 req 02 val 2800 [ 1027.852896][ T5947] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 1027.863029][T17336] pwc: recv_control_msg error -71 req 04 val 1100 [ 1027.871887][T17336] pwc: recv_control_msg error -71 req 04 val 1200 [ 1027.897791][T17336] pwc: Registered as video103. [ 1027.909619][T17336] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input84 [ 1027.938627][T17336] usb 7-1: USB disconnect, device number 93 [ 1028.035145][ T5947] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 1028.045880][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.057773][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.070240][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.079532][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.090217][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.101267][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.110325][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.120326][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.131150][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.139507][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.149615][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.160793][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.169097][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.182701][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.193577][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.202680][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.212566][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.223303][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.232585][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.242444][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.253246][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.261720][ T5947] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1028.272165][ T5947] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1028.282933][ T5947] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1028.292161][ T5947] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1028.302376][ T5947] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1028.311750][ T5947] usb 9-1: Product: syz [ 1028.316361][ T5947] usb 9-1: Manufacturer: syz [ 1028.321400][ T5947] usb 9-1: SerialNumber: syz [ 1028.329239][ T5947] usb 9-1: config 0 descriptor?? [ 1028.334922][T17336] usb 7-1: new high-speed USB device number 94 using dummy_hcd [ 1028.350085][ T5947] yurex 9-1:0.0: Could not find endpoints [ 1028.483405][T17336] usb 7-1: device descriptor read/64, error -71 [ 1028.641638][T22814] usb 9-1: USB disconnect, device number 31 [ 1028.739846][T17336] usb 7-1: new high-speed USB device number 95 using dummy_hcd [ 1028.888907][T17336] usb 7-1: device descriptor read/64, error -71 [ 1029.007265][T17336] usb usb7-port1: attempt power cycle [ 1029.380460][T17336] usb 7-1: new high-speed USB device number 96 using dummy_hcd [ 1029.403907][T17336] usb 7-1: device descriptor read/8, error -71 [ 1029.658318][T17336] usb 7-1: new high-speed USB device number 97 using dummy_hcd [ 1029.680291][T17336] usb 7-1: device descriptor read/8, error -71 [ 1029.798977][T22814] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 1029.801127][T17336] usb usb7-port1: unable to enumerate USB device [ 1029.968123][T22814] usb 9-1: Using ep0 maxpacket: 16 [ 1029.975456][T22814] usb 9-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 1029.987314][T22814] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1030.005689][T22814] usb 9-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1030.016015][T22814] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.024921][T22814] usb 9-1: Product: syz [ 1030.029921][T22814] usb 9-1: Manufacturer: syz [ 1030.035195][T22814] usb 9-1: SerialNumber: syz [ 1030.042743][T22814] usb 9-1: config 0 descriptor?? [ 1030.052576][T22814] appledisplay 9-1:0.0: Could not find int-in endpoint [ 1030.061037][T22814] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 1030.267931][T25054] syzkaller1: entered promiscuous mode [ 1030.274012][T25054] syzkaller1: entered allmulticast mode [ 1030.300242][T17336] usb 9-1: USB disconnect, device number 32 [ 1030.812421][T22814] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1030.975784][T22814] usb 10-1: no configurations [ 1030.994046][T22814] usb 10-1: can't read configurations, error -22 [ 1031.132917][T22814] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1031.293824][T22814] usb 10-1: no configurations [ 1031.299056][T22814] usb 10-1: can't read configurations, error -22 [ 1031.307922][T22814] usb usb10-port1: attempt power cycle [ 1031.423358][ T5856] usb 7-1: new high-speed USB device number 98 using dummy_hcd [ 1032.569392][ T5856] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1032.580023][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1032.591700][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1032.596858][ T5947] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 1032.603779][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1032.746579][ T5947] usb 9-1: device descriptor read/64, error -71 [ 1032.815573][T22814] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1032.824026][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1032.833152][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1032.843671][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1032.855925][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1032.866752][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1032.876152][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1032.886100][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1032.898294][T22814] usb 10-1: no configurations [ 1032.903490][T22814] usb 10-1: can't read configurations, error -22 [ 1032.910603][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1032.922440][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1032.931164][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1032.941263][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1032.953911][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1032.964740][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1032.972932][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1032.982783][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1032.995273][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1033.006164][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1033.013756][ T5947] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 1033.023228][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1033.033187][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1033.045215][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1033.056656][T22814] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1033.065947][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1033.074596][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1033.084649][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1033.096786][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1033.107620][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1033.115675][T22814] usb 10-1: no configurations [ 1033.121086][T22814] usb 10-1: can't read configurations, error -22 [ 1033.128699][T22814] usb usb10-port1: unable to enumerate USB device [ 1033.136034][ T5856] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1033.146508][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1033.158557][ T5856] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1033.165098][ T5947] usb 9-1: device descriptor read/64, error -71 [ 1033.170168][ T5856] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1033.186467][ T5856] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1033.196508][ T5856] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1033.205804][ T5856] usb 7-1: Product: syz [ 1033.210470][ T5856] usb 7-1: Manufacturer: syz [ 1033.215554][ T5856] usb 7-1: SerialNumber: syz [ 1033.223374][ T5856] usb 7-1: config 0 descriptor?? [ 1033.232702][ T5856] yurex 7-1:0.0: Could not submitting URB [ 1033.239325][ T5856] yurex 7-1:0.0: probe with driver yurex failed with error -5 [ 1033.304768][ T5947] usb usb9-port1: attempt power cycle [ 1033.517053][ T5917] usb 7-1: USB disconnect, device number 98 [ 1033.668004][ T5947] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 1033.698233][ T5947] usb 9-1: device descriptor read/8, error -71 [ 1033.954342][ T5947] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 1033.978538][ T5947] usb 9-1: device descriptor read/8, error -71 [ 1034.094896][ T5947] usb usb9-port1: unable to enumerate USB device [ 1034.693696][T25161] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1034.701720][T25161] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1034.721404][T25161] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1035.088133][ T5947] usb 10-1: new low-speed USB device number 7 using dummy_hcd [ 1035.285894][ T5947] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1035.295579][ T5947] usb 10-1: config 197 has an invalid interface number: 211 but max is 0 [ 1035.305055][ T5947] usb 10-1: config 197 has no interface number 0 [ 1035.312765][ T5947] usb 10-1: config 197 interface 211 has no altsetting 0 [ 1035.324081][ T5947] usb 10-1: string descriptor 0 read error: -22 [ 1035.331065][ T5947] usb 10-1: New USB device found, idVendor=0923, idProduct=010f, bcdDevice=b1.cd [ 1035.341569][ T5947] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.364901][ T5947] gspca_main: tv8532-2.14.0 probing 0923:010f [ 1035.471557][T17336] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 1035.628798][ T5947] usb 10-1: USB disconnect, device number 7 [ 1035.657234][T17336] usb 7-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1035.687939][T17336] usb 7-1: New USB device strings: Mfr=65, Product=2, SerialNumber=3 [ 1035.715059][T17336] usb 7-1: Product: syz [ 1035.731141][T17336] usb 7-1: Manufacturer: syz [ 1035.747156][T17336] usb 7-1: SerialNumber: syz [ 1035.761537][T17336] usb 7-1: config 0 descriptor?? [ 1036.016098][T25184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1036.032528][T25184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1036.049573][ T5861] Bluetooth: hci0: command 0x0c1a tx timeout [ 1036.100341][T17336] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1036.108539][T17336] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 1036.117011][T17336] sq905c 7-1:0.0: Get version command failed [ 1036.125674][T17336] sq905c 7-1:0.0: probe with driver sq905c failed with error -71 [ 1036.140619][T17336] usb 7-1: USB disconnect, device number 99 [ 1036.240970][ T5917] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 1036.411986][ T5917] usb 9-1: Using ep0 maxpacket: 32 [ 1036.421629][ T5917] usb 9-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 1036.431727][ T5917] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1036.440816][ T5917] usb 9-1: Product: syz [ 1036.445555][ T5917] usb 9-1: Manufacturer: syz [ 1036.450931][ T5917] usb 9-1: SerialNumber: syz [ 1036.465412][ T5856] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1036.637435][ T5856] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 1036.649019][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.659278][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.672656][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.684024][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1036.699562][ T5917] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 1036.699557][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.735063][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.760417][ T5917] usb 9-1: USB disconnect, device number 37 [ 1036.771953][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.785179][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1036.813543][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.825256][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.839591][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.851307][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1036.869723][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.879823][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.892948][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.905269][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1036.914075][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.924039][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.936581][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.947613][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1036.957789][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1036.968183][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1036.981799][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1036.992889][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1037.002578][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1037.012835][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1037.025667][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1037.037266][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1037.046175][ T5856] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1037.056486][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1037.069481][ T5856] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1037.080862][ T5856] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1037.092230][ T5856] usb 10-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1037.102552][ T5856] usb 10-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1037.114061][ T5856] usb 10-1: Product: syz [ 1037.118848][ T5856] usb 10-1: Manufacturer: syz [ 1037.124023][ T5856] usb 10-1: SerialNumber: syz [ 1037.134358][ T5856] usb 10-1: config 0 descriptor?? [ 1037.145069][ T5856] yurex 10-1:0.0: Could not submitting URB [ 1037.152477][ T5856] yurex 10-1:0.0: probe with driver yurex failed with error -5 [ 1037.470605][ T5917] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 1037.483845][ T5856] usb 10-1: USB disconnect, device number 8 [ 1037.651438][ T5917] usb 7-1: Using ep0 maxpacket: 32 [ 1037.659193][ T5917] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1037.671776][ T5917] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1037.685189][ T5917] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1037.695495][ T5917] usb 7-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1037.704927][ T5917] usb 7-1: Product: syz [ 1037.709713][ T5917] usb 7-1: Manufacturer: syz [ 1037.725034][ T5917] hub 7-1:4.0: USB hub found [ 1037.939285][ T5917] hub 7-1:4.0: 2 ports detected [ 1038.220427][ T5917] hub 7-1:4.0: hub_hub_status failed (err = -71) [ 1038.232052][ T5917] hub 7-1:4.0: config failed, can't get hub status (err -71) [ 1038.261085][ T5861] Bluetooth: hci0: command 0x0c1a tx timeout [ 1038.268103][ T5917] usb 7-1: USB disconnect, device number 100 [ 1038.585063][T25314] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1038.619057][ C0] [ 1038.621617][ C0] ================================ [ 1038.627221][ C0] WARNING: inconsistent lock state [ 1038.632822][ C0] syzkaller #0 Tainted: G L [ 1038.639419][ C0] -------------------------------- [ 1038.645029][ C0] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. [ 1038.652562][ C0] syz.8.6518/25314 [HC1[1]:SC0[0]:HE0:SE1] takes: [ 1038.659631][ C0] ffff888031d2e068 (&dev->spinlock){?...}-{3:3}, at: das16m1_interrupt+0x5e/0x180 [ 1038.669888][ C0] {HARDIRQ-ON-W} state was registered at: [ 1038.676169][ C0] lock_acquire+0x106/0x350 [ 1038.681219][ C0] _raw_spin_lock_bh+0x36/0x50 [ 1038.686555][ C0] waveform_ao_cancel+0x8d/0x120 [ 1038.692098][ C0] comedi_close+0x27e/0x5e0 [ 1038.697144][ C0] __fput+0x44f/0xa60 [ 1038.701624][ C0] task_work_run+0x1d9/0x270 [ 1038.706766][ C0] exit_to_user_mode_loop+0xed/0x480 [ 1038.712677][ C0] do_syscall_64+0x33e/0xf80 [ 1038.717825][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.724497][ C0] irq event stamp: 3228 [ 1038.729060][ C0] hardirqs last enabled at (3227): [] _raw_spin_unlock_irqrestore+0x30/0x80 [ 1038.740414][ C0] hardirqs last disabled at (3228): [] common_interrupt+0x13/0xe0 [ 1038.750810][ C0] softirqs last enabled at (3186): [] fpu_swap_kvm_fpstate+0xc1/0x4f0 [ 1038.761588][ C0] softirqs last disabled at (3184): [] fpu_swap_kvm_fpstate+0xc1/0x4f0 [ 1038.772372][ C0] [ 1038.772372][ C0] other info that might help us debug this: [ 1038.781230][ C0] Possible unsafe locking scenario: [ 1038.781230][ C0] [ 1038.789431][ C0] CPU0 [ 1038.793034][ C0] ---- [ 1038.796634][ C0] lock(&dev->spinlock); [ 1038.801397][ C0] [ 1038.805190][ C0] lock(&dev->spinlock); [ 1038.810149][ C0] [ 1038.810149][ C0] *** DEADLOCK *** [ 1038.810149][ C0] [ 1038.819103][ C0] 2 locks held by syz.8.6518/25314: [ 1038.824808][ C0] #0: ffff88807c1c42c8 (&tty->termios_rwsem){++++}-{4:4}, at: uart_ioctl+0x108/0x1aa0 [ 1038.835426][ C0] #1: ffff888143ae8e58 (&port->mutex){+.+.}-{4:4}, at: uart_ioctl+0x132/0x1aa0 [ 1038.845467][ C0] [ 1038.845467][ C0] stack backtrace: [ 1038.851961][ C0] CPU: 0 UID: 0 PID: 25314 Comm: syz.8.6518 Tainted: G L syzkaller #0 PREEMPT(full) [ 1038.851981][ C0] Tainted: [L]=SOFTLOCKUP [ 1038.851987][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1038.851996][ C0] Call Trace: [ 1038.852003][ C0] [ 1038.852009][ C0] dump_stack_lvl+0xe8/0x150 [ 1038.852029][ C0] print_usage_bug+0x28b/0x2e0 [ 1038.852050][ C0] mark_lock_irq+0x410/0x420 [ 1038.852072][ C0] mark_lock+0x115/0x190 [ 1038.852091][ C0] __lock_acquire+0x661/0x2cf0 [ 1038.852109][ C0] ? __asan_memset+0x22/0x50 [ 1038.852132][ C0] ? das16m1_interrupt+0x5e/0x180 [ 1038.852148][ C0] lock_acquire+0x106/0x350 [ 1038.852165][ C0] ? das16m1_interrupt+0x5e/0x180 [ 1038.852184][ C0] _raw_spin_lock+0x2e/0x40 [ 1038.852199][ C0] ? das16m1_interrupt+0x5e/0x180 [ 1038.852213][ C0] das16m1_interrupt+0x5e/0x180 [ 1038.852228][ C0] ? __pfx_das16m1_interrupt+0x10/0x10 [ 1038.852243][ C0] __handle_irq_event_percpu+0x216/0x9a0 [ 1038.852262][ C0] handle_irq_event+0x8b/0x1e0 [ 1038.852277][ C0] ? handle_edge_irq+0x229/0x9f0 [ 1038.852292][ C0] handle_edge_irq+0x23b/0x9f0 [ 1038.852308][ C0] __common_interrupt+0x141/0x1f0 [ 1038.852327][ C0] common_interrupt+0xb6/0xe0 [ 1038.852341][ C0] [ 1038.852346][ C0] [ 1038.852352][ C0] asm_common_interrupt+0x26/0x40 [ 1038.852366][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 1038.852384][ C0] Code: f7 e8 bd fd e5 f5 f7 c3 00 02 00 00 74 05 e8 60 69 11 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 96 d7 f5 65 8b 05 dd a7 84 07 85 c0 74 18 5b 41 5e e9 41 48 [ 1038.852396][ C0] RSP: 0018:ffffc900044f7a28 EFLAGS: 00000206 [ 1038.852409][ C0] RAX: 0000000000000002 RBX: 0000000000000287 RCX: 0000000080000001 [ 1038.852419][ C0] RDX: 0000000000000006 RSI: ffffffff8e106c7e RDI: 0000000000000001 [ 1038.852429][ C0] RBP: ffffc900044f7be0 R08: ffffffff9033bef7 R09: 1ffffffff20677de [ 1038.852439][ C0] R10: dffffc0000000000 R11: fffffbfff20677df R12: 0000000000000100 [ 1038.852449][ C0] R13: dffffc0000000000 R14: ffffffff9a82bfe0 R15: ffffffff8f231860 [ 1038.852465][ C0] serial8250_config_port+0x1464/0x53b0 [ 1038.852489][ C0] ? __release_region+0x38c/0x440 [ 1038.852505][ C0] ? __pfx_serial8250_config_port+0x10/0x10 [ 1038.852521][ C0] ? __release_region+0x38c/0x440 [ 1038.852544][ C0] ? __pfx___release_region+0x10/0x10 [ 1038.852559][ C0] univ8250_config_port+0x3b9/0x980 [ 1038.852576][ C0] ? __free_frozen_pages+0x749/0xd30 [ 1038.852595][ C0] ? __pfx_univ8250_release_port+0x10/0x10 [ 1038.852613][ C0] ? serial8250_release_std_resource+0x135/0x2e0 [ 1038.852631][ C0] uart_ioctl+0x1513/0x1aa0 [ 1038.852649][ C0] ? do_futex+0x333/0x420 [ 1038.852668][ C0] ? __pfx_uart_ioctl+0x10/0x10 [ 1038.852685][ C0] ? __fget_files+0x2a/0x420 [ 1038.852703][ C0] ? __fget_files+0x3a0/0x420 [ 1038.852719][ C0] ? __fget_files+0x2a/0x420 [ 1038.852736][ C0] tty_ioctl+0x928/0xde0 [ 1038.852750][ C0] ? __pfx_tty_ioctl+0x10/0x10 [ 1038.852762][ C0] __se_sys_ioctl+0xfc/0x170 [ 1038.852776][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.852790][ C0] do_syscall_64+0x15f/0xf80 [ 1038.852806][ C0] ? trace_irq_disable+0x3b/0x140 [ 1038.852822][ C0] ? clear_bhb_loop+0x40/0x90 [ 1038.852837][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.852850][ C0] RIP: 0033:0x7f357019c819 [ 1038.852863][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1038.852874][ C0] RSP: 002b:00007f3570ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1038.852888][ C0] RAX: ffffffffffffffda RBX: 00007f3570415fa0 RCX: 00007f357019c819 [ 1038.852898][ C0] RDX: 000000000300fff2 RSI: 0000000000005453 RDI: 0000000000000003 [ 1038.852908][ C0] RBP: 00007f3570232c91 R08: 0000000000000000 R09: 0000000000000000 [ 1038.852917][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1038.852925][ C0] R13: 00007f3570416038 R14: 00007f3570415fa0 R15: 00007ffcfeac7e68 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1038.852940][ C0] [ 1038.853017][ C0] comedi comedi3: fifo overflow [ 1039.322341][T25314] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1039.995546][T23304] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1040.049857][T23304] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1040.091348][T23304] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1040.166142][T23304] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1040.334676][T23304] bridge_slave_1: left allmulticast mode [ 1040.343782][T23304] bridge_slave_1: left promiscuous mode [ 1040.350340][T23304] bridge0: port 2(bridge_slave_1) entered disabled state [ 1040.362253][T23304] bridge_slave_0: left allmulticast mode [ 1040.368726][T23304] bridge_slave_0: left promiscuous mode [ 1040.375022][T23304] bridge0: port 1(bridge_slave_0) entered disabled state [ 1040.582011][T23304] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1040.634465][T23304] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1040.646103][T23304] bond0 (unregistering): Released all slaves [ 1041.196194][T23304] hsr_slave_0: left promiscuous mode [ 1041.212712][T23304] hsr_slave_1: left promiscuous mode [ 1041.219136][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1041.227564][T23304] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1041.236159][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1041.247326][T23304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1041.260354][T23304] veth1_macvtap: left promiscuous mode [ 1041.266546][T23304] veth0_macvtap: left promiscuous mode [ 1041.272651][T23304] veth1_vlan: left promiscuous mode [ 1041.282343][T23304] veth0_vlan: left promiscuous mode [ 1041.367670][T23304] team0 (unregistering): Port device team_slave_1 removed [ 1041.395217][T23304] team0 (unregistering): Port device team_slave_0 removed [ 1042.614139][T23304] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.667633][T23304] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.721011][T23304] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.784570][T23304] netdevsim netdevsim8 netdevsim0 (unregistering): left allmulticast mode [ 1042.794681][T23304] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.957030][T23304] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.991295][T23304] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.043870][T23304] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.098820][T23304] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.283961][T23304] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.356807][T23304] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.440133][T23304] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.490306][T23304] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.624092][T23304] bridge_slave_1: left allmulticast mode [ 1043.632757][T23304] bridge_slave_1: left promiscuous mode [ 1043.639444][T23304] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.650828][T23304] bridge_slave_0: left allmulticast mode [ 1043.659017][T23304] bridge_slave_0: left promiscuous mode [ 1043.665339][T23304] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.676729][T23304] bond0: left allmulticast mode [ 1043.683023][T23304] bond_slave_0: left allmulticast mode [ 1043.690147][T23304] bond_slave_1: left allmulticast mode [ 1043.696363][T23304] bridge0: port 3(bond0) entered disabled state [ 1043.705947][T23304] bridge_slave_1: left allmulticast mode [ 1043.712651][T23304] bridge_slave_1: left promiscuous mode [ 1043.718925][T23304] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.729730][T23304] bridge_slave_0: left allmulticast mode [ 1043.737422][T23304] bridge_slave_0: left promiscuous mode [ 1043.747803][T23304] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.759062][T23304] bridge_slave_1: left allmulticast mode [ 1043.766154][T23304] bridge_slave_1: left promiscuous mode [ 1043.772439][T23304] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.782970][T23304] bridge_slave_0: left allmulticast mode [ 1043.790523][T23304] bridge_slave_0: left promiscuous mode [ 1043.798226][T23304] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.810417][T23304] dvmrp12: left allmulticast mode [ 1043.993656][T23304] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1044.033689][T23304] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.074744][T23304] bond0 (unregistering): Released all slaves [ 1044.154212][T23304] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1044.180924][T23304] bond_slave_0: left promiscuous mode [ 1044.188098][T23304] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.223643][T23304] bond_slave_1: left promiscuous mode [ 1044.230198][T23304] bond0 (unregistering): Released all slaves [ 1044.318987][T23304] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1044.353480][T23304] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.395229][T23304] bond0 (unregistering): Released all slaves [ 1046.021705][T23304] hsr_slave_0: left promiscuous mode [ 1046.029920][T23304] hsr_slave_1: left promiscuous mode [ 1046.036379][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1046.045066][T23304] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1046.053995][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1046.062638][T23304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1046.074728][T23304] hsr_slave_0: left promiscuous mode [ 1046.081159][T23304] hsr_slave_1: left promiscuous mode [ 1046.088899][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1046.097328][T23304] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1046.106172][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1046.114336][T23304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1046.130720][T23304] hsr_slave_0: left promiscuous mode [ 1046.138142][T23304] hsr_slave_1: left promiscuous mode [ 1046.144567][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1046.153670][T23304] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1046.162409][T23304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1046.176069][T23304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1046.194006][T23304] veth1_macvtap: left promiscuous mode [ 1046.200476][T23304] veth0_macvtap: left promiscuous mode [ 1046.206658][T23304] veth1_vlan: left promiscuous mode [ 1046.213457][T23304] veth0_vlan: left promiscuous mode [ 1046.220165][T23304] veth1_macvtap: left promiscuous mode [ 1046.226539][T23304] veth0_macvtap: left promiscuous mode [ 1046.232720][T23304] veth1_vlan: left promiscuous mode [ 1046.238509][T23304] veth0_vlan: left promiscuous mode [ 1046.246349][T23304] veth1_macvtap: left promiscuous mode [ 1046.252407][T23304] veth0_macvtap: left promiscuous mode [ 1046.258931][T23304] veth1_vlan: left promiscuous mode [ 1046.265877][T23304] veth0_vlan: left promiscuous mode [ 1046.413718][T23304] team0 (unregistering): Port device team_slave_1 removed [ 1046.431297][T23304] team0 (unregistering): Port device team_slave_0 removed [ 1046.529962][T23304] team0 (unregistering): Port device team_slave_1 removed [ 1046.545556][T23304] team0 (unregistering): Port device team_slave_0 removed [ 1046.661098][T23304] team0 (unregistering): Port device team_slave_1 removed [ 1046.672873][T23304] team0 (unregistering): Port device team_slave_0 removed [ 1046.681433][T23306] smc: removing ib device syz1 [ 1046.878697][T23306] smbdirect: ib_dev[syz1] removed [ 1047.201930][T23306] ================================================================== [ 1047.210859][T23306] BUG: KASAN: invalid-free in gid_table_release_one+0x384/0x470 [ 1047.219268][T23306] Free of addr ffff88806744c0d8 by task kworker/u8:13/23306 [ 1047.227377][T23306] [ 1047.229948][T23306] CPU: 1 UID: 0 PID: 23306 Comm: kworker/u8:13 Tainted: G L syzkaller #0 PREEMPT(full) [ 1047.229971][T23306] Tainted: [L]=SOFTLOCKUP [ 1047.229976][T23306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1047.229987][T23306] Workqueue: ib-unreg-wq ib_unregister_work [ 1047.230010][T23306] Call Trace: [ 1047.230017][T23306] [ 1047.230024][T23306] dump_stack_lvl+0xe8/0x150 [ 1047.230047][T23306] print_address_description+0x55/0x1e0 [ 1047.230069][T23306] print_report+0x58/0x70 [ 1047.230087][T23306] ? gid_table_release_one+0x384/0x470 [ 1047.230102][T23306] kasan_report_invalid_free+0xea/0x110 [ 1047.230119][T23306] ? gid_table_release_one+0x384/0x470 [ 1047.230136][T23306] free_large_kmalloc+0x3c/0x110 [ 1047.230151][T23306] gid_table_release_one+0x384/0x470 [ 1047.230171][T23306] ib_device_release+0xd2/0x1c0 [ 1047.230193][T23306] ? __pfx_ib_device_release+0x10/0x10 [ 1047.230213][T23306] device_release+0xc4/0x1f0 [ 1047.230229][T23306] kobject_put+0x228/0x560 [ 1047.230252][T23306] ? process_scheduled_works+0xa70/0x1860 [ 1047.230273][T23306] process_scheduled_works+0xb5d/0x1860 [ 1047.230302][T23306] ? __pfx_process_scheduled_works+0x10/0x10 [ 1047.230328][T23306] ? do_raw_spin_lock+0x12b/0x2f0 [ 1047.230347][T23306] ? assign_work+0x3d5/0x5e0 [ 1047.230367][T23306] worker_thread+0xa53/0xfc0 [ 1047.230394][T23306] kthread+0x388/0x470 [ 1047.230411][T23306] ? __pfx_worker_thread+0x10/0x10 [ 1047.230430][T23306] ? __pfx_kthread+0x10/0x10 [ 1047.230446][T23306] ret_from_fork+0x514/0xb70 [ 1047.230467][T23306] ? __pfx_ret_from_fork+0x10/0x10 [ 1047.230487][T23306] ? __switch_to+0xc79/0x1410 [ 1047.230505][T23306] ? __pfx_kthread+0x10/0x10 [ 1047.230520][T23306] ret_from_fork_asm+0x1a/0x30 [ 1047.230539][T23306] [ 1047.230544][T23306] [ 1047.420175][T23306] The buggy address belongs to the physical page: [ 1047.427226][T23306] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f1b82e49 pfn:0x6744c [ 1047.437621][T23306] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1047.446964][T23306] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1047.455267][T23306] page_type: f8(unknown) [ 1047.460901][T23306] raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000 [ 1047.470341][T23306] raw: 00000007f1b82e49 0000000000000000 00000000f8000000 0000000000000000 [ 1047.479773][T23306] head: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000 [ 1047.489301][T23306] head: 00000007f1b82e49 0000000000000000 00000000f8000000 0000000000000000 [ 1047.498838][T23306] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 1047.508366][T23306] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 1047.517888][T23306] page dumped because: kasan: bad access detected [ 1047.524932][T23306] page_owner tracks the page as allocated [ 1047.531207][T23306] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 24382, tgid 24381 (syz.7.6390), ts 1005564056271, free_ts 1005316043326 [ 1047.551272][T23306] post_alloc_hook+0x231/0x280 [ 1047.556523][T23306] get_page_from_freelist+0x24ba/0x2540 [ 1047.562618][T23306] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1047.569016][T23306] alloc_pages_mpol+0x235/0x490 [ 1047.574363][T23306] ___kmalloc_large_node+0x4e/0x120 [ 1047.580080][T23306] __kmalloc_large_node_noprof+0x18/0x90 [ 1047.586284][T23306] __kmalloc_noprof+0x3e8/0x760 [ 1047.591741][T23306] ib_cache_setup_one+0x198/0x570 [ 1047.597407][T23306] ib_register_device+0xfbd/0x13e0 [ 1047.603049][T23306] rxe_register_device+0x1e3/0x350 [ 1047.608700][T23306] rxe_net_add+0x81/0x110 [ 1047.613479][T23306] rxe_newlink+0xf4/0x1c0 [ 1047.618270][T23306] nldev_newlink+0x5bc/0x650 [ 1047.623335][T23306] rdma_nl_rcv+0x6d1/0xa10 [ 1047.628201][T23306] netlink_unicast+0x80f/0x9b0 [ 1047.633464][T23306] netlink_sendmsg+0x813/0xb40 [ 1047.638723][T23306] page last free pid 23265 tgid 23265 stack trace: [ 1047.645879][T23306] __free_frozen_pages+0xbc7/0xd30 [ 1047.651532][T23306] device_release+0xc4/0x1f0 [ 1047.656686][T23306] kobject_put+0x228/0x560 [ 1047.661563][T23306] netdev_run_todo+0xc75/0xde0 [ 1047.666828][T23306] tun_chr_close+0x13c/0x1c0 [ 1047.672072][T23306] __fput+0x44f/0xa60 [ 1047.676446][T23306] task_work_run+0x1d9/0x270 [ 1047.681495][T23306] do_exit+0x70f/0x22c0 [ 1047.686091][T23306] do_group_exit+0x21b/0x2d0 [ 1047.691137][T23306] get_signal+0x1284/0x1330 [ 1047.696097][T23306] arch_do_signal_or_restart+0xbc/0x830 [ 1047.702200][T23306] exit_to_user_mode_loop+0x86/0x480 [ 1047.708007][T23306] do_syscall_64+0x33e/0xf80 [ 1047.713051][T23306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1047.719542][T23306] [ 1047.722089][T23306] Memory state around the buggy address: [ 1047.728270][T23306] ffff88806744bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1047.737125][T23306] ffff88806744c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1047.745981][T23306] >ffff88806744c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1047.754835][T23306] ^ [ 1047.762452][T23306] ffff88806744c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1047.771307][T23306] ffff88806744c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1047.780158][T23306] ================================================================== [ 1047.845865][T23306] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1047.853838][T23306] CPU: 1 UID: 0 PID: 23306 Comm: kworker/u8:13 Tainted: G L syzkaller #0 PREEMPT(full) [ 1047.866178][T23306] Tainted: [L]=SOFTLOCKUP [ 1047.870953][T23306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1047.882126][T23306] Workqueue: ib-unreg-wq ib_unregister_work [ 1047.888645][T23306] Call Trace: [ 1047.892268][T23306] [ 1047.895515][T23306] vpanic+0x56c/0xa60 [ 1047.899914][T23306] ? __pfx_vpanic+0x10/0x10 [ 1047.904983][T23306] ? __pfx___schedule+0x10/0x10 [ 1047.910345][T23306] panic+0xc5/0xd0 [ 1047.914461][T23306] ? __pfx_panic+0x10/0x10 [ 1047.919344][T23306] ? preempt_schedule_common+0x82/0xd0 [ 1047.925379][T23306] check_panic_on_warn+0x89/0xb0 [ 1047.930919][T23306] end_report+0x73/0x170 [ 1047.935605][T23306] ? gid_table_release_one+0x384/0x470 [ 1047.941629][T23306] kasan_report_invalid_free+0xfa/0x110 [ 1047.947746][T23306] ? gid_table_release_one+0x384/0x470 [ 1047.953755][T23306] free_large_kmalloc+0x3c/0x110 [ 1047.959181][T23306] gid_table_release_one+0x384/0x470 [ 1047.965195][T23306] ib_device_release+0xd2/0x1c0 [ 1047.970537][T23306] ? __pfx_ib_device_release+0x10/0x10 [ 1047.976545][T23306] device_release+0xc4/0x1f0 [ 1047.981593][T23306] kobject_put+0x228/0x560 [ 1047.986483][T23306] ? process_scheduled_works+0xa70/0x1860 [ 1047.992780][T23306] process_scheduled_works+0xb5d/0x1860 [ 1047.998885][T23306] ? __pfx_process_scheduled_works+0x10/0x10 [ 1048.005462][T23306] ? do_raw_spin_lock+0x12b/0x2f0 [ 1048.011278][T23306] ? assign_work+0x3d5/0x5e0 [ 1048.016333][T23306] worker_thread+0xa53/0xfc0 [ 1048.021402][T23306] kthread+0x388/0x470 [ 1048.025896][T23306] ? __pfx_worker_thread+0x10/0x10 [ 1048.031535][T23306] ? __pfx_kthread+0x10/0x10 [ 1048.036604][T23306] ret_from_fork+0x514/0xb70 [ 1048.041662][T23306] ? __pfx_ret_from_fork+0x10/0x10 [ 1048.047290][T23306] ? __switch_to+0xc79/0x1410 [ 1048.052437][T23306] ? __pfx_kthread+0x10/0x10 [ 1048.057484][T23306] ret_from_fork_asm+0x1a/0x30 [ 1048.062731][T23306] [ 1048.066494][T23306] Kernel Offset: disabled [ 1048.071240][T23306] Rebooting in 86400 seconds..