last executing test programs: 14m53.232547256s ago: executing program 4 (id=644): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0xffb7) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000580)={0x0, 0xd, 0x3}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000980)={r1, 0x0, 0x1, [0xfffffffffffffff9, 0xdd, 0x4, 0xa9f, 0x907], [0x100000000, 0x8, 0x4, 0x9, 0x5, 0x7f, 0x7fffffff, 0x1, 0xffffffffffffffff, 0x6, 0x3, 0x4, 0x4f5, 0x8000, 0x4, 0xb95, 0xe2, 0x5, 0x3, 0x8, 0x7f, 0xc31, 0x1, 0x0, 0x5, 0x8, 0xa, 0xfffffffffffffffc, 0x5c26, 0x2, 0xffffffffffff1735, 0x9, 0x6, 0xb, 0x7, 0x4, 0x8, 0x8, 0x85, 0x7, 0x0, 0x0, 0x2, 0xf, 0x2, 0x1, 0x800, 0x5, 0x10000, 0xb5, 0x0, 0x8, 0x5, 0x100, 0x3, 0x10000, 0x200, 0x8, 0x401, 0x81, 0x0, 0x5, 0x9, 0x6, 0xdb57, 0x80, 0x0, 0x40, 0x23, 0x5, 0xf, 0x7f, 0x8, 0x400, 0x4, 0x100000001, 0x5, 0x6, 0xffff, 0x3, 0xd4, 0xffffffffffffaba8, 0x4, 0xe, 0x1, 0x10001, 0x100000000, 0x2, 0x7, 0x1, 0x5, 0xffffffff, 0xffffffffffffffff, 0x10, 0xad03, 0x1, 0x101, 0x2, 0x200, 0x1, 0x4, 0x3, 0x0, 0xa, 0xd1b8, 0xb, 0x2, 0x7, 0xfffffffffffffff9, 0x87a, 0x7fff, 0x80, 0x1, 0x7ff, 0x8, 0xfffffffffffffffc, 0x9, 0x5, 0x1, 0x6, 0xa]}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000000, 0x10012, r0, 0x0) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) (async) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x1, 0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe1000, 0x280000b, 0x28011, r2, 0x0) mremap(&(0x7f00000d5000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000ffd000/0x2000)=nil) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xf) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080)=0x3) (async) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080)=0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) creat(&(0x7f0000000000)='./bus\x00', 0x0) (async) r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0) write$cgroup_int(r3, &(0x7f0000000540), 0xfffffdd8) (async) write$cgroup_int(r3, &(0x7f0000000540), 0xfffffdd8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r4, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r5) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b00010000000109040000"], 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b00010000000109040000"], 0x0) 14m52.489078421s ago: executing program 4 (id=649): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x25dfdbf8, {}, [@NHA_OIF={0x8}]}, 0x20}}, 0x4) syz_emit_ethernet(0x46, &(0x7f00000005c0)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0xe0, 0x3a, 0xff, @remote, @mcast2, {[@dstopts={0x6, 0x0, '\x00', [@pad1, @jumbo={0xc2, 0x4, 0x1ff}, @calipso={0x7, 0x0, {0x2, 0x0, 0x9, 0x9, [0x5, 0x9]}}, @hao={0xc9, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x43}}}, @calipso={0x7, 0x0, {0x3, 0x0, 0xb, 0x1dc2, [0x1, 0x7a2, 0x5, 0xffffffff, 0xa68]}}, @pad1, @ra, @jumbo={0xc2, 0x4, 0x9}]}, @routing={0x73, 0x0, 0x2, 0x2, 0x0, [@mcast1, @loopback, @mcast1, @local, @rand_addr=' \x01\x00', @private0, @loopback, @mcast2, @empty]}, @fragment={0x32, 0x0, 0x3, 0x1, 0x0, 0x2, 0x68}, @hopopts={0x5c, 0x0, '\x00', [@padn={0x1, 0x0, [0x0, 0x0, 0x0]}, @calipso={0x7, 0x0, {0x3, 0x0, 0x5, 0x7, [0x1000, 0xb, 0x6]}}, @generic={0x4, 0x0, "0be9448968d686cde7aecc4945b001d075a878a974fc6a3fc8e2cedb432bb50ed4ef643e9db2e3cda10e15bd375b2c8fce7bfffa95ec48ec0367b2c86414d64cf519b18a24c4f07384fb57762c79d76ea22fcef3077802bc381a855586ff413224f9281f1c056bd34f5270e8eead62b9db43f590a4fbf6ecfe3605d27dd906d9af8bd91e452530025186148f0990"}, @calipso={0x7, 0x0, {0x3, 0x0, 0x9, 0x401, [0x9, 0x80000001]}}, @generic={0x2, 0x0, "c97d9988571a9e5e4b347c58959ed940d53b4ca1a197c11056dacfe132899b3f99d462430a66d6c817f5f4657a5a6a551968f7deb7cf42cf20aebfe11551797e1bafc19d6c000e22f789e89b8df0c4ebc65c6af63909b1f8bd1ad9761376973bb6509f667e99f106fb74cb3cf11c652eea7ce92a3b84571612d527a443cee0008a931bcd75ac3c4f79f1"}, @pad1, @calipso={0x7, 0x0, {0x1, 0x0, 0x3, 0x1, [0x0, 0x80000000, 0x5, 0xffffffffffff6adf, 0x73, 0x8000000000000000]}}, @padn={0x1, 0x0, [0x0, 0x0]}, @padn={0x1, 0x0, [0x0, 0x0]}]}], @ndisc_ra={0x88, 0x0, 0x0, 0x1, 0x1, 0x0, 0xffffffff, 0x0, [{0x1, 0x0, "0eb9bdcad51db4482f01e5f457d30e911b4c3846f338bfab29b607e333450684adf0db5ee7b488ac98b85952ee32122d723043ebb6bd706181c55445663f8be8daec69af8dff9fffd973a97e74c462ea07261bdb05de6738c984a41bdef05c6bc001f5cd1fb748f1f5b7fc78058c1d9828b3aecc3838a714e99d3786d1a201c4994c90a51f3eb2ebd28a43a4ac41eee06174"}, {0x5, 0x0, "a6"}, {0x4, 0x0, "20cc54f547b2df3f8b085ac02529314e8464646bed91efeba1bbdf86054a875d2e218bb5fedc2a4aa717c4c0dec91f69ae24ee45e5badee8b43a0d98ac5bd5"}]}}}}}}, 0x0) syz_emit_ethernet(0xdc, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaad3830000aaaaaabb0004f84e438f573d1368a4d12b9c1b584175d7fc78bebaf2d2a58eeea688b94a7e361dbdd7159ec4883fb6c1f232dacee5c6be92e75b9bc2f79cc6930d8372e2de7727bfa5585ea0e83764d206be0e1438ccc9d7fe19327e5777371c8c9956ccc5dbe2c98cd81fd6f3810445763f8b22bb04fab674cf4bd0a565be8a68715af2062e007c15e649c164c8cbda1bb9641a146473d43a8d62a19c4b1eff6e591f1f50bef3e888fbc5107302dde51b8e41eb5c55219599cfc1947d3a0f882f74a7e38d25d21f7de8ab7481c2dae31aa8965f"], &(0x7f0000000100)={0x1, 0x3, [0xd04, 0xc5c, 0x901, 0xa30]}) 14m51.578520284s ago: executing program 4 (id=652): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) rt_sigaction(0xd, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300), 0x0) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000340)=""/140, 0x8c}], 0x1}, 0x3}], 0x1, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x0, 0x29, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4040810) 14m50.571824623s ago: executing program 4 (id=654): madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) 14m49.197936364s ago: executing program 4 (id=662): openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000380)='+\x8b\x8a\x16\x06O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcR\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2E\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x89V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xda\xb5\xba\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x80\x00\x00\x00!\x16Tu\xe3I\f\x171~\xdf\xe6\xc82\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\x85\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa7\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92\x9be\xe4\x00\x00\x00\x80\xf1\xacQ\xb9O\xd4\x14\xa1\x92\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83nk\xd3\xc9/m\x1aT\x8f\'\xef\xa6D\xab\xcfs\x97.\xf2\xf4wK`\xa9S\x98>0\x92\xd9\xb8\xb2\x17,\xd6\xf8\n\x93\xc1\x10qk.\xf6\x9bY\xe6\x92\xef\xa2o\\\x9b\xeb\x93v\x11B\xf6', 0x6) fcntl$addseals(r0, 0x409, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r5, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r4, {0x1}}, './file0\x00'}) fallocate(r0, 0x3, 0x9100, 0x3) r6 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_REG(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="1400d66f", @ANYRES16=r7, @ANYBLOB="00082abd7000fbdbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x24044851}, 0x4000010) 14m48.109183552s ago: executing program 4 (id=665): ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x90044802, 0x0) r0 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 14m32.882768165s ago: executing program 32 (id=665): ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x90044802, 0x0) r0 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 13.383710044s ago: executing program 0 (id=3678): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0xff, 0x80801) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000080)={0x0, r1}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r1}) write$eventfd(r1, &(0x7f00000001c0)=0xded0, 0x8) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000040)={"e9f3c5d0bb3850c2274fab9f53459cdc", 0x0, 0x0, {0x7fffffffffffffff, 0x3}, {0xd, 0x4e9}, 0x9, [0x9, 0x7fffffffffffffff, 0xc8, 0x4, 0x4, 0x4, 0x200, 0x4, 0x0, 0x8001, 0x6, 0x101, 0x1, 0x7, 0x3, 0x4]}) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001", @ANYBLOB="a2"], 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x19, 0x0, &(0x7f0000000180)) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TCXONC(r2, 0x5608, 0x2) 11.859676459s ago: executing program 0 (id=3684): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0x7e, &(0x7f0000000600)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfe, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @local, @rand_addr=0x64010102, {[@cipso={0x86, 0x3d, 0xffffffffffffffff, [{0x0, 0xa, "e256b28c59881681"}, {0x7, 0x5, "020007"}, {0x0, 0x2}, {0x0, 0x9, "e706d30bd224f8"}, {0x2, 0x4, "cfa1"}, {0x0, 0xd, "8475be675de6a70a05a0dc"}, {0x0, 0x5, "6580a5"}, {0x0, 0x7, "73bc23f9ff"}]}]}}}}}}}, 0x0) recvfrom$inet(r1, 0x0, 0x0, 0x7eabfcf2497233c6, 0x0, 0x0) 11.661709852s ago: executing program 0 (id=3685): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1c759000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) chdir(0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfffffc1e}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)={0x1a0, 0x2, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_NAT_DST={0xb4, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x34, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_PROTO={0x4c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x6f}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8000}]}, @CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x1c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x52}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x1}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x5}]}}, @CTA_TUPLE_REPLY={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x19}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @private=0x92a}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @remote}}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x402}, @CTA_ZONE={0x6}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x80804}, 0x10) 10.893198955s ago: executing program 1 (id=3686): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[], 0xd0}}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r5, 0xc01064bd, &(0x7f0000000280)={&(0x7f00000004c0)="00a1", 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f0000000340)={0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000001c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r7}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r10, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000001500)={0x24, r9, 0x1, 0x70bd07, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x64}, @val={0x8, 0x3, r11}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000a0}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r9, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}}, 0x2000c015) syz_emit_vhci(&(0x7f0000000480)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x0, 0xc9, "a5c02216a150c0c9"}}}, 0xe) ioctl$DRM_IOCTL_MODE_ATOMIC(r5, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f00000000c0)=[r7], &(0x7f0000000280), &(0x7f0000000300)=[r8], &(0x7f0000000340)}) 10.709690802s ago: executing program 0 (id=3687): r0 = socket$xdp(0x2c, 0x3, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000600)={{0x12, 0x1, 0x200, 0xde, 0x47, 0x31, 0x8, 0x1286, 0x1fa4, 0x8f69, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x86, 0x20, 0x6, [{{0x9, 0x4, 0x1b, 0xc, 0x0, 0xff, 0xff, 0xff, 0x3}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = syz_open_dev$usbmon(&(0x7f00000001c0), 0xfffffffffffffffd, 0x20000) read$usbmon(r2, &(0x7f0000000200)=""/203, 0xcb) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0xf1) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000380), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x92) mknodat(r3, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./bus\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./bus\x00', 0x0) chdir(&(0x7f0000000080)='./bus\x00') renameat2(r4, &(0x7f00000001c0)='./file0\x00', r4, &(0x7f0000000200)='./bus/file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0xdf) r5 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r5, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xfffffffffffffeff}, 0x3}, {{0x0, 0x0, 0x0}, 0x85a}], 0x2, 0x10041, 0x0) 8.620874785s ago: executing program 3 (id=3690): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x9, 0x3, 0x3, 0x882e, 0x8, 0x8, 0x2, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x400, 0x9, 0xffff, 0x7a, 0x5, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x7fff, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0xd5, 0x80000001, 0x6, 0x4, 0x9, 0x8, 0xfffffffd, 0x5, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffe00, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x4, 0x0, 0x8, 0x5, 0x8001, 0x5, 0x1, 0x1000, 0x9, 0x3, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x7, 0x0, 0xb1, 0x3, 0xffffff44, 0x1, 0x8, 0xf, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0xffffff00, 0x3, 0x2, 0x7, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x6, 0xbfffffff, 0x7, 0x80, 0x7, 0x0, 0x743, 0x5, 0x3, 0x7, 0x200, 0x5, 0x0, 0x8, 0x3, 0x100, 0x2, 0x8, 0x1, 0x1, 0x8, 0xe, 0x5, 0x6, 0x4, 0x7ff, 0x5, 0xfffffffe, 0x7, 0xf80, 0x7, 0x5a, 0x2302, 0xffff, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x401, 0x10001, 0x512d, 0x1, 0xe, 0x2, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x6b2, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e9, 0x48, 0x9, 0x3, 0x0, 0x5, 0x6, 0xf, 0xff, 0xd, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x4, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x5, 0xa, 0x6, 0x2, 0x6, 0x8, 0x48, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2, 0x4, 0xebf, 0x9, 0x1000, 0x1, 0x71f, 0x2, 0x7, 0x6e8, 0x8, 0x0, 0x80000000, 0x6, 0x9, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r2, @ANYBLOB="0000000003120100500012800b00010062726964676500004000028008000500010000000600270fff0000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000ac0)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@empty}}, &(0x7f0000000400)=0xe8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008d105400000002b0900020073797a310000000008000a40fffffffc140000001100010000000000000000000100000a"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) bind$can_j1939(r1, &(0x7f0000000200)={0x1d, r3, 0x1, {0x2, 0xf0, 0x3}, 0xff}, 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_NOACK_MAP(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x24, r5, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0xfffc}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0xc17a) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0x6, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000040)='\f\x00', 0xffeb, 0x0, &(0x7f0000000340), 0x10) sendmsg$NL80211_CMD_STOP_NAN(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x28, r5, 0x304, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3ff, 0x23}}}}, [""]}, 0x28}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r7 = request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x2}, &(0x7f0000000500)='grpquota_inode_hardlimit', 0xffffffffffffffff) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r4, 0xe1) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x30, 0x6, @void}, 0x10) 8.565057722s ago: executing program 2 (id=3692): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r1 = mq_open(&(0x7f0000000140)='*+@[^#^\x00', 0x40, 0x65, 0x0) mq_notify(r1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) 8.462617804s ago: executing program 2 (id=3693): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') ioctl$TUNGETVNETHDRSZ(r0, 0x8004b707, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0x36}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x17}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x405}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) r2 = fsopen(&(0x7f0000000000)='udf\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='-\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4080) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000100)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r3, @ANYBLOB="05", @ANYRES16=r3], 0x0) 8.365090624s ago: executing program 5 (id=3694): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x3a, 0x98, 0x2a, 0x8, 0xccd, 0x10a3, 0x23a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x57, 0x33, 0x19}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000a00)={0x2c, &(0x7f00000006c0)={0x20, 0x0, 0x6, "1577c6393daa"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x4f2a, 0x7, 0x6, 0x5, 0x1000, 0xcc7, 0x8, 0x7, 0x200000a, 0x6, 0x2, 0xd, 0x1, 0x22, 0x6, 0x101, 0x4, 0x1a449, 0x3, 0x40000003, 0x89, 0xcaa3, 0x0, 0x20001e58, 0x4, 0xe69, 0x3d, 0x8, 0x4088, 0x0, 0xfffffff8]}) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x48, 0x4, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x44801) 8.250631762s ago: executing program 1 (id=3695): r0 = syz_open_dev$sg(&(0x7f0000000fc0), 0x0, 0x5) ioctl$SG_IO(r0, 0x2285, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000780)="aa1d484e243103000000f7c08bfcd111fbdf23ea32db0e8f21d5bc27bd8063067a0689fff2a41cfbf0e9d85e44751170", 0x30}], 0x2) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000000c0)) fstat(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400)=0x0, &(0x7f0000000440), &(0x7f0000000480)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000000100)=0xe8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b040000000000000000020000002400048020000180070001006374000014000280080002400000000f08000140000000020900010073797a30000000000900020073797a320000000014000000110001"], 0x78}}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x38}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0xfffffffe}}, 0x80000, 0x0, 0x0, 0x0, 0xb3550aa4ba878396, 0x0, 0x4}, 0x9c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r5, &(0x7f0000003e00)=[{{0x0, 0x0, &(0x7f0000003d40)=[{0x0, 0xf4}, {&(0x7f00000026c0)=""/4089, 0xff9}, {&(0x7f0000003780)=""/139, 0x8b}, {&(0x7f00000005c0)=""/211, 0xd3}], 0x4}, 0x1c0}], 0x1, 0x40002162, 0x0) r6 = getuid() mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), 0x804, &(0x7f00000007c0)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=r3, @ANYBLOB="0000800000226eea351d9d9fa9cdeb4dd860f9ca08ad01726ef30bdd36a5d938673b5aecee1a4904c29e70cce496d6089ead19af0dbddd40abf630db0d7112589591a601adb1a7a4a683ebbdd732420852058ba057518d80160273b6a7b71c01b2bb5030cd4878fa082b07897bba9c88d76e01c0e3a42dcdd9892d2a8333359f112c27f296d4facdda4e7f3217c74aa9a63bbd6af4e2ed6e0970d4fffe67355c90a6773e7de1625bf32a21120703db87c3dfb477362fe09157c54ba169b3b6895da9da9a6005ab5476e969bff1154aab979fa876010000000000000007403f5edb5109a1e1a46901e1b77a74fe94ece26056c01c8cb3cc5b63060b98b18e8ef45152e007d9729c5c3cdd9b47acc9dd70aefa11c50e642af09b399996509158a427e7aa37a5d5af0b5d6893a4f75606f2604c716d1b67d6d0593595e10c33c7e71701fa623ec8f93dfdefa83758ed0c2f2861f26265183dfc7fea1209c97979fd467f1e850be1603767c58037ab42b2bfb8af7ec66cb66229fbcd18bc98f0d529cfa8435efc166df1907234", @ANYRESHEX, @ANYBLOB=',fowner=', @ANYRESDEC=r6, @ANYBLOB=',\x00']) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x208880b, &(0x7f00000004c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}], [{@fowner_eq={'fowner', 0x3d, r6}}, {@dont_appraise}, {@pcr={'pcr', 0x3d, 0x18}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/dri/card#\x00'}}, {@uid_gt={'uid>', 0xee00}}]}}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r7, 0x84, 0x6b, &(0x7f0000000240)=[@in={0x2, 0x4e24, @private=0xa010101}], 0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r7, 0x84, 0xc, &(0x7f0000000000), 0x4) setsockopt(r7, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r7, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x30, r8, 0x3000) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) 8.18071786s ago: executing program 3 (id=3696): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'veth1_to_bond\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES8=r1, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e003000028008000100100000a6b27cfeb7975fdfffedd100100005800a000400aaaaaaaaaabb000008001300030000060a000400aaaaaaaab1aa000008000500", @ANYBLOB="da6f4b1b2c25453df39efb5d6fd0cabaf1102e852511cc536aa9863f830754f431cb8979eaba33119a1e0a007c728586ac57080e7adee16909abc8ccb1df61ad39b7b3ee461116f4d71a11b1ac626fee520efa27"], 0x68}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x6}, {0xd}, {0x11, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) 7.965268608s ago: executing program 3 (id=3697): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1c759000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) chdir(0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfffffc1e}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)={0x1a0, 0x2, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_NAT_DST={0xb4, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x34, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_PROTO={0x4c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x6f}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8000}]}, @CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x1c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x52}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x1}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x5}]}}, @CTA_TUPLE_REPLY={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x19}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @private=0x92a}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @remote}}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x402}, @CTA_ZONE={0x6}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x80804}, 0x10) 7.421894086s ago: executing program 0 (id=3698): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000040)) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080), 0x40000000048601, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r4, 0xc0884113, &(0x7f00000000c0)={0x1, 0x0, 0x1fb, 0x10001, 0xfffffffffffffffe, 0x6, 0x4, 0x1fc, 0x9, 0x102002c, 0x49200000, 0x1}) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r4, 0xc0984124, &(0x7f0000000600)) 7.361806561s ago: executing program 1 (id=3699): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x111, 0x5, 0x800}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x200400) syz_open_dev$vbi(0x0, 0x0, 0x2) r4 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r4, 0x4004510d, &(0x7f0000000000)) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) gettid() r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x39, 0x0, @thr={0x0, &(0x7f00000007c0)="8700ce0bc89e8283082ccc47363814fc9bcc0e7522b190110bc257698a1f9d0981016b437d04d98d5c0f4b5dcf4c3565673606dc2d1f6e1382cddb7d0c788767f677caeaa1f8a7a37bdb7f7dc7ef27350a1f4a3a2e9e0db56a16da4a05f80fbc4678648b84f8a1e33de36ffe1c3e68f042ed10a1f863ced625e85d7f9f4af20682290b554d83bf06d643f46ccf8175ba2ddaee81dcaf911659080acb21f9409d3db0ebf65ae1505cee46d24947b23050c1d5a017fc99af4e4e5a88c618ebb600cd3d68f2a3492643e6d47a1729c048a35e6bfb93abc581635dff2073e71015441d2da5aeba50c7b47d95b87b5e48c302573baa87b7f5af37f4d7caeaf582daf4809e83145e3b00353b05b8"}}, 0x0) sendfile(r6, 0xffffffffffffffff, &(0x7f0000002080)=0x64, 0x21c) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x2e) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 7.065100871s ago: executing program 3 (id=3700): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x40f00, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80600, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000001c0)={0xc4, 0x0, 0x1}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000000300000001000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r5}, 0x38) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x5, @local, 0x2}], 0x17) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, &(0x7f00000003c0)={"57baa9c2c04ee1db808130b56934d239eabc1bdcc8fb21a55743b2e563e1d3ade578118969bdba2ae63dd247000bc3d970a0d70b0475cb79522e42c9c2f6b145de6d2d9f5a5eaaaf67f69ef93c5028766c779f530438b37e7dbeec568611043f3b8df2cf42e7cadec7698ff0e7df4ae5305c721dc04f51556eb404c4708aa823298531a4d340cd9cd1bbc285e2d1c1c43b13ee22248b1e568d3ac5ae71679ea41d90f7e0f80ebd063d4bf040df969c95d18d4a14571f8029fe764c309740249d0a6c173daa169aa73588a81289f3baaf7a2e4affddc49ec80fa25da372767db6e07ef030a9f277d923fdbe68d3d474d3b6a1e9feadf3639bd32a8ba9dfbe0758ed154a84f0ee44bcc80d19068012745acb6436423ab97011f050cd8ae8b1292d6cddd42ad8182e6f276ad941c86442d60552fad2e6321a61587b985d9d7473a7e92e8b32a9dc71e1c22e5bde1a17fab841cbc549f1b2856319580c4d5d913429ae0a7549ac59d9012b0cc5dbbb45d47b17ad1809f8b5d290048ce4fa4fa4661a1202e5cb62059fcb214e80ac9dc86680d69238c5cdb44c5bb7821260b28232a0381994854681c933342e20668bb96735724e2bd69b0b7a17837f7d9e3f72f5b0f63d2740b08019cd3c1752a45a0fba743b9fe9dada7a3c92faa6f377569ee5b64fb67c26005cafde39eaaf7281f6c101f34aab1a448b186d1d8baa0350f520383ebcbb41fb25ec25d446003dfe31020e3819b4e31459d1325c67756f21675bbedcaedc4e556f35a5e9feecab55abfb255d9adb3a3cd2265077026af9b834e414a6077ea91f7c1d3819c64615c4583bddf4acd9b533f673fc956bca528f5de25272ea8d8598d28d05e44a0d758130cb1ee5c9e63e44cdff3045ddf128bd8ff2b9f4283782c6b3e0b8ced7d4e505137dd7bbea0de9412d7ff1f9641743a34e0e45ee033293237863b352557c4fb0dbf89f18d76c98befa0046f22184a77790f8a3c3651e6dbe65e94181126f657d8a57260c685ae89002d6878240dcc22e0333e3f96d43bd1aa8170e4ebc2bd549186221c93dd8a0b21fb23d18fe9921da209adf91eb2aa328029256b80dcb8999ec8af2c588d113617c4eea9b2177987d23cf0c7b4f575ffaae0107ba057aff63db17d6ec27adb913f438454846a25f21d361dca44dcb842cb3ac4a4e366a3dcd2d079ab58f062c9c8218f063a46f26d4cbb129f23e31c9a377b23c0aae724a6503b7adb6a82dc83e08e37d56b2d4f627ab5d38fcbaf4bf56723d269b1f1fba8cff66f70ceefa1db4e11438336635725a79ba6705461cb6c6b20f41205542315b9d065010b34d2445a8db7d0b5ea2d9e1e405a7a98e2019f298fb2b53b8fc40ec4c0b0f50dc6e172390f6eece660cbe09e4a56a28f233bcee2fcdf7d503ed7a8b94840975323211726703ce90601dde587cb89b"}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000500), &(0x7f00000006c0), 0x3, r5}, 0x38) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x68, 0x30, 0xfff5, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xbabd, 0x81, 0x10000000, 0x1, 0xfff}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 6.958362859s ago: executing program 2 (id=3701): r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000180)={0x0, &(0x7f00000004c0)=[@wr_drn={0x6e, 0x20, {0x5, 0xe6}}, @in_dx={0x82, 0x20, {0xc1a3, 0x4}}, @wr_drn={0x6e, 0x20, {0x0, 0x3}}, @wrmsr={0x1e, 0x20, {0xe17d9e8d89f34600, 0xfffffffffffffffe}}, @in_dx={0x82, 0x20, {0xfc0e, 0x1}}, @rdmsr={0x32, 0x18, {0x2a2}}, @wrmsr={0x1e, 0x20, {0xa14, 0x1}}, @rdmsr={0x32, 0x18, {0x2a3}}, @cpuid={0x14, 0x18, {0x7fff, 0x5374}}, @wr_crn={0x46, 0xfffffffffffffe00, {0x8, 0x3}}, @in_dx={0x82, 0x20, {0x8657, 0x1}}, @rdmsr={0x32, 0x18, {0x9d6}}], 0x160}) ioctl$KVM_RUN(r0, 0xae80, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), 0xffffffffffffffff) r3 = socket(0x2b, 0x1, 0x0) listen(r3, 0xfff7fffd) ioctl$sock_TIOCINQ(r3, 0x8905, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000006c0), 0x8000) r5 = socket$packet(0x11, 0x3, 0x300) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r7 = fspick(r6, &(0x7f0000000000)='.\x00', 0x0) setreuid(0x0, 0xee00) read$FUSE(r1, &(0x7f00000009c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000201, r8, &(0x7f0000000480)='./file0\x00') fsconfig$FSCONFIG_CMD_RECONFIGURE(r7, 0x7, 0x0, 0x0, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x0) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x149802, 0x0) r11 = dup(r10) read$FUSE(r11, &(0x7f0000001900)={0x2020}, 0x2020) sendfile(r0, r11, 0x0, 0x80006) io_setup(0xc, &(0x7f0000000180)=0x0) io_submit(r12, 0x2, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r9, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0}]) io_cancel(r12, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x3, 0x5, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'geneve0\x00'}) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000003c0)={0x10, r5}, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r4, 0x80045300, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r2, @ANYBLOB="00012bbd7000ffdbdf250b00000005000500050000000800040006000000080004000900000008000300080000000800040000100000c0000040000180060001000000000008000300ac141439060001000a00000008000300ac1414bb14000400fe88000000000000000000000000010108000300ffffffff00"/134], 0x8c}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) r13 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x46000) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r13, 0xc0505510, 0x0) 6.130286906s ago: executing program 0 (id=3702): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) getpid() r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b0001000000000904000001012920000905", @ANYBLOB="da05f9"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) gettid() timer_settime(0x0, 0x0, 0x0, 0x0) futex(&(0x7f00000002c0)=0x2, 0xb, 0x2, &(0x7f0000000300)={0x77359400}, 0x0, 0x2) r2 = socket$igmp(0x2, 0x3, 0x2) io_uring_enter(0xffffffffffffffff, 0x1733, 0x6323, 0x20, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000180)={0x0, 0x4, 0x0, 0x40, @vifc_lcl_ifindex, @multicast2}, 0x10) setsockopt$MRT_FLUSH(r2, 0x0, 0xd4, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r3) syz_genetlink_get_family_id$ieee802154(0x0, r3) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r4, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000001ff0), 0x10) sendmsg$can_bcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x7, @can={{}, 0x0, 0x2, 0x0, 0x0, "8bc75700"}}, 0x48}}, 0x0) 5.389099475s ago: executing program 2 (id=3703): openat$nullb(0xffffffffffffff9c, 0x0, 0x147c40, 0x0) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = syz_io_uring_setup(0xcac, &(0x7f0000000100)={0x0, 0xb601, 0x800, 0x5, 0x255}, &(0x7f00000002c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) connect$phonet_pipe(r0, &(0x7f0000000000)={0x23, 0xc, 0x3, 0x1}, 0xffffff96) ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0) 5.366581154s ago: executing program 3 (id=3704): r0 = socket(0x18, 0x6, 0xffffffff) getsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000200), &(0x7f0000000280)=0x4) openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0x40405514, 0x0) read$msr(r1, &(0x7f0000034700)=""/102400, 0x19000) r3 = socket$inet6(0xa, 0x3, 0xff) socket$l2tp(0x2, 0x2, 0x73) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) r5 = socket$kcm(0x2c, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4, 0xffffffffffffffff}, 0x0, &(0x7f00000001c0)=r5}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r6}, &(0x7f00000000c0), &(0x7f0000000100)=r5}, 0x20) connect$inet6(r3, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @mcast1, 0x5}, 0x1c) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, 0x0, 0x0) r8 = dup2(r3, r3) sendmmsg$unix(r8, &(0x7f0000008380), 0x400000000000174, 0x4008890) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r9, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r8, 0x1, &(0x7f0000000040)={0x22, r9}, 0x0) 5.131163983s ago: executing program 5 (id=3705): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[], 0xd0}}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r5, 0xc01064bd, &(0x7f0000000280)={&(0x7f00000004c0)="00a1", 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f0000000340)={0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000001c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r7}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r10, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000001500)={0x24, r9, 0x1, 0x70bd07, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x64}, @val={0x8, 0x3, r11}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000a0}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r9, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [""]}, 0x14}}, 0x2000c015) syz_emit_vhci(&(0x7f0000000480)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x0, 0xc9, "a5c02216a150c0c9"}}}, 0xe) ioctl$DRM_IOCTL_MODE_ATOMIC(r5, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f00000000c0)=[r7], &(0x7f0000000280), &(0x7f0000000300)=[r8], &(0x7f0000000340)}) 4.904966451s ago: executing program 3 (id=3706): mkdirat(0xffffffffffffff9c, 0x0, 0x0) pipe2$9p(&(0x7f0000000240), 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r0 = syz_open_dev$audion(&(0x7f00000001c0), 0x4, 0x180) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000200)=0x9c9dce0ca2da8647, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) sigaltstack(0x0, &(0x7f0000000280)={0x0}) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) rseq(0x0, 0x0, 0x0, 0x0) getpid() madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x17) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000080)=[&(0x7f0000ffc000/0x1000)=nil], &(0x7f0000002640)=[0x1], &(0x7f0000000000), 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, 0x0, 0x84) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bdaa, 0xffffffff, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002cc0)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, {0xc, 0xffe0}, {}, {0xf, 0xa}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4, 0x2}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40010}, 0x20040054) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) getpid() 4.084338904s ago: executing program 5 (id=3707): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x299be000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) wait4(r6, 0x0, 0x2, 0x0) syz_open_procfs$pagemap(r6, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000012c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEAUTHENTICATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)={0x1c, r7, 0xfc5, 0x0, 0x0, {{0x11}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) socket(0x21, 0xa, 0x20000000) 3.904402556s ago: executing program 1 (id=3708): openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) (async) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000140)='/dev/comedi2\x00', 0x103180, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000240)={0x8000001, 0x0, 0x0, 0x0, 0x3}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) syz_usb_connect(0x4, 0x24, &(0x7f0000000100)=ANY=[@ANYRESOCT=r2], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000000000008c0000008c000000030000000000000000000003000000000400000004000000800000000100000000000007000000000400000000000008020000001000000000000008010000000f000000000000110400200006000000010000000000001105000000010000000b00000000000012010000000800000000000007000000000800000000000007000000000b00000000000008050000000000"], &(0x7f0000000000)=""/72, 0xa7, 0x48, 0x0, 0x4, 0x10000}, 0x28) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xa4f47000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0/../file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) (async) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) prlimit64(0x0, 0xb, &(0x7f0000000140), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r6, 0x402, 0x80000027) fcntl$setsig(r6, 0xa, 0x3a) (async) fcntl$setsig(r6, 0xa, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x4e21, 0xa, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x79}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x4e21, 0xa, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x79}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) fcntl$getownex(r5, 0x10, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x20000841, &(0x7f0000b63fe4)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="240000000104010100000000000000000100000505000100010000000800034000000004c449a54a5624532f2780443e99ffa82312e2e56fb599ecd28d79e89ab05ae5124468bc6195ab03c0ee520c6830bd425789900a9c1e553405726215c200c8444d2e0d210d83cb22aeea2d6de300a02f2f6c5ab05c311da8c88a6fc2608a44eaf1e5c61d9df03b6e703d58341287089bdbf314baf141c69ae8cd0e5206524c406e9a409393673d1ec9669f20c3c7f3e763158330fecb8502ae3f029eef522b7accc8cee6e1c24a76979f7425e6"], 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="240000000104010100000000000000000100000505000100010000000800034000000004c449a54a5624532f2780443e99ffa82312e2e56fb599ecd28d79e89ab05ae5124468bc6195ab03c0ee520c6830bd425789900a9c1e553405726215c200c8444d2e0d210d83cb22aeea2d6de300a02f2f6c5ab05c311da8c88a6fc2608a44eaf1e5c61d9df03b6e703d58341287089bdbf314baf141c69ae8cd0e5206524c406e9a409393673d1ec9669f20c3c7f3e763158330fecb8502ae3f029eef522b7accc8cee6e1c24a76979f7425e6"], 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 3.106100878s ago: executing program 5 (id=3709): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r0, 0x0, 0x0, 0x20004041, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='inode_foreign_history\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r8 = dup2(r7, r7) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000300)={'\x00', 0x40, 0xa, 0x1, 0x40000000, 0x10, r4}) ioctl$BLKTRACESTART(r7, 0x1274, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r8, 0x1276, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) socket$inet_sctp(0x2, 0x1, 0x84) socket(0xa, 0x3, 0xff) 2.169067306s ago: executing program 5 (id=3710): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1c759000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) chdir(0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfffffc1e}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)={0x1a0, 0x2, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_NAT_DST={0xb4, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x34, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_PROTO={0x4c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x6f}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8000}]}, @CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x1c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x52}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x1}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x5}]}}, @CTA_TUPLE_REPLY={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x19}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @private=0x92a}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @remote}}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x402}, @CTA_ZONE={0x6}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x80804}, 0x10) 1.40426398s ago: executing program 2 (id=3711): syz_open_dev$radio(&(0x7f0000000300), 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r4) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) gettid() lsm_get_self_attr(0x65, &(0x7f0000000ac0)={0x0, 0x0, 0xa5, 0x85, ""/133}, &(0x7f00000004c0)=0xa5, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) 1.20111777s ago: executing program 5 (id=3712): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x80000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400400bce) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'virt_wifi0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0xb0, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r5, {}, {0xffff, 0xffff}, {0x2, 0x10}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xe, 0x0, 0x3, 0x0, 0x8001]}}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x6, 0x100, 0x5d, 0x0, 0x7ff, 0x200}}, {0x4}}]}]}, 0xb0}}, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r1, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x51e}) r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x101c01) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000540)=ANY=[@ANYBLOB="0a00000057ee4d09b118993d008000000100000007000000900000000104000009000000000000000000000000000000000000006c0d000002000000fcffffff0100000005000000cb0000000000000000000000000000000d000000939f000004000000ffff00000600000009000000040000000000000000000000000000000000008003000000060000000200000006000000000000000000000000341eb2fd760a970f4e7bcfc0804d50440000000000000000000000010000c0010000000c000000000000000300000005000000020000000000000000000000000000000b0000000900000001000000090000008b6800009a0c000004000000000000000000000000000000010000c007002000050000000300000068020000070000000200000000000000000000000000000008000080010000800700000001800000f4ffffff05000000320c0000000000000000000000000000010000409e000000060000000100000008000000000000000500000000000000000000000000000002000000ff0f0000020000000600000040000000453c00008000"/423]) 460.498316ms ago: executing program 1 (id=3713): getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, &(0x7f0000000280)) openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0x40405514, 0x0) read$msr(r0, &(0x7f0000034700)=""/102400, 0x19000) socket$inet6(0xa, 0x3, 0xff) socket$l2tp(0x2, 0x2, 0x73) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) r3 = socket$kcm(0x2c, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r2, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r4}, &(0x7f00000000c0), 0x0}, 0x20) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000008380), 0x400000000000174, 0x4008890) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x22, r6}, 0x0) 109.012809ms ago: executing program 2 (id=3714): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1c759000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000000)={0xe000202b}) waitid(0x1, r4, 0x0, 0x4, 0x0) chdir(0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r7, &(0x7f0000000580), 0x0, 0x8008801) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_POWER(r8, 0x112, 0x9, 0x0, 0x0) epoll_create(0xeb5) syz_open_dev$sndpcmp(&(0x7f0000000700), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) ptrace(0x10, 0x0) r9 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r9, 0xc0505510, &(0x7f0000000540)={0x2, 0x1, 0x6, 0x8d2, &(0x7f00000004c0)=[{}]}) 0s ago: executing program 1 (id=3715): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket(0xa, 0x3, 0xf2c) r1 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x3, 0x7) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x24, &(0x7f0000000500)=0x40, 0x4) sendmsg$inet(r3, 0x0, 0x2000c054) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x480, 0x0) r5 = fsopen(&(0x7f0000001140)='hugetlbfs\x00', 0x1) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x100) truncate(&(0x7f0000000900)='./file1\x00', 0x3000000) openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc0242, 0x1ff) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r0}, 0x18) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) io_uring_setup(0x2756, &(0x7f0000000080)={0x0, 0xffffff7c, 0x100, 0xffffffff, 0x73}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) kernel console output (not intermixed with test programs): istering): (slave batadv0): Releasing backup interface [ 979.510651][ T8042]  (unregistering): Released all slaves [ 979.522950][ T8042] bond1 (unregistering): Released all slaves [ 979.533570][T17390] bridge0: port 2(bridge_slave_1) entered blocking state [ 979.540872][ T5897] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 979.541268][T17390] bridge0: port 2(bridge_slave_1) entered disabled state [ 979.558437][T17390] bridge_slave_1: entered allmulticast mode [ 979.559605][ T5816] usb usb2-port1: unable to enumerate USB device [ 979.565775][T17390] bridge_slave_1: entered promiscuous mode [ 979.609875][T17415] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 979.653486][ T8042] : left promiscuous mode [ 979.730939][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 979.748554][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 979.760180][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 979.795335][ T5897] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 979.802756][T17415] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 979.827285][ T5897] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 979.836618][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.864099][T17390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 979.880201][ T5897] usb 3-1: config 0 descriptor?? [ 979.888780][T17390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 979.998687][T17390] team0: Port device team_slave_0 added [ 980.012400][T17390] team0: Port device team_slave_1 added [ 980.069388][ T7470] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.124091][T17390] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 980.131536][T17390] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 980.157458][ C0] vkms_vblank_simulate: vblank timer overrun [ 980.166287][T17390] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 980.188977][T17390] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 980.196058][T17390] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 980.223517][T17390] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 980.237719][ T7470] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.265639][ T7470] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.291533][T17432] netlink: 'syz.2.3122': attribute type 2 has an invalid length. [ 980.299885][T17432] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3122'. [ 980.314905][ T5897] usbhid 3-1:0.0: can't add hid device: -71 [ 980.328119][ T5897] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 980.341091][ T5897] usb 3-1: USB disconnect, device number 109 [ 980.393378][T17390] hsr_slave_0: entered promiscuous mode [ 980.411436][T17390] hsr_slave_1: entered promiscuous mode [ 980.424688][T17390] debugfs: 'hsr0' already exists in 'hsr' [ 980.431541][T17390] Cannot create hsr debugfs directory [ 980.442950][ T7470] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.562621][T17438] FAULT_INJECTION: forcing a failure. [ 980.562621][T17438] name failslab, interval 1, probability 0, space 0, times 0 [ 980.562668][T17438] CPU: 0 UID: 0 PID: 17438 Comm: syz.0.3124 Not tainted syzkaller #0 PREEMPT(full) [ 980.562695][T17438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 980.562705][T17438] Call Trace: [ 980.562711][T17438] [ 980.562717][T17438] dump_stack_lvl+0x16c/0x1f0 [ 980.562737][T17438] should_fail_ex+0x512/0x640 [ 980.562756][T17438] should_failslab+0xc2/0x120 [ 980.562774][T17438] __kmalloc_cache_noprof+0x72/0x780 [ 980.562789][T17438] ? con_allocate_new+0x8a/0x1a0 [ 980.562811][T17438] ? con_allocate_new+0x8a/0x1a0 [ 980.562827][T17438] con_allocate_new+0x8a/0x1a0 [ 980.562845][T17438] con_clear_unimap+0xac/0x130 [ 980.562856][T17438] vt_ioctl+0x1146/0x30a0 [ 980.562868][T17438] ? __pfx___schedule+0x10/0x10 [ 980.562882][T17438] ? __pfx_vt_ioctl+0x10/0x10 [ 980.562897][T17438] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 980.562911][T17438] ? rcu_is_watching+0x12/0xc0 [ 980.562922][T17438] ? irqentry_exit+0x3b/0x90 [ 980.562935][T17438] ? lockdep_hardirqs_on+0x7c/0x110 [ 980.562952][T17438] ? tty_ioctl+0x1288/0x1680 [ 980.562968][T17438] ? tty_ioctl+0x601/0x1680 [ 980.562984][T17438] ? __pfx_vt_ioctl+0x10/0x10 [ 980.562995][T17438] tty_ioctl+0x661/0x1680 [ 980.563011][T17438] ? __pfx_tty_ioctl+0x10/0x10 [ 980.563027][T17438] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 980.563049][T17438] ? hook_file_ioctl_common+0x145/0x410 [ 980.563064][T17438] ? selinux_file_ioctl+0x180/0x270 [ 980.563078][T17438] ? selinux_file_ioctl+0xb4/0x270 [ 980.563093][T17438] ? __pfx_tty_ioctl+0x10/0x10 [ 980.563109][T17438] __x64_sys_ioctl+0x18e/0x210 [ 980.563123][T17438] do_syscall_64+0xcd/0xfa0 [ 980.563137][T17438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.563149][T17438] RIP: 0033:0x7f4de118eec9 [ 980.563158][T17438] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 980.563169][T17438] RSP: 002b:00007f4ddf3d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 980.563181][T17438] RAX: ffffffffffffffda RBX: 00007f4de13e6090 RCX: 00007f4de118eec9 [ 980.563188][T17438] RDX: 0000000000000000 RSI: 0000000000004b68 RDI: 0000000000000003 [ 980.563194][T17438] RBP: 00007f4ddf3d5090 R08: 0000000000000000 R09: 0000000000000000 [ 980.563201][T17438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 980.563207][T17438] R13: 00007f4de13e6128 R14: 00007f4de13e6090 R15: 00007ffcd6f96fc8 [ 980.563222][T17438] [ 981.655441][ T5826] Bluetooth: hci5: command tx timeout [ 982.508351][ T10] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 982.598848][T17455] netlink: 'syz.2.3129': attribute type 2 has an invalid length. [ 982.607750][T17455] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 982.658198][ T10] usb 2-1: device descriptor read/64, error -71 [ 983.597977][ T10] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 983.707452][ T5826] Bluetooth: hci5: command tx timeout [ 983.757136][ T10] usb 2-1: device descriptor read/64, error -71 [ 983.877551][ T10] usb usb2-port1: attempt power cycle [ 984.151357][ T8042] hsr_slave_0: left promiscuous mode [ 984.160100][ T8042] hsr_slave_1: left promiscuous mode [ 984.173450][ T8042] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 984.201353][ T8042] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 984.337486][ T10] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 984.368807][ T10] usb 2-1: device descriptor read/8, error -71 [ 984.397715][ T5897] usb 6-1: new full-speed USB device number 94 using dummy_hcd [ 984.566534][ T5897] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 984.576991][ T5897] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 984.585968][ T5897] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 984.623340][ T10] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 984.687273][ T5897] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.704638][ T5897] usb 6-1: config 0 descriptor?? [ 984.898838][ T10] usb 2-1: device not accepting address 38, error -71 [ 984.905871][ T10] usb usb2-port1: unable to enumerate USB device [ 985.361793][T17481] ieee802154 phy1 wpan1: encryption failed: -22 [ 985.797197][ T5826] Bluetooth: hci5: command tx timeout [ 985.853329][ T5875] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 985.921025][ T5956] usb 1-1: new low-speed USB device number 106 using dummy_hcd [ 985.987278][ T5875] usb 3-1: device descriptor read/64, error -71 [ 986.057498][ T5956] usb 1-1: device descriptor read/64, error -71 [ 986.193441][ T24] usb 6-1: USB disconnect, device number 94 [ 986.216775][T17390] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 986.227951][T17390] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 986.238327][ T5875] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 986.241394][T17390] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 986.259692][T17390] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 986.307038][ T5956] usb 1-1: new low-speed USB device number 107 using dummy_hcd [ 986.379574][ T5875] usb 3-1: device descriptor read/64, error -71 [ 986.445756][ T5956] usb 1-1: device descriptor read/64, error -71 [ 986.510050][ T5875] usb usb3-port1: attempt power cycle [ 986.559142][ T5956] usb usb1-port1: attempt power cycle [ 986.828597][T17390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 986.866563][T17390] 8021q: adding VLAN 0 to HW filter on device team0 [ 986.894569][ T8042] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.901815][ T8042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 986.934094][ T8042] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.941311][ T8042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 986.981349][ T5875] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 987.008944][ T5875] usb 3-1: device descriptor read/8, error -71 [ 987.047420][ T5956] usb 1-1: new low-speed USB device number 108 using dummy_hcd [ 987.472511][ T5956] usb 1-1: device descriptor read/8, error -71 [ 987.511277][T17390] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 987.545619][T17390] veth0_vlan: entered promiscuous mode [ 987.558961][T17390] veth1_vlan: entered promiscuous mode [ 987.582374][T17390] veth0_macvtap: entered promiscuous mode [ 987.591341][T17390] veth1_macvtap: entered promiscuous mode [ 987.606308][T17390] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 987.607171][ T5875] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 987.617983][T17390] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 987.639625][ T8013] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.649051][ T5875] usb 3-1: device descriptor read/8, error -71 [ 987.650681][ T8013] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.697864][ T8013] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.727111][ T8013] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 987.735072][ T5956] usb 1-1: new low-speed USB device number 109 using dummy_hcd [ 987.760794][ T5875] usb usb3-port1: unable to enumerate USB device [ 987.778620][ T5956] usb 1-1: device descriptor read/8, error -71 [ 987.897439][ T5956] usb usb1-port1: unable to enumerate USB device [ 987.905090][ T8013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 987.927786][ T8013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 988.097983][ T8027] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 988.129205][ T8027] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 988.517192][ T5875] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 988.740956][ T5875] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 988.764387][ T5875] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 988.785716][ T5875] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 988.812369][ T5875] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 988.944567][ T5875] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 988.961293][ T5875] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.003866][ T5875] usb 4-1: Product: syz [ 989.137044][ T5875] usb 4-1: Manufacturer: syz [ 989.141717][ T5875] usb 4-1: SerialNumber: syz [ 989.198153][ T5875] usb 4-1: config 0 descriptor?? [ 989.302516][ T5814] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 989.315387][ T5814] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 989.324796][ T5814] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 989.333118][ T5814] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 989.353107][ T5814] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 989.424292][T17524] lo speed is unknown, defaulting to 1000 [ 989.433944][ T5875] adutux 4-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 989.442436][T17524] lo speed is unknown, defaulting to 1000 [ 989.677420][ T5956] usb 4-1: USB disconnect, device number 5 [ 989.767042][ T10] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 989.920284][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 989.931465][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 989.970296][T17524] chnl_net:caif_netlink_parms(): no params data found [ 989.981930][ T10] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 989.996779][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 990.005633][ T10] usb 1-1: SerialNumber: syz [ 990.140098][ T8011] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.403810][ T10] usb 1-1: 0:2 : does not exist [ 990.421333][ T10] usb 1-1: USB disconnect, device number 110 [ 990.493118][T17547] netlink: 'syz.1.3149': attribute type 2 has an invalid length. [ 990.731811][ T8011] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.055853][T17524] bridge0: port 1(bridge_slave_0) entered blocking state [ 991.068463][T17524] bridge0: port 1(bridge_slave_0) entered disabled state [ 991.083088][T17524] bridge_slave_0: entered allmulticast mode [ 991.105294][T17524] bridge_slave_0: entered promiscuous mode [ 991.131809][T17553] random: crng reseeded on system resumption [ 991.225132][ T8011] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.423900][ T5826] Bluetooth: hci1: command tx timeout [ 991.433849][T17524] bridge0: port 2(bridge_slave_1) entered blocking state [ 991.451572][T17524] bridge0: port 2(bridge_slave_1) entered disabled state [ 991.459858][T17524] bridge_slave_1: entered allmulticast mode [ 991.467975][T17524] bridge_slave_1: entered promiscuous mode [ 991.546145][T17562] siw: device registration error -23 [ 991.553449][T17562] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 991.732299][ T8011] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 992.067917][T17524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 992.139034][T17524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 992.285641][T17524] team0: Port device team_slave_0 added [ 992.307259][ T5875] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 992.308683][T17524] team0: Port device team_slave_1 added [ 992.335584][T17576] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3159'. [ 992.434896][T17524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 992.443154][T17524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 992.469486][T17581] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3160'. [ 992.479248][T17581] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3160'. [ 992.486701][T17524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 992.501166][ T5875] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 992.520915][ T5875] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 992.568384][ T5875] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 992.583693][ T8011] team0: left allmulticast mode [ 992.587016][ T5875] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 992.608337][ T8011] team0: left promiscuous mode [ 992.609798][T17570] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 992.613450][ T8011] bridge0: port 1(team0) entered disabled state [ 992.634823][ T5875] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 992.936848][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.459183][ T8011] bond2 (unregistering): (slave gretap1): Releasing backup interface [ 993.467726][ T5826] Bluetooth: hci1: command tx timeout [ 993.833872][ T8011] bond0 (unregistering): Released all slaves [ 994.040920][ T8011] bond1 (unregistering): Released all slaves [ 994.478485][ T8011] bond2 (unregistering): (slave bond3): Releasing backup interface [ 994.488094][ T8011] bond2 (unregistering): Released all slaves [ 994.643861][ T8011] bond3 (unregistering): Released all slaves [ 994.659999][ T8011] bond4 (unregistering): Released all slaves [ 994.677729][T17524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 994.685243][T17524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 994.724056][T17524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 994.921634][T17524] hsr_slave_0: entered promiscuous mode [ 994.946525][T17524] hsr_slave_1: entered promiscuous mode [ 994.964869][ T10] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 994.981993][ T8011] tipc: Disabling bearer [ 995.004982][T17600] tmpfs: Unknown parameter 'fsuuid' [ 995.025408][ T8011] tipc: Left network mode [ 995.115405][ T24] usb 1-1: USB disconnect, device number 111 [ 995.127471][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 995.134541][ T10] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 995.182354][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.201903][ T10] usb 6-1: config 0 descriptor?? [ 995.212466][T17605] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 995.251003][T17605] tmpfs: Unknown parameter 'fsuuid' [ 995.370338][T17607] xt_TCPMSS: Only works on TCP SYN packets [ 995.432885][T17597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 995.444120][T17597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 995.587682][ T5826] Bluetooth: hci1: command tx timeout [ 995.853240][ T10] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 995.903290][ T10] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 995.923731][ T10] dib0700: firmware download failed at 7 with -22 [ 995.950422][T17612] xt_TCPMSS: Only works on TCP SYN packets [ 996.398084][T17597] random: crng reseeded on system resumption [ 996.632864][ T5860] usb 6-1: USB disconnect, device number 95 [ 997.082559][T17524] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 997.094751][T17524] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 997.103971][T17623] trusted_key: encrypted_key: insufficient parameters specified [ 997.110874][T17524] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 997.206807][T17524] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 997.293259][T17625] could not allocate digest TFM handle sha224-avx [ 997.627353][ T5826] Bluetooth: hci1: command tx timeout [ 997.827379][T17524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 998.409954][T17524] 8021q: adding VLAN 0 to HW filter on device team0 [ 998.459466][ T8013] bridge0: port 1(bridge_slave_0) entered blocking state [ 998.466669][ T8013] bridge0: port 1(bridge_slave_0) entered forwarding state [ 998.635326][ T8013] bridge0: port 2(bridge_slave_1) entered blocking state [ 998.642484][ T8013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 998.840701][T17655] xt_TCPMSS: Only works on TCP SYN packets [ 998.875152][T17652] syzkaller0: entered promiscuous mode [ 998.881525][T17652] syzkaller0: entered allmulticast mode [ 998.962848][T17659] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3179'. [ 999.466377][ T8011] hsr_slave_0: left promiscuous mode [ 999.472856][ T8011] hsr_slave_1: left promiscuous mode [ 999.528533][ T8011] veth1_macvtap: left allmulticast mode [ 999.554977][ T8011] veth1_macvtap: left promiscuous mode [ 999.574428][ T8011] veth0_macvtap: left promiscuous mode [ 999.618414][ T8011] veth1_vlan: left promiscuous mode [ 999.633218][ T8011] veth0_vlan: left promiscuous mode [ 1001.032369][ T8011] pimreg (unregistering): left allmulticast mode [ 1002.640669][T17698] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1002.648467][T17698] tmpfs: Unknown parameter 'fsuuid' [ 1003.624098][ T24] lo speed is unknown, defaulting to 1000 [ 1003.638694][ T24] syz2: Port: 1 Link DOWN [ 1004.514425][T17715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3194'. [ 1004.799650][ T10] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1004.967046][ T10] usb 1-1: device descriptor read/64, error -71 [ 1004.974648][T17524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1005.467069][ T10] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1005.597004][ T10] usb 1-1: device descriptor read/64, error -71 [ 1005.641029][T17524] veth0_vlan: entered promiscuous mode [ 1005.654018][T17524] veth1_vlan: entered promiscuous mode [ 1005.679566][T17524] veth0_macvtap: entered promiscuous mode [ 1005.688113][T17524] veth1_macvtap: entered promiscuous mode [ 1005.702673][T17524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1005.712394][ T10] usb usb1-port1: attempt power cycle [ 1005.724948][T17524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1005.742641][ T8013] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.767578][ T8013] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.800863][ T8013] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1005.811613][ T8013] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.016470][ T8043] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1006.065636][T17735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3197'. [ 1006.080019][ T8043] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1006.107130][ T10] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1006.121305][ T8043] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1006.150978][ T8043] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1006.265784][ T10] usb 1-1: device descriptor read/8, error -71 [ 1006.294183][T17739] tmpfs: Unknown parameter 'fsuuid' [ 1006.676981][ T10] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1006.807773][ T10] usb 1-1: device descriptor read/8, error -71 [ 1006.931420][ T10] usb usb1-port1: unable to enumerate USB device [ 1007.336775][T17759] syzkaller1: entered promiscuous mode [ 1007.342407][T17759] syzkaller1: entered allmulticast mode [ 1007.690408][T17765] overlayfs: failed to resolve './file0': -2 [ 1007.720119][T17768] xt_TCPMSS: Only works on TCP SYN packets [ 1009.180060][ T5816] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1009.267472][ T9] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1009.389885][T17800] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1009.437045][ T5816] usb 4-1: Using ep0 maxpacket: 32 [ 1009.445055][ T5816] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1009.459277][ T5816] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1009.469566][ T5816] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1009.478383][ T5816] usb 4-1: Product: syz [ 1009.482695][ T5816] usb 4-1: Manufacturer: syz [ 1009.488298][ T5816] usb 4-1: SerialNumber: syz [ 1009.497164][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1009.503082][ T5816] usb 4-1: config 0 descriptor?? [ 1009.510123][T17783] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1009.520354][ T5816] hub 4-1:0.0: bad descriptor, ignoring hub [ 1009.526438][ T5816] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1009.534860][ T9] usb 1-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 1009.545896][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.555940][ T9] usb 1-1: Product: syz [ 1009.561423][ T9] usb 1-1: Manufacturer: syz [ 1009.566126][ T9] usb 1-1: SerialNumber: syz [ 1009.592056][ T9] usb 1-1: config 0 descriptor?? [ 1009.618297][ T9] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 1009.942476][T17793] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1009.948803][T17793] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1009.955839][T17793] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1009.965464][T17793] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1009.972568][T17793] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1009.984089][T17793] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1009.997450][T17793] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1010.013273][T17793] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1010.030251][T17793] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1010.037326][T17793] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1010.048150][T17793] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1010.509352][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3220'. [ 1010.705335][T17822] xt_TCPMSS: Only works on TCP SYN packets [ 1011.018641][ T24] usb 4-1: USB disconnect, device number 6 [ 1011.201764][ T9] gspca_topro: Sensor cx0342 [ 1011.231088][ T5826] Bluetooth: hci3: command 0x0406 tx timeout [ 1011.355917][T17835] xt_TCPMSS: Only works on TCP SYN packets [ 1011.421392][ T5875] usb 1-1: USB disconnect, device number 116 [ 1012.014112][T17844] comedi comedi3: board detection failed [ 1012.024432][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.038121][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.052130][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.065567][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.079007][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.092431][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.105957][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.119928][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.133373][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.147040][T17844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17844 comm=syz.3.3226 [ 1012.161163][ T5814] Bluetooth: hci0: command 0x0c1a tx timeout [ 1012.168116][ T5826] Bluetooth: hci5: command 0x0c1a tx timeout [ 1012.175323][ T5814] Bluetooth: hci1: command 0x0c1a tx timeout [ 1012.339508][T17849] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1012.398452][ T24] hid_parser_main: 117 callbacks suppressed [ 1012.398473][ T24] hid-generic 0000:0000:0000.003E: unknown main item tag 0x0 [ 1012.429539][ T24] hid-generic 0000:0000:0000.003E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1013.310248][T17845] Bluetooth: hci3: command 0x0406 tx timeout [ 1014.229395][T17845] Bluetooth: hci1: command 0x0c1a tx timeout [ 1014.235489][T17845] Bluetooth: hci5: command 0x0c1a tx timeout [ 1014.240299][T14245] Bluetooth: hci0: command 0x0c1a tx timeout [ 1014.397233][ T10] usb 1-1: new low-speed USB device number 117 using dummy_hcd [ 1014.588915][ T10] usb 1-1: config index 0 descriptor too short (expected 6427, got 27) [ 1014.644455][ T10] usb 1-1: config 0 has an invalid interface number: 21 but max is 0 [ 1014.727106][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1014.851759][ T10] usb 1-1: config 0 has no interface number 0 [ 1014.871605][ T10] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1014.887000][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1014.915374][ T10] usb 1-1: config 0 descriptor?? [ 1015.028888][T17890] xt_TCPMSS: Only works on TCP SYN packets [ 1015.504061][T17900] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1015.511683][T17900] tmpfs: Unknown parameter 'fsuuid' [ 1015.617008][ T5956] usb 3-1: new full-speed USB device number 114 using dummy_hcd [ 1015.737216][T17903] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3243'. [ 1015.839551][ T5956] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 1015.854455][ T5956] usb 3-1: config 0 has no interface number 0 [ 1015.861317][ T5956] usb 3-1: config 0 interface 119 has no altsetting 0 [ 1015.870182][ T5956] usb 3-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 1016.147028][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.176485][ T5956] usb 3-1: Product: syz [ 1016.248227][ T5956] usb 3-1: Manufacturer: syz [ 1016.258989][ T5956] usb 3-1: SerialNumber: syz [ 1016.267060][T14245] Bluetooth: hci5: command 0x0c1a tx timeout [ 1016.273101][ T5814] Bluetooth: hci0: command 0x0c1a tx timeout [ 1016.273121][T17845] Bluetooth: hci1: command 0x0c1a tx timeout [ 1016.322196][ T5956] usb 3-1: config 0 descriptor?? [ 1016.475081][ T10] hid-generic 0000:0000:0000.003F: unknown main item tag 0x0 [ 1016.627215][ T5875] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1016.638730][ T10] hid-generic 0000:0000:0000.003F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1016.647985][ T5956] kaweth 3-1:0.119: Firmware present in device. [ 1016.757095][ T5956] kaweth 3-1:0.119: Error reading configuration (-71), no net device created [ 1016.769957][ T5956] kaweth 3-1:0.119: probe with driver kaweth failed with error -5 [ 1016.807159][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 1016.815367][ T5875] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 1016.825651][ T5956] pegasus 3-1:0.119: probe with driver pegasus failed with error -71 [ 1016.859443][ T5875] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1016.869027][ T5956] usb 3-1: USB disconnect, device number 114 [ 1016.895535][ T5875] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.949869][ T5875] usb 2-1: Product: syz [ 1016.971589][ T5875] usb 2-1: Manufacturer: syz [ 1016.996016][ T5875] usb 2-1: SerialNumber: syz [ 1017.023261][ T5875] usb 2-1: config 0 descriptor?? [ 1017.054088][T17914] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1017.071347][ T5875] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input62 [ 1017.086250][ T5956] usb 1-1: USB disconnect, device number 117 [ 1017.510726][T17922] FAULT_INJECTION: forcing a failure. [ 1017.510726][T17922] name failslab, interval 1, probability 0, space 0, times 0 [ 1017.524372][T17922] CPU: 1 UID: 0 PID: 17922 Comm: syz.0.3246 Not tainted syzkaller #0 PREEMPT(full) [ 1017.524400][T17922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1017.524412][T17922] Call Trace: [ 1017.524419][T17922] [ 1017.524430][T17922] dump_stack_lvl+0x16c/0x1f0 [ 1017.524459][T17922] should_fail_ex+0x512/0x640 [ 1017.524482][T17922] ? __kmalloc_noprof+0xca/0x880 [ 1017.524504][T17922] should_failslab+0xc2/0x120 [ 1017.524532][T17922] __kmalloc_noprof+0xdd/0x880 [ 1017.524551][T17922] ? vb2_core_allocated_buffers_storage+0xc4/0x220 [ 1017.524579][T17922] ? vb2_core_allocated_buffers_storage+0xc4/0x220 [ 1017.524598][T17922] vb2_core_allocated_buffers_storage+0xc4/0x220 [ 1017.524620][T17922] vb2_core_reqbufs+0x398/0xfe0 [ 1017.524646][T17922] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 1017.524665][T17922] ? lockdep_hardirqs_on+0x7c/0x110 [ 1017.524702][T17922] __vb2_init_fileio+0x3f1/0x1100 [ 1017.524725][T17922] ? vb2_core_poll+0xfe/0x700 [ 1017.524749][T17922] vb2_core_poll+0x5ec/0x700 [ 1017.524771][T17922] vb2_poll+0x4b/0xe0 [ 1017.524789][T17922] vb2_fop_poll+0x10f/0x2c0 [ 1017.524809][T17922] ? __pfx_vb2_fop_poll+0x10/0x10 [ 1017.524827][T17922] v4l2_poll+0x163/0x320 [ 1017.524853][T17922] ? __pfx_v4l2_poll+0x10/0x10 [ 1017.524875][T17922] do_sys_poll+0x55c/0xdf0 [ 1017.524908][T17922] ? __pfx_do_sys_poll+0x10/0x10 [ 1017.524928][T17922] ? sched_clock+0x38/0x60 [ 1017.524972][T17922] ? __schedule+0x11a3/0x5de0 [ 1017.524993][T17922] ? find_held_lock+0x2b/0x80 [ 1017.525018][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525041][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525064][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525088][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525112][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525135][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525158][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525183][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525207][T17922] ? __pfx_pollwake+0x10/0x10 [ 1017.525228][T17922] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 1017.525261][T17922] ? set_user_sigmask+0x21b/0x2b0 [ 1017.525289][T17922] ? __pfx_set_user_sigmask+0x10/0x10 [ 1017.525315][T17922] ? __fget_files+0x20e/0x3c0 [ 1017.525344][T17922] __x64_sys_ppoll+0x254/0x2d0 [ 1017.525370][T17922] ? __pfx___x64_sys_ppoll+0x10/0x10 [ 1017.525391][T17922] ? ksys_write+0x1ac/0x250 [ 1017.525413][T17922] ? __pfx_ksys_write+0x10/0x10 [ 1017.525444][T17922] do_syscall_64+0xcd/0xfa0 [ 1017.525468][T17922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1017.525486][T17922] RIP: 0033:0x7f4de118eec9 [ 1017.525504][T17922] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1017.525522][T17922] RSP: 002b:00007f4ddf3b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 1017.525541][T17922] RAX: ffffffffffffffda RBX: 00007f4de13e6180 RCX: 00007f4de118eec9 [ 1017.525554][T17922] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 1017.525565][T17922] RBP: 00007f4ddf3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1017.525576][T17922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1017.525586][T17922] R13: 00007f4de13e6218 R14: 00007f4de13e6180 R15: 00007ffcd6f96fc8 [ 1017.525614][T17922] [ 1018.039918][T17922] vivid-000: kernel_thread() failed [ 1018.399606][ T5816] IPVS: starting estimator thread 0... [ 1018.527167][ T9] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1018.828330][T17936] IPVS: using max 50 ests per chain, 120000 per kthread [ 1018.920557][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 1018.933311][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1018.952159][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1018.963072][ T9] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1018.972904][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1019.106781][ T9] usb 3-1: config 0 descriptor?? [ 1019.797203][ T5956] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1019.827272][ T9] savu 0003:1E7D:2D5A.0040: unknown main item tag 0x0 [ 1019.888373][ T9] savu 0003:1E7D:2D5A.0040: unknown main item tag 0x0 [ 1019.908180][ T9] savu 0003:1E7D:2D5A.0040: unknown main item tag 0x0 [ 1019.944823][ T9] savu 0003:1E7D:2D5A.0040: unknown main item tag 0x0 [ 1019.990308][ T5860] usb 2-1: USB disconnect, device number 39 [ 1019.990332][ C1] usbtouchscreen 2-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 1020.007292][T17929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.015806][T17929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.026068][ T9] savu 0003:1E7D:2D5A.0040: unknown main item tag 0x0 [ 1020.047975][ T5956] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1020.100152][ T9] savu 0003:1E7D:2D5A.0040: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 1020.113164][ T5956] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1020.126047][ T5956] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1020.127417][ T9] usb 3-1: USB disconnect, device number 115 [ 1020.941646][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1021.005074][T17940] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1021.026477][ T5956] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1021.080476][T17959] netlink: 1296 bytes leftover after parsing attributes in process `syz.1.3256'. [ 1021.107070][ T5875] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1021.224830][ T30] audit: type=1400 audit(1760412165.893:879): avc: denied { ioctl } for pid=17937 comm="syz.0.3251" path="socket:[64534]" dev="sockfs" ino=64534 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1021.598643][ T5875] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1021.607904][ T5875] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1021.617592][ T5875] usb 4-1: config 0 descriptor?? [ 1022.510586][ T5883] usb 1-1: USB disconnect, device number 118 [ 1023.059050][ T5956] usb 1-1: new full-speed USB device number 119 using dummy_hcd [ 1023.156047][ T5875] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1023.164226][ T5875] [drm:udl_init] *ERROR* Selecting channel failed [ 1023.183607][ T5875] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 1023.190666][ T5875] [drm] Initialized udl on minor 2 [ 1023.204031][ T5875] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1023.213461][ T5875] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1023.227203][ T5883] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1023.247700][ T5956] usb 1-1: config 0 has an invalid interface number: 218 but max is 0 [ 1023.256971][ T5875] usb 4-1: USB disconnect, device number 7 [ 1023.263519][ T5883] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1023.277324][ T5956] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1023.290953][ T5956] usb 1-1: config 0 has no interface number 0 [ 1023.297159][ T5956] usb 1-1: too many endpoints for config 0 interface 218 altsetting 5: 249, using maximum allowed: 30 [ 1023.318635][ T5956] usb 1-1: config 0 interface 218 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 249 [ 1023.343942][ T5956] usb 1-1: config 0 interface 218 has no altsetting 0 [ 1023.403292][ T5956] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1023.433442][ T5956] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.452668][ T5956] usb 1-1: Product: syz [ 1023.461298][ T5956] usb 1-1: Manufacturer: syz [ 1023.466236][ T5956] usb 1-1: SerialNumber: syz [ 1023.474285][ T5956] usb 1-1: config 0 descriptor?? [ 1024.154461][T17845] Bluetooth: hci1: ACL packet for unknown connection handle 3072 [ 1024.467434][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1024.692404][T18010] pimreg: entered allmulticast mode [ 1024.707016][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 1024.714720][ T9] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1024.744105][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1024.770515][ T9] usb 4-1: config 0 descriptor?? [ 1025.980822][T18005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1026.015066][T18005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1026.030268][ T5816] usb 1-1: USB disconnect, device number 119 [ 1026.105142][ T9] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1026.120706][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1026.129735][ T9] dib0700: firmware download failed at 7 with -22 [ 1026.150705][T18020] 9pnet_fd: Insufficient options for proto=fd [ 1026.193405][T18020] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3276'. [ 1026.300081][T18005] random: crng reseeded on system resumption [ 1026.482400][ T5816] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1026.913234][T12881] hid-generic 0000:0000:0000.0041: unknown main item tag 0x0 [ 1026.981023][T12881] hid-generic 0000:0000:0000.0041: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1026.991381][ T5883] usb 4-1: USB disconnect, device number 8 [ 1027.486974][ T5816] usb 1-1: Using ep0 maxpacket: 16 [ 1027.498039][ T5816] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1027.516973][ T5816] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1027.526747][ T5816] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1027.567030][ T5816] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1027.576129][ T5816] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.594475][T18041] tmpfs: Bad value for 'mpol' [ 1027.603898][ T5816] usb 1-1: config 0 descriptor?? [ 1029.037003][ T9] usb 6-1: new low-speed USB device number 96 using dummy_hcd [ 1029.247586][T18056] sctp: [Deprecated]: syz.1.3286 (pid 18056) Use of int in maxseg socket option. [ 1029.247586][T18056] Use struct sctp_assoc_value instead [ 1029.307621][ T9] usb 6-1: device descriptor read/64, error -71 [ 1029.334477][T18059] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1029.523264][T18024] netlink: 'syz.0.3278': attribute type 2 has an invalid length. [ 1029.537169][T18024] netlink: 244 bytes leftover after parsing attributes in process `syz.0.3278'. [ 1029.696108][ T5816] usbhid 1-1:0.0: can't add hid device: -71 [ 1029.703127][ T5816] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1029.711007][ T9] usb 6-1: new low-speed USB device number 97 using dummy_hcd [ 1029.738741][ T5816] usb 1-1: USB disconnect, device number 120 [ 1029.847209][ T9] usb 6-1: device descriptor read/64, error -71 [ 1030.022874][ T9] usb usb6-port1: attempt power cycle [ 1030.603253][ T9] usb 6-1: new low-speed USB device number 98 using dummy_hcd [ 1031.027687][ T9] usb 6-1: device descriptor read/8, error -71 [ 1031.107306][ T5956] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1031.288392][ T5956] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1031.302095][ T5956] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1031.315238][ T5956] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1031.325564][ T5956] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1031.846415][ T5956] usb 3-1: SerialNumber: syz [ 1031.957740][ T5816] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1032.082347][ T5956] usb 3-1: 0:2 : does not exist [ 1032.115295][ T5956] usb 3-1: USB disconnect, device number 116 [ 1032.154218][ T10] hid-generic 0000:0000:0000.0042: unknown main item tag 0x0 [ 1032.161904][ T5816] usb 2-1: Using ep0 maxpacket: 16 [ 1032.177491][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1032.192448][ T10] hid-generic 0000:0000:0000.0042: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1032.202153][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1032.216875][ T5816] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1032.234860][ T5816] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1032.244709][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.257406][ T5816] usb 2-1: config 0 descriptor?? [ 1032.327044][ T9] usb 6-1: new low-speed USB device number 99 using dummy_hcd [ 1032.518670][ T9] usb 6-1: config index 0 descriptor too short (expected 6427, got 27) [ 1032.609938][ T9] usb 6-1: config 0 has an invalid interface number: 21 but max is 0 [ 1032.618752][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1032.656999][ T9] usb 6-1: config 0 has no interface number 0 [ 1032.663274][ T9] usb 6-1: config 0 interface 21 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1032.677342][ T9] usb 6-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1032.688409][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.701375][ T9] usb 6-1: config 0 descriptor?? [ 1032.852891][ T5816] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 1032.868561][ T5816] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 1032.875824][ T5816] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 1032.885583][ T5816] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 1032.912349][ T5816] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 1032.950945][ T5816] input: HID 0955:7214 Haptics as /devices/virtual/input/input63 [ 1032.976007][ T5816] shield 0003:0955:7214.0043: Registered Thunderstrike controller [ 1032.984902][ T5816] shield 0003:0955:7214.0043: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 1033.128408][ T5816] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1033.129077][ T5883] usb 2-1: USB disconnect, device number 40 [ 1033.161604][ T5816] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1033.204301][ T5816] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1033.221940][T18107] netlink: 'syz.2.3300': attribute type 21 has an invalid length. [ 1033.245425][T18107] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3300'. [ 1033.255941][ T5816] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1033.268326][T18107] netlink: 'syz.2.3300': attribute type 4 has an invalid length. [ 1033.307315][T18107] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3300'. [ 1033.946114][T18107] batadv1: entered promiscuous mode [ 1033.952283][T18107] batadv1: entered allmulticast mode [ 1033.962742][T18107] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1034.317923][ T5956] usb 6-1: USB disconnect, device number 99 [ 1034.657055][ T5956] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1034.676975][ T9] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 1035.587037][ T9] usb 4-1: device descriptor read/64, error -71 [ 1035.767014][T18132] fuse: Bad value for 'fd' [ 1036.487991][ T5956] usb 6-1: Using ep0 maxpacket: 16 [ 1036.506116][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1036.507015][ T9] usb 4-1: new low-speed USB device number 10 using dummy_hcd [ 1036.552910][ T5956] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1036.575872][ T5883] hid-generic 0000:0000:0000.0044: unknown main item tag 0x0 [ 1036.602324][ T5956] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1036.623236][ T5883] hid-generic 0000:0000:0000.0044: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1036.657087][ T9] usb 4-1: device descriptor read/64, error -71 [ 1036.667324][ T5956] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1036.691369][ T5956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1036.714073][ T5956] usb 6-1: config 0 descriptor?? [ 1036.772566][ T9] usb usb4-port1: attempt power cycle [ 1037.069520][ T5902] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1037.227091][ T9] usb 4-1: new low-speed USB device number 11 using dummy_hcd [ 1037.257656][ T9] usb 4-1: device descriptor read/8, error -71 [ 1037.299791][ T5902] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1037.313498][ T5902] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1037.334006][T18156] netlink: 'syz.5.3305': attribute type 2 has an invalid length. [ 1037.344641][ T5902] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1037.354138][T18156] netlink: 244 bytes leftover after parsing attributes in process `syz.5.3305'. [ 1037.379635][ T5956] usbhid 6-1:0.0: can't add hid device: -71 [ 1037.386085][ T5956] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1037.399505][ T5956] usb 6-1: USB disconnect, device number 100 [ 1037.410975][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1037.429968][ T5902] usb 2-1: SerialNumber: syz [ 1037.735930][ T5902] usb 2-1: 0:2 : does not exist [ 1037.792590][ T5902] usb 2-1: USB disconnect, device number 41 [ 1038.774718][T18178] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1039.228799][ T5883] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1039.240575][ T5883] hid-generic 0000:0000:0000.0045: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1040.627042][ T5883] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1040.777123][ T5883] usb 2-1: Using ep0 maxpacket: 16 [ 1040.785121][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1040.796383][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1040.807515][ T5883] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1040.867216][ T5883] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1040.896331][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.941842][ T5883] usb 2-1: config 0 descriptor?? [ 1040.947838][ T5956] usb 3-1: new full-speed USB device number 117 using dummy_hcd [ 1041.349344][ T5956] usb 3-1: config 1 has an invalid interface number: 91 but max is 0 [ 1041.387184][ T5956] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1041.396268][ T5956] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.427840][ T5956] usb 3-1: config 1 has no interface number 0 [ 1041.446411][ T5956] usb 3-1: config 1 interface 91 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1041.456502][ T5956] usb 3-1: config 1 interface 91 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1041.466697][ T5956] usb 3-1: config 1 interface 91 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1041.478108][ T5956] usb 3-1: config 1 interface 91 altsetting 0 endpoint 0xB has invalid maxpacket 1024, setting to 1023 [ 1041.489434][ T5956] usb 3-1: config 1 interface 91 altsetting 0 has an endpoint descriptor with address 0x77, changing to 0x7 [ 1041.541108][T18199] netlink: 'syz.1.3326': attribute type 2 has an invalid length. [ 1041.566073][T18199] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3326'. [ 1041.605748][ T5956] usb 3-1: config 1 interface 91 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 1041.636404][ T5956] usb 3-1: config 1 interface 91 altsetting 0 has 6 endpoint descriptors, different from the interface descriptor's value: 11 [ 1041.662756][ T5883] usbhid 2-1:0.0: can't add hid device: -71 [ 1041.668972][ T5883] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1041.694243][ T5883] usb 2-1: USB disconnect, device number 42 [ 1041.701012][ T5956] usb 3-1: New USB device found, idVendor=eb1a, idProduct=2820, bcdDevice=2c.48 [ 1041.751341][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.781765][ T5956] usb 3-1: Product: syz [ 1041.785980][ T5956] usb 3-1: Manufacturer: syz [ 1041.807406][ T5956] usb 3-1: SerialNumber: syz [ 1042.050468][ T5902] usb 3-1: USB disconnect, device number 117 [ 1042.967189][ T5956] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1043.165588][ T5956] usb 2-1: Using ep0 maxpacket: 8 [ 1043.227879][ T5956] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1043.250519][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1043.267237][ T5956] usb 2-1: Product: syz [ 1043.280314][ T5956] usb 2-1: Manufacturer: syz [ 1043.295291][ T5956] usb 2-1: SerialNumber: syz [ 1043.309942][ T5956] usb 2-1: config 0 descriptor?? [ 1043.335867][T18239] netlink: 'syz.3.3338': attribute type 1 has an invalid length. [ 1043.352723][ T10] hid-generic 0000:0000:0000.0046: unknown main item tag 0x0 [ 1043.364030][T18239] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3338'. [ 1043.481740][ T10] hid-generic 0000:0000:0000.0046: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1043.519303][ T5956] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1043.937046][ T5883] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1043.960799][ T5956] usb write operation failed. (-71) [ 1043.989093][ T5956] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1044.010366][ T5956] dvbdev: DVB: registering new adapter (Terratec H7) [ 1044.017614][ T5956] usb 2-1: media controller created [ 1044.023818][ T5956] usb read operation failed. (-71) [ 1044.030474][ T5956] usb write operation failed. (-71) [ 1044.275227][ T5883] usb 6-1: Using ep0 maxpacket: 16 [ 1044.297749][ T5956] dvb_usb_az6007 2-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1044.361822][ T5956] usb 2-1: USB disconnect, device number 43 [ 1044.375005][ T5883] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1044.392744][ T5883] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1044.403473][ T5883] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1044.417249][ T5883] usb 6-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 1044.430429][ T5883] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1044.442382][ T5883] usb 6-1: config 0 descriptor?? [ 1044.622656][T18259] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1044.997273][ T9] usb 3-1: new low-speed USB device number 118 using dummy_hcd [ 1045.153747][T18267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3347'. [ 1045.282747][T18241] tmpfs: Bad value for 'mpol' [ 1045.332261][ T9] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 1045.350450][ T9] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 1045.360675][ T9] usb 3-1: config 0 has no interface number 0 [ 1045.367619][ T9] usb 3-1: config 0 interface 21 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1045.660988][ T9] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1045.671370][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1045.700647][ T9] usb 3-1: config 0 descriptor?? [ 1046.406875][ T5883] usbhid 6-1:0.0: can't add hid device: -71 [ 1046.418193][ T5883] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1046.517748][ T5883] usb 6-1: USB disconnect, device number 101 [ 1047.349324][T18300] bridge: RTM_NEWNEIGH with invalid ether address [ 1047.462897][T18294] ntfs3(nullb0): Primary boot signature is not NTFS. [ 1047.469860][T18294] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 1047.579119][ T24] hid-generic 0000:0000:0000.0047: unknown main item tag 0x0 [ 1047.593697][ T24] hid-generic 0000:0000:0000.0047: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1048.247709][ T5883] usb 3-1: USB disconnect, device number 118 [ 1048.977141][ T5956] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1049.129053][ T5956] usb 4-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 1049.138296][ T5956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=2 [ 1049.146304][ T5956] usb 4-1: SerialNumber: syz [ 1049.146977][ T9] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1049.158991][ T24] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1049.167546][ T5956] usb 4-1: config 0 descriptor?? [ 1049.174493][ T5956] gspca_main: spca508-2.14.0 probing 8086:0110 [ 1049.269071][T18328] wg2: entered promiscuous mode [ 1049.308994][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 1049.316583][ T9] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1049.327630][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1049.340352][ T24] usb 6-1: config 6 has an invalid interface number: 134 but max is 1 [ 1049.341581][ T9] usb 2-1: config 0 descriptor?? [ 1049.354667][ T24] usb 6-1: config 6 has an invalid interface number: 203 but max is 1 [ 1049.364004][ T24] usb 6-1: config 6 has no interface number 0 [ 1049.372396][ T24] usb 6-1: config 6 has no interface number 1 [ 1049.437155][ T24] usb 6-1: config 6 interface 134 has no altsetting 0 [ 1049.443983][ T24] usb 6-1: config 6 interface 203 has no altsetting 0 [ 1049.619781][T18324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1049.647135][ T30] audit: type=1400 audit(1760412194.186:880): avc: denied { bind } for pid=18318 comm="syz.3.3360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1049.696175][T18324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1049.696629][ T5956] gspca_spca508: reg_read err -71 [ 1049.711658][ T24] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=46.8f [ 1049.922233][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.940489][ T5956] gspca_spca508: reg_read err -71 [ 1049.946629][ T24] usb 6-1: Product: syz [ 1049.955429][ T9] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1049.955796][ T5956] gspca_spca508: reg_read err -71 [ 1049.969956][ T24] usb 6-1: Manufacturer: syz [ 1049.977020][ T24] usb 6-1: SerialNumber: syz [ 1049.991260][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1050.011882][ T9] dib0700: firmware download failed at 7 with -22 [ 1050.027507][ T5956] gspca_spca508: reg_read err -71 [ 1050.075025][ T5956] gspca_spca508: reg_read err -71 [ 1050.211206][ T5956] gspca_spca508: reg write: error -71 [ 1050.221436][ T5956] spca508 4-1:0.0: probe with driver spca508 failed with error -71 [ 1050.231948][T18324] random: crng reseeded on system resumption [ 1050.233009][ T5956] usb 4-1: USB disconnect, device number 13 [ 1050.768291][ T5902] usb 2-1: USB disconnect, device number 44 [ 1050.792507][ T24] usb 6-1: USB disconnect, device number 102 [ 1051.020900][T18347] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3370'. [ 1051.192166][T18351] hub 2-0:1.0: USB hub found [ 1051.197019][T18351] hub 2-0:1.0: 1 port detected [ 1051.344227][T18355] FAULT_INJECTION: forcing a failure. [ 1051.344227][T18355] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1051.358577][T18355] CPU: 0 UID: 0 PID: 18355 Comm: syz.0.3373 Not tainted syzkaller #0 PREEMPT(full) [ 1051.358604][T18355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1051.358615][T18355] Call Trace: [ 1051.358622][T18355] [ 1051.358629][T18355] dump_stack_lvl+0x16c/0x1f0 [ 1051.358658][T18355] should_fail_ex+0x512/0x640 [ 1051.358687][T18355] _copy_from_user+0x2e/0xd0 [ 1051.358710][T18355] copy_msghdr_from_user+0x98/0x160 [ 1051.358732][T18355] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1051.358765][T18355] ___sys_sendmsg+0xfe/0x1d0 [ 1051.358786][T18355] ? __pfx____sys_sendmsg+0x10/0x10 [ 1051.358804][T18355] ? __lock_acquire+0x622/0x1c90 [ 1051.358857][T18355] __sys_sendmsg+0x16d/0x220 [ 1051.358878][T18355] ? __pfx___sys_sendmsg+0x10/0x10 [ 1051.358914][T18355] do_syscall_64+0xcd/0xfa0 [ 1051.358937][T18355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.358955][T18355] RIP: 0033:0x7f4de118eec9 [ 1051.358970][T18355] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1051.358987][T18355] RSP: 002b:00007f4ddf3f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1051.359005][T18355] RAX: ffffffffffffffda RBX: 00007f4de13e5fa0 RCX: 00007f4de118eec9 [ 1051.359016][T18355] RDX: 0000000024000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1051.359027][T18355] RBP: 00007f4ddf3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1051.359038][T18355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1051.359048][T18355] R13: 00007f4de13e6038 R14: 00007f4de13e5fa0 R15: 00007ffcd6f96fc8 [ 1051.359073][T18355] [ 1052.477087][ T5875] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1052.857131][ T5875] usb 6-1: Using ep0 maxpacket: 16 [ 1052.894032][ T5875] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1052.912536][ T5875] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1053.402330][ T5902] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 1053.437326][ T5875] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1053.476015][ T5875] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1053.487061][ T5875] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1053.529671][ T5875] usb 6-1: config 0 descriptor?? [ 1053.577158][ T5902] usb 2-1: Using ep0 maxpacket: 32 [ 1053.658693][ T5902] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1053.679451][ T5902] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1053.696573][ T5902] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1053.719974][ T5902] usb 2-1: Product: syz [ 1053.724687][ T5902] usb 2-1: Manufacturer: syz [ 1053.737239][ T5902] usb 2-1: SerialNumber: syz [ 1054.349792][ T5902] usb 2-1: config 0 descriptor?? [ 1054.352289][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.400149][ T5875] shield 0003:0955:7214.0048: unknown main item tag 0x0 [ 1054.408608][ T5875] shield 0003:0955:7214.0048: unknown main item tag 0x0 [ 1054.416428][ T5875] shield 0003:0955:7214.0048: unknown main item tag 0x0 [ 1054.432918][T18372] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1054.468738][ T5902] hub 2-1:0.0: bad descriptor, ignoring hub [ 1054.494616][ T5902] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1054.637605][ T5875] shield 0003:0955:7214.0048: unknown main item tag 0x0 [ 1054.648835][ T5875] shield 0003:0955:7214.0048: unknown main item tag 0x0 [ 1054.680967][ T5875] input: HID 0955:7214 Haptics as /devices/virtual/input/input64 [ 1054.702954][ T5875] shield 0003:0955:7214.0048: Registered Thunderstrike controller [ 1054.801835][ T5875] shield 0003:0955:7214.0048: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.5-1/input0 [ 1055.349626][ T5883] shield 0003:0955:7214.0048: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1055.422735][ T5875] usb 6-1: USB disconnect, device number 103 [ 1055.436877][ T5883] shield 0003:0955:7214.0048: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1055.562424][ T5883] shield 0003:0955:7214.0048: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1055.748722][ T5883] shield 0003:0955:7214.0048: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1055.789647][T18399] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1056.032781][T18401] block device autoloading is deprecated and will be removed. [ 1056.058423][ T5902] usb 2-1: USB disconnect, device number 45 [ 1056.347466][T18402] lo speed is unknown, defaulting to 1000 [ 1056.949417][T18407] lo speed is unknown, defaulting to 1000 [ 1057.147009][ T5875] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1057.297020][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 1057.308499][ T5875] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 214, changing to 11 [ 1057.457195][ T5875] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1057.497114][ T5875] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1057.535490][ T5875] usb 2-1: New USB device found, idVendor=28bd, idProduct=0933, bcdDevice= 0.00 [ 1057.582215][ T30] audit: type=1400 audit(1760412202.236:881): avc: denied { connect } for pid=18415 comm="syz.5.3390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1057.583488][ T5875] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.620797][T18424] xt_TCPMSS: Only works on TCP SYN packets [ 1057.639750][T18426] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1057.677815][ T5875] usb 2-1: config 0 descriptor?? [ 1057.680750][T18426] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3391'. [ 1057.704033][T18426] bridge0: port 2(bridge_slave_1) entered disabled state [ 1057.712709][T18426] bridge0: port 1(bridge_slave_0) entered disabled state [ 1058.380061][ T5875] input: HID 28bd:0933 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28BD:0933.0049/input/input65 [ 1058.545663][ T5875] uclogic 0003:28BD:0933.0049: input,hidraw0: USB HID v5f.b2 Mouse [HID 28bd:0933] on usb-dummy_hcd.1-1/input0 [ 1058.621470][ T5875] usb 2-1: USB disconnect, device number 46 [ 1058.857227][ T5883] usb 1-1: new full-speed USB device number 121 using dummy_hcd [ 1059.039341][ T5883] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1059.997241][ T5902] usb 4-1: new low-speed USB device number 14 using dummy_hcd [ 1060.147030][ T5883] usb 1-1: New USB device found, idVendor=056a, idProduct=0343, bcdDevice= 0.00 [ 1060.156265][ T5883] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.172732][ T5883] usb 1-1: config 0 descriptor?? [ 1060.372512][ T5902] usb 4-1: device descriptor read/64, error -71 [ 1060.489536][ T24] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1060.667577][ T5902] usb 4-1: new low-speed USB device number 15 using dummy_hcd [ 1060.688072][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1060.719051][ T24] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1060.730275][ T5883] wacom 0003:056A:0343.004A: unknown main item tag 0x4 [ 1060.739979][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.798103][ T24] usb 3-1: config 0 descriptor?? [ 1060.828880][ T5902] usb 4-1: device descriptor read/64, error -71 [ 1060.841130][ T5883] usb 1-1: USB disconnect, device number 121 [ 1060.937366][ T5902] usb usb4-port1: attempt power cycle [ 1061.052018][T18454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1061.061211][T18454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1061.072653][ T24] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1061.083220][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1061.092459][ T24] dib0700: firmware download failed at 7 with -22 [ 1061.406965][ T5902] usb 4-1: new low-speed USB device number 16 using dummy_hcd [ 1061.418721][T18454] random: crng reseeded on system resumption [ 1061.437479][ T5902] usb 4-1: device descriptor read/8, error -71 [ 1061.444428][ T10] usb 3-1: USB disconnect, device number 119 [ 1062.047019][ T5902] usb 4-1: new low-speed USB device number 17 using dummy_hcd [ 1062.090353][T18475] bad cache= option: noe*(3 -n[}ZP [ 1062.090353][T18475] [ 1062.116782][T18475] CIFS: VFS: bad cache= option: noe*(3 -n[}ZP [ 1062.137623][T18479] FAULT_INJECTION: forcing a failure. [ 1062.137623][T18479] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1062.179618][ T5860] hid-generic 0000:0000:0000.004B: unknown main item tag 0x0 [ 1062.194760][ T5860] hid-generic 0000:0000:0000.004B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1062.198345][T18479] CPU: 1 UID: 0 PID: 18479 Comm: syz.0.3406 Not tainted syzkaller #0 PREEMPT(full) [ 1062.198367][T18479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1062.198377][T18479] Call Trace: [ 1062.198383][T18479] [ 1062.198394][T18479] dump_stack_lvl+0x16c/0x1f0 [ 1062.198418][T18479] should_fail_ex+0x512/0x640 [ 1062.198443][T18479] _copy_to_user+0x32/0xd0 [ 1062.198465][T18479] ksys_shmctl.constprop.0+0x186/0x380 [ 1062.198490][T18479] ? __pfx_ksys_shmctl.constprop.0+0x10/0x10 [ 1062.198513][T18479] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 1062.198536][T18479] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1062.198559][T18479] ? __fget_files+0x20e/0x3c0 [ 1062.198596][T18479] do_syscall_64+0xcd/0xfa0 [ 1062.198616][T18479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1062.198633][T18479] RIP: 0033:0x7f4de118eec9 [ 1062.198646][T18479] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1062.198662][T18479] RSP: 002b:00007f4ddf3f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000001f [ 1062.198678][T18479] RAX: ffffffffffffffda RBX: 00007f4de13e5fa0 RCX: 00007f4de118eec9 [ 1062.198688][T18479] RDX: 0000200000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 1062.198698][T18479] RBP: 00007f4ddf3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1062.198707][T18479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1062.198716][T18479] R13: 00007f4de13e6038 R14: 00007f4de13e5fa0 R15: 00007ffcd6f96fc8 [ 1062.198739][T18479] [ 1062.366108][ T5902] usb 4-1: device not accepting address 17, error -71 [ 1062.379200][ T5902] usb usb4-port1: unable to enumerate USB device [ 1062.448804][ T30] audit: type=1400 audit(1760412207.066:882): avc: denied { ioctl } for pid=18483 comm="syz.2.3409" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x8924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1062.627115][ T24] usb 3-1: new low-speed USB device number 120 using dummy_hcd [ 1062.817036][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1063.049596][ T24] usb 3-1: new low-speed USB device number 121 using dummy_hcd [ 1063.426659][T18498] netlink: 2384 bytes leftover after parsing attributes in process `syz.1.3412'. [ 1063.610016][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1063.616004][ T24] usb usb3-port1: attempt power cycle [ 1064.447118][ T24] usb 3-1: new low-speed USB device number 122 using dummy_hcd [ 1064.907599][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1065.036996][ T24] usb 3-1: new low-speed USB device number 123 using dummy_hcd [ 1065.058248][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1065.063783][ T24] usb usb3-port1: unable to enumerate USB device [ 1065.537625][ T5902] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1065.633534][T18526] tmpfs: Unknown parameter 'fsuuid' [ 1065.817084][ T5902] usb 6-1: Using ep0 maxpacket: 32 [ 1065.830018][ T5902] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1065.946379][T18537] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1065.978432][T18537] tmpfs: Unknown parameter 'fsuuid' [ 1066.077757][ T5902] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.090732][ T5902] usb 6-1: config 0 descriptor?? [ 1066.169079][T18541] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1066.362141][T18524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1066.371406][T18524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1066.381623][ T5902] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1066.412205][ T5902] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1066.443063][ T5902] dib0700: firmware download failed at 7 with -22 [ 1066.586957][T18524] random: crng reseeded on system resumption [ 1066.621543][ T10] usb 6-1: USB disconnect, device number 104 [ 1068.782718][T18565] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3429'. [ 1069.255570][T18568] bad cache= option: noe*(3 -n[}ZP [ 1069.255570][T18568] [ 1069.264738][T18568] CIFS: VFS: bad cache= option: noe*(3 -n[}ZP [ 1069.817025][ T5875] usb 4-1: new low-speed USB device number 18 using dummy_hcd [ 1070.447030][ T5875] usb 4-1: device descriptor read/64, error -71 [ 1070.548374][T18581] SET target dimension over the limit! [ 1070.964849][ T10] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 1071.335150][ T10] usb 2-1: config 0 has an invalid descriptor of length 218, skipping remainder of the config [ 1071.428758][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1071.481929][ T10] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1071.507151][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.515185][ T10] usb 2-1: Product: syz [ 1071.519769][ T10] usb 2-1: Manufacturer: syz [ 1071.524647][ T10] usb 2-1: SerialNumber: syz [ 1071.536234][ T10] usb 2-1: config 0 descriptor?? [ 1071.815469][ T10] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1071.973973][T18605] Bluetooth: MGMT ver 1.23 [ 1072.547033][ T5883] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1072.767412][ T5902] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1072.916978][ T5902] usb 4-1: Using ep0 maxpacket: 32 [ 1072.932241][ T5902] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 1072.940931][ T5902] usb 4-1: config 4 has no interface number 0 [ 1072.949302][ T5902] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1072.972056][ T5902] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1072.999475][ T5902] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1073.017015][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.036574][ T5902] hub 4-1:4.128: USB hub found [ 1073.136962][ T5883] usb 6-1: Using ep0 maxpacket: 32 [ 1073.180006][ T5883] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1073.189285][ T5883] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.207708][ T5883] usb 6-1: config 0 descriptor?? [ 1073.305598][ T5902] hub 4-1:4.128: config failed, can't read hub descriptor (err -22) [ 1073.338135][ T5902] usb 4-1: USB disconnect, device number 20 [ 1073.416150][T18607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1073.426833][T18607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1073.448358][ T5883] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1073.472276][ T5883] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1073.496330][ T5883] dib0700: firmware download failed at 7 with -22 [ 1073.650512][T18607] random: crng reseeded on system resumption [ 1073.662033][ T10] usb 6-1: USB disconnect, device number 105 [ 1074.167161][T18625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3443'. [ 1074.312089][T18626] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3443'. [ 1074.321268][T18626] unsupported nlmsg_type 40 [ 1074.556924][ T30] audit: type=1326 audit(1760412218.836:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.584817][ T30] audit: type=1326 audit(1760412218.836:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.609465][ T30] audit: type=1326 audit(1760412218.836:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.648160][ T30] audit: type=1326 audit(1760412218.836:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.672844][ T30] audit: type=1326 audit(1760412218.836:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.697711][ T30] audit: type=1326 audit(1760412218.836:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.725233][ T30] audit: type=1326 audit(1760412218.836:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.751056][ T30] audit: type=1326 audit(1760412218.836:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.767714][T18611] pimreg: entered allmulticast mode [ 1074.774442][ C1] vkms_vblank_simulate: vblank timer overrun [ 1074.777414][ T30] audit: type=1326 audit(1760412218.846:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18621 comm="syz.3.3443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f79d538eec9 code=0x7ffc0000 [ 1074.808959][ C1] vkms_vblank_simulate: vblank timer overrun [ 1075.005266][ T5875] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1075.029605][ T5902] usb 2-1: USB disconnect, device number 47 [ 1075.240426][T18635] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1075.272738][T18636] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3446'. [ 1075.373925][T18636] bridge0: port 2(bridge_slave_1) entered disabled state [ 1075.381488][T18636] bridge0: port 1(bridge_slave_0) entered disabled state [ 1075.558488][ T5875] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1075.567085][ T5875] usb 6-1: config 0 has no interface number 0 [ 1075.578501][ T5875] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1075.588204][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.596431][ T5875] usb 6-1: Product: syz [ 1075.599488][T18644] No source specified [ 1075.607614][ T5875] usb 6-1: Manufacturer: syz [ 1075.612734][ T5875] usb 6-1: SerialNumber: syz [ 1075.620087][ T5875] usb 6-1: config 0 descriptor?? [ 1075.931005][ T5875] usb 6-1: dvb_usb_v2: found a 'E3C EC168 reference design' in cold state [ 1075.988717][ T5875] usb 6-1: Direct firmware load for dvb-usb-ec168.fw failed with error -2 [ 1076.009468][ T5875] usb 6-1: Falling back to sysfs fallback for: dvb-usb-ec168.fw [ 1076.029124][ T30] audit: type=1400 audit(1760412220.676:892): avc: denied { firmware_load } for pid=5875 comm="kworker/1:3" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1076.494579][T18644] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3448'. [ 1077.141813][T18665] 9pnet_fd: Insufficient options for proto=fd [ 1077.294926][T18667] netlink: 'syz.1.3456': attribute type 4 has an invalid length. [ 1077.328432][T18667] netlink: 'syz.1.3456': attribute type 4 has an invalid length. [ 1077.698737][T18678] xt_TCPMSS: Only works on TCP SYN packets [ 1078.107608][T18683] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1078.127768][T18683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3460'. [ 1078.268230][T18688] syzkaller0: entered promiscuous mode [ 1078.274850][T18688] syzkaller0: entered allmulticast mode [ 1079.277768][ T9] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1079.510293][ T9] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1079.529741][ T9] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 1079.557132][ T9] usb 3-1: Product: syz [ 1079.561336][ T9] usb 3-1: Manufacturer: syz [ 1079.565931][ T9] usb 3-1: SerialNumber: syz [ 1079.582625][ T9] usb 3-1: config 0 descriptor?? [ 1079.680135][ T9] ch341 3-1:0.0: ch341-uart converter detected [ 1079.730709][T18716] xt_TCPMSS: Only works on TCP SYN packets [ 1080.625804][T18723] netlink: 'syz.3.3473': attribute type 1 has an invalid length. [ 1080.971043][T18736] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1080.990803][T18736] tmpfs: Unknown parameter 'fsuuid' [ 1081.227759][ T9] ch341-uart ttyUSB0: break control not supported, using simulated break [ 1081.239879][ T9] usb 3-1: ch341-uart converter now attached to ttyUSB0 [ 1081.384035][T18739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3480'. [ 1081.390762][T18737] vlan0: entered allmulticast mode [ 1081.403413][T18737] hsr_slave_1: entered allmulticast mode [ 1081.426495][T18744] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 1081.433013][T18744] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1081.441018][T18744] vhci_hcd vhci_hcd.0: Device attached [ 1081.827775][ T5956] usb 40-1: SetAddress Request (2) to port 0 [ 1081.835050][ T5956] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1082.056244][T18739] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3480'. [ 1082.269057][T18745] vhci_hcd: connection reset by peer [ 1082.276783][ T7470] vhci_hcd: stop threads [ 1082.316541][ T7470] vhci_hcd: release socket [ 1082.769803][ T7470] vhci_hcd: disconnect device [ 1082.788402][ T5902] usb 3-1: USB disconnect, device number 124 [ 1082.799451][ T5902] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 1082.809683][ T5902] ch341 3-1:0.0: device disconnected [ 1082.872767][T18762] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1083.112032][ T5860] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1083.117369][T12881] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 1083.368422][T12881] usb 2-1: Using ep0 maxpacket: 8 [ 1083.387589][ T5860] usb 1-1: Using ep0 maxpacket: 32 [ 1083.409028][T12881] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1083.530025][T12881] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1083.628276][ T5860] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1083.644252][ T5860] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1083.653791][T12881] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1083.698103][ T5860] usb 1-1: config 0 descriptor?? [ 1083.825068][T12881] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1083.838488][T12881] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1083.850788][T12881] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1083.905443][T12881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1083.982124][T18764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1083.994222][T12881] usb 2-1: config 0 descriptor?? [ 1083.999579][T18764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1084.010231][T18762] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1084.035621][ T5860] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1084.064271][ T5860] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1084.087148][ T5860] dib0700: firmware download failed at 7 with -22 [ 1084.459194][T18764] random: crng reseeded on system resumption [ 1084.501320][T12881] usb 1-1: USB disconnect, device number 122 [ 1085.445312][ T5902] usb 2-1: USB disconnect, device number 48 [ 1085.454477][T17845] Bluetooth: hci2: Opcode 0x0c03 failed: -19 [ 1085.911769][T18805] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3496'. [ 1086.854360][ T30] audit: type=1400 audit(1760412231.526:893): avc: denied { map } for pid=18807 comm="syz.2.3497" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1086.907968][ T5956] usb 40-1: device descriptor read/8, error -110 [ 1087.169214][ T5902] hid-generic 0000:0000:0000.004C: unknown main item tag 0x0 [ 1087.248392][ T5902] hid-generic 0000:0000:0000.004C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1087.443312][ T5956] usb usb40-port1: attempt power cycle [ 1087.627799][T18822] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 1087.636522][T18822] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3502'. [ 1087.646773][T18822] bridge0: port 2(bridge_slave_1) entered disabled state [ 1087.654513][T18822] bridge0: port 1(bridge_slave_0) entered disabled state [ 1088.082425][ T5956] usb usb40-port1: unable to enumerate USB device [ 1088.536968][ T5956] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1088.653388][ T30] audit: type=1326 audit(1760412233.296:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.706583][ T30] audit: type=1326 audit(1760412233.296:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.733938][ T30] audit: type=1326 audit(1760412233.296:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.759694][ T30] audit: type=1326 audit(1760412233.296:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.784597][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 1088.787471][ T30] audit: type=1326 audit(1760412233.296:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.797985][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1088.852571][ T30] audit: type=1326 audit(1760412233.296:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.876550][ T30] audit: type=1326 audit(1760412233.296:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.904313][ T30] audit: type=1326 audit(1760412233.296:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.929194][ T30] audit: type=1326 audit(1760412233.296:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18819 comm="syz.2.3501" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8acb58eec9 code=0x7fc00000 [ 1088.970896][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1088.983112][ T5956] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1089.011593][ T5956] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1089.043811][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1089.089151][ T5956] usb 2-1: config 0 descriptor?? [ 1089.775414][ T5956] shield 0003:0955:7214.004D: unknown main item tag 0x0 [ 1089.783905][ T5956] shield 0003:0955:7214.004D: unknown main item tag 0x0 [ 1089.807175][ T5956] shield 0003:0955:7214.004D: unknown main item tag 0x0 [ 1089.827027][ T5956] shield 0003:0955:7214.004D: unknown main item tag 0x0 [ 1089.855971][ T5956] shield 0003:0955:7214.004D: unknown main item tag 0x0 [ 1089.866446][ T5956] input: HID 0955:7214 Haptics as /devices/virtual/input/input66 [ 1090.138765][ T5956] shield 0003:0955:7214.004D: Registered Thunderstrike controller [ 1090.146840][ T5956] shield 0003:0955:7214.004D: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 1090.217347][ T43] shield 0003:0955:7214.004D: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1090.231382][ T5956] usb 2-1: USB disconnect, device number 49 [ 1090.237572][ T43] shield 0003:0955:7214.004D: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1090.257312][ T43] shield 0003:0955:7214.004D: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1090.269820][ T43] shield 0003:0955:7214.004D: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1090.378275][T18857] FAT-fs (nullb0): bogus number of reserved sectors [ 1090.386064][T18857] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 1090.987174][ T5902] usb 3-1: new low-speed USB device number 125 using dummy_hcd [ 1091.183714][ T5902] usb 3-1: config 9 has an invalid interface number: 40 but max is 0 [ 1091.237842][ T5902] usb 3-1: config 9 has no interface number 0 [ 1091.300337][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1091.346590][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1091.360374][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0x1 has invalid maxpacket 1023, setting to 8 [ 1091.374632][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1091.385970][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0x7 is Bulk; changing to Interrupt [ 1091.400956][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0xF has invalid maxpacket 32, setting to 8 [ 1091.414998][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has a duplicate endpoint with address 0xC, skipping [ 1091.426282][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0xB is Bulk; changing to Interrupt [ 1091.437239][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0x4 has invalid maxpacket 1023, setting to 8 [ 1091.448970][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an endpoint descriptor with address 0xA5, changing to 0x85 [ 1091.460967][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0x85 has an invalid bInterval 153, changing to 4 [ 1091.497279][ T5902] usb 3-1: config 9 interface 40 altsetting 1 endpoint 0x85 has invalid maxpacket 30069, setting to 0 [ 1091.638157][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has a duplicate endpoint with address 0x4, skipping [ 1091.819821][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1092.029640][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 1092.061449][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has a duplicate endpoint with address 0xB, skipping [ 1092.075407][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1092.181920][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has a duplicate endpoint with address 0x4, skipping [ 1092.195010][ T5902] usb 3-1: config 9 interface 40 altsetting 1 has 17 endpoint descriptors, different from the interface descriptor's value: 16 [ 1092.225429][ T5902] usb 3-1: config 9 interface 40 has no altsetting 0 [ 1092.234397][ T5902] usb 3-1: Dual-Role OTG device on HNP port [ 1092.240832][ T5902] usb 3-1: New USB device found, idVendor=0471, idProduct=1236, bcdDevice=fd.4f [ 1092.250253][ T5902] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.258556][ T5902] usb 3-1: Product: 렙䖆煙鶴焽臃㇅쟀䊂ố뫃赤滪㍕쁃ި밗絾ꏤ๧䷡궀ꊉ툧妺㬑줁䈻೚荚啾鍑蝶ᰇ奱䩼ᝑ쒱 [ 1092.274360][ T5902] usb 3-1: Manufacturer: ဌ [ 1092.279466][ T5902] usb 3-1: SerialNumber: Н [ 1092.294393][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.301936][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.309792][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.322779][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.361753][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.369374][T18861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1092.416996][ T5956] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1092.525776][T18893] loop3: detected capacity change from 0 to 7 [ 1092.535088][T18893] Dev loop3: unable to read RDB block 7 [ 1092.540785][T18893] loop3: unable to read partition table [ 1092.546674][T18893] loop3: partition table beyond EOD, truncated [ 1092.553201][T18893] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 1092.580968][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 1092.608646][ T5956] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1092.619253][ T5902] usb 3-1: USB disconnect, device number 125 [ 1092.626330][ T5956] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1092.637655][ T5956] usb 2-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 1092.646730][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1092.659942][T18895] xt_TCPMSS: Only works on TCP SYN packets [ 1092.666582][ T5956] usb 2-1: config 0 descriptor?? [ 1094.006979][ T5902] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1094.178577][ T5902] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1094.224214][ T5902] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1094.237456][ T5902] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1094.281128][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1094.300800][ T5902] usb 4-1: SerialNumber: syz [ 1094.417680][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 1094.417720][ T30] audit: type=1326 audit(1760412239.086:960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18915 comm="syz.5.3528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42d138eec9 code=0x7ffc0000 [ 1094.447207][ C1] vkms_vblank_simulate: vblank timer overrun [ 1094.832477][ T10] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1094.870755][ T5902] usb 4-1: 0:2 : does not exist [ 1094.877934][ T30] audit: type=1326 audit(1760412239.086:961): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18915 comm="syz.5.3528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42d138eec9 code=0x7ffc0000 [ 1094.902380][ T30] audit: type=1326 audit(1760412239.086:962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18915 comm="syz.5.3528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f42d138eec9 code=0x7ffc0000 [ 1094.925672][ C1] vkms_vblank_simulate: vblank timer overrun [ 1094.932332][ T30] audit: type=1326 audit(1760412239.086:963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18915 comm="syz.5.3528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42d138eec9 code=0x7ffc0000 [ 1094.971923][ T5902] usb 4-1: USB disconnect, device number 21 [ 1094.999455][ T30] audit: type=1326 audit(1760412239.086:964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18915 comm="syz.5.3528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f42d138eec9 code=0x7ffc0000 [ 1095.026014][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1095.037135][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1095.048521][ T10] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1095.058353][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1095.069722][ T10] usb 1-1: SerialNumber: syz [ 1095.248480][ T5956] usbhid 2-1:0.0: can't add hid device: -71 [ 1095.255883][ T5956] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1095.269428][ T5956] usb 2-1: USB disconnect, device number 50 [ 1095.299926][ T10] usb 1-1: 0:2 : does not exist [ 1095.301026][T18923] 9pnet_fd: Insufficient options for proto=fd [ 1095.639878][ T10] usb 1-1: USB disconnect, device number 123 [ 1095.878175][T18930] tmpfs: Unknown parameter 'fsuuid' [ 1097.947175][T12881] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1098.076999][T12881] usb 2-1: device descriptor read/64, error -71 [ 1098.107040][ T10] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 1098.237069][ T5883] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1098.268295][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xDA, changing to 0x8A [ 1098.280123][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 4 [ 1098.292947][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1098.302229][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1098.310430][ T10] usb 4-1: Product: syz [ 1098.314572][ T10] usb 4-1: Manufacturer: syz [ 1098.319386][ T10] usb 4-1: SerialNumber: syz [ 1098.325512][ T10] usb 4-1: config 0 descriptor?? [ 1098.327042][T12881] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1098.396973][ T5883] usb 3-1: Using ep0 maxpacket: 32 [ 1098.403703][ T5883] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1098.413187][ T5883] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1098.423168][ T5883] usb 3-1: config 0 descriptor?? [ 1098.477080][T12881] usb 2-1: device descriptor read/64, error -71 [ 1098.587365][T12881] usb usb2-port1: attempt power cycle [ 1098.630031][ T5883] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 1098.640111][ T5883] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1098.648202][ T5883] dib0700: firmware download failed at 7 with -22 [ 1098.780109][T18955] pimreg: entered allmulticast mode [ 1098.791083][ T5883] usb 4-1: USB disconnect, device number 22 [ 1098.832256][T18960] random: crng reseeded on system resumption [ 1098.845320][ T5956] usb 3-1: USB disconnect, device number 126 [ 1098.948571][T12881] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1098.967406][T12881] usb 2-1: device descriptor read/8, error -71 [ 1099.217030][T12881] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1099.237413][T12881] usb 2-1: device descriptor read/8, error -71 [ 1099.386953][T12881] usb usb2-port1: unable to enumerate USB device [ 1099.756963][ T5956] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 1099.934418][ T5956] usb 4-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 1100.033862][ T5956] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1100.160966][ T5956] usb 4-1: New USB device found, idVendor=20d6, idProduct=cb17, bcdDevice= 0.00 [ 1100.170389][ T5956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1100.180722][ T5956] usb 4-1: config 0 descriptor?? [ 1100.282950][ T30] audit: type=1400 audit(1760412244.956:965): avc: denied { shutdown } for pid=18979 comm="syz.2.3545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1101.015461][ T5956] usb 4-1: string descriptor 0 read error: -71 [ 1101.044200][ T5956] usb 4-1: USB disconnect, device number 23 [ 1101.056995][ T5902] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1101.219782][T18988] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1101.226271][ T5902] usb 2-1: Using ep0 maxpacket: 8 [ 1101.243406][ T5902] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 1101.262812][ T5902] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 1101.324502][ T5902] usb 2-1: Product: syz [ 1101.341946][ T5902] usb 2-1: Manufacturer: syz [ 1101.354979][ T5902] usb 2-1: SerialNumber: syz [ 1101.366824][ T5902] usb 2-1: config 0 descriptor?? [ 1101.378137][ T5902] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 1101.480731][ T30] audit: type=1400 audit(1760412246.156:966): avc: denied { mounton } for pid=18998 comm="syz.2.3551" path="/75/file0" dev="fuse" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 1101.654187][T18984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1101.667803][T18984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1101.766088][T19010] hpfs: hpfs_map_sector(): read error [ 1101.966340][ T5902] gspca_zc3xx: reg_w_i err -110 [ 1102.027197][ T5902] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1102.379188][ T5956] usb 2-1: USB disconnect, device number 55 [ 1102.587078][T14245] Bluetooth: hci0: command 0x0c1a tx timeout [ 1102.786409][ T30] audit: type=1400 audit(1760412247.456:967): avc: denied { nlmsg_write } for pid=19018 comm="syz.0.3555" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 1103.938948][T19039] macvlan2: entered promiscuous mode [ 1103.944333][T19039] bridge0: entered promiscuous mode [ 1104.051781][T19039] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1104.237272][ T30] audit: type=1400 audit(1760412248.716:968): avc: denied { setattr } for pid=19035 comm="syz.0.3559" path="/dev/mixer" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 1105.406859][T19058] tmpfs: Unknown parameter 'usrquota [ 1105.406859][T19058] lo' [ 1105.418168][T19058] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3563'. [ 1105.644583][T19062] tmpfs: Unknown parameter 'fsuuid' [ 1105.998755][T19069] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1106.682549][ T30] audit: type=1400 audit(1760412251.316:969): avc: denied { setopt } for pid=19066 comm="syz.0.3567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1107.027619][ T30] audit: type=1400 audit(1760412251.636:970): avc: denied { listen } for pid=19079 comm="syz.3.3569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1107.056453][T19060] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1108.454898][ T30] audit: type=1400 audit(1760412253.126:971): avc: denied { read } for pid=19117 comm="syz.1.3581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1108.636966][ T5902] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1109.006988][ T5902] usb 1-1: Using ep0 maxpacket: 16 [ 1109.013415][ T5902] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1109.029080][ T5902] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1109.051368][ T5902] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1109.064885][ T5902] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1109.076559][ T5902] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1109.089226][ T5902] usb 1-1: config 0 descriptor?? [ 1109.642766][ T5902] usbhid 1-1:0.0: can't add hid device: -71 [ 1109.648884][ T5902] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1109.660854][ T5902] usb 1-1: USB disconnect, device number 124 [ 1111.466643][T19164] xt_TCPMSS: Only works on TCP SYN packets [ 1113.437168][ T5883] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1113.598687][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1113.639185][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 1113.676645][ T5883] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1113.737942][ T5883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.817119][ T5883] usb 2-1: Product: syz [ 1113.824412][ T5883] usb 2-1: Manufacturer: syz [ 1113.835476][ T5883] usb 2-1: SerialNumber: syz [ 1113.846213][ T5883] usb 2-1: config 0 descriptor?? [ 1114.545270][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.556006][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.566141][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.576493][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.586844][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.597364][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.607751][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.617935][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.628109][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.638404][T19205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3606'. [ 1114.830358][T19205] wg2: left promiscuous mode [ 1114.967361][T19205] batadv1: left promiscuous mode [ 1115.792602][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.809213][T19218] overlayfs: upper fs does not support file handles, falling back to index=off. [ 1115.841384][T19218] overlayfs: failed lookup in lower (newroot/105, name='file1', err=-40): overlapping layers [ 1116.233703][T19230] netlink: 'syz.3.3615': attribute type 4 has an invalid length. [ 1116.404554][ T5883] usb 2-1: USB disconnect, device number 56 [ 1117.260613][T19247] NILFS (loop2): device size too small [ 1118.080744][ T30] audit: type=1326 audit(1760412262.756:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19255 comm="syz.0.3623" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4de118eec9 code=0x0 [ 1118.103634][ C0] vkms_vblank_simulate: vblank timer overrun [ 1118.443034][T19261] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1118.817579][T19270] netlink: 'syz.5.3628': attribute type 4 has an invalid length. [ 1118.907001][ T9] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1119.077026][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 1119.091168][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1119.129350][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1119.140870][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1119.168237][ T9] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1119.177706][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1119.193300][ T9] usb 2-1: config 0 descriptor?? [ 1119.622498][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 1119.628760][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1119.638902][ T9] usb 2-1: USB disconnect, device number 57 [ 1119.747562][ T10] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1119.898465][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 1119.908518][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1119.919904][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1119.932403][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1119.951274][ T10] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1119.960623][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1119.972689][ T10] usb 3-1: config 0 descriptor?? [ 1120.388109][ T10] shield 0003:0955:7214.004E: unknown main item tag 0x0 [ 1120.395206][ T10] shield 0003:0955:7214.004E: unknown main item tag 0x0 [ 1120.402427][ T10] shield 0003:0955:7214.004E: unknown main item tag 0x0 [ 1120.409491][ T10] shield 0003:0955:7214.004E: unknown main item tag 0x0 [ 1120.416483][ T10] shield 0003:0955:7214.004E: unknown main item tag 0x0 [ 1120.425679][ T10] input: HID 0955:7214 Haptics as /devices/virtual/input/input68 [ 1120.440514][ T10] shield 0003:0955:7214.004E: Registered Thunderstrike controller [ 1120.448583][ T10] shield 0003:0955:7214.004E: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 1120.547015][ T5902] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1120.595802][T19287] __nla_validate_parse: 141 callbacks suppressed [ 1120.595821][T19287] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3634'. [ 1120.615144][ T5860] shield 0003:0955:7214.004E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1120.615837][ T43] usb 3-1: USB disconnect, device number 127 [ 1120.633878][ T5860] shield 0003:0955:7214.004E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1120.732379][ T5860] shield 0003:0955:7214.004E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1120.744109][ T5860] shield 0003:0955:7214.004E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1120.756995][ T5902] usb 2-1: config 0 has no interfaces? [ 1120.764687][ T5902] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1120.775384][ T5902] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1120.783526][ T5902] usb 2-1: Product: syz [ 1120.787866][ T5902] usb 2-1: Manufacturer: syz [ 1120.792884][ T5902] usb 2-1: SerialNumber: syz [ 1120.799064][ T5902] usb 2-1: config 0 descriptor?? [ 1122.073985][T19318] netlink: 'syz.0.3643': attribute type 4 has an invalid length. [ 1122.358985][T19322] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1123.343682][T12881] usb 2-1: USB disconnect, device number 58 [ 1123.627818][T19346] selinux_netlink_send: 49 callbacks suppressed [ 1123.627855][T19346] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=19346 comm=syz.1.3652 [ 1126.140755][T19372] IPVS: set_ctl: invalid protocol: 47 100.1.1.1:20004 [ 1126.319766][T19376] netlink: 'syz.1.3660': attribute type 12 has an invalid length. [ 1126.988178][ T43] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1127.168690][ T43] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1127.189088][ T43] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1127.209428][ T30] audit: type=1400 audit(1760412271.886:973): avc: denied { write } for pid=19389 comm="syz.1.3664" name="mouse0" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1127.234657][T19393] 9pnet_fd: Insufficient options for proto=fd [ 1127.347423][ T5902] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1127.790151][ T5902] usb 3-1: Using ep0 maxpacket: 32 [ 1127.942495][ T5902] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1128.047290][ T5902] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1128.268345][ T5902] usb 3-1: config 0 descriptor?? [ 1128.690490][ T43] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1128.700861][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1128.710284][ T43] usb 1-1: SerialNumber: syz [ 1128.711764][T19392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.725676][T19392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1128.737704][ T5902] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1128.746786][ T5902] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1128.838016][ T5902] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1128.845221][ T5902] usb 3-1: media controller created [ 1129.158868][ T5902] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1129.165126][ T43] usb 1-1: 0:2 : does not exist [ 1129.185849][ T5902] az6027: usb out operation failed. (-71) [ 1129.202571][ T5902] az6027: usb out operation failed. (-71) [ 1129.208345][ T43] usb 1-1: USB disconnect, device number 125 [ 1129.243661][ T5902] stb0899_attach: Driver disabled by Kconfig [ 1129.254654][ T5902] az6027: no front-end attached [ 1129.254654][ T5902] [ 1129.265248][ T5902] az6027: usb out operation failed. (-71) [ 1129.271314][ T5902] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1129.280772][ T5902] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input69 [ 1129.295516][ T5902] dvb-usb: schedule remote query interval to 400 msecs. [ 1129.303362][ T5902] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1129.323485][ T5902] usb 3-1: USB disconnect, device number 2 [ 1129.351235][ T5902] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1131.917626][T19436] xt_TCPMSS: Only works on TCP SYN packets [ 1132.881886][ T8005] bond0 (unregistering): (slave gretap0): Releasing active interface [ 1133.126973][T12881] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 1133.188317][ T5902] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1133.236999][ T43] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1133.277024][T12881] usb 1-1: Using ep0 maxpacket: 16 [ 1133.286490][T12881] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1133.353173][T12881] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1133.364679][ T8005]  (unregistering): Released all slaves [ 1133.364879][T12881] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 1133.379954][T12881] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1133.389031][T12881] usb 1-1: Product: syz [ 1133.390164][ T5902] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1133.393414][T12881] usb 1-1: Manufacturer: syz [ 1133.403495][ T5902] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1133.408355][T12881] usb 1-1: SerialNumber: syz [ 1133.420469][ T5902] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1133.423217][ T43] usb 3-1: config 0 has no interfaces? [ 1133.438592][ T43] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1133.441689][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1133.448275][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1133.465701][ T43] usb 3-1: Product: syz [ 1133.469986][ T43] usb 3-1: Manufacturer: syz [ 1133.474855][ T43] usb 3-1: SerialNumber: syz [ 1133.488911][ T5902] usb 4-1: SerialNumber: syz [ 1133.489637][ T43] usb 3-1: config 0 descriptor?? [ 1133.599644][ T8005] bond0 (unregistering): Released all slaves [ 1133.713065][T12881] usb 1-1: 0:2 : does not exist [ 1133.723763][T12881] usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) [ 1133.741602][T12881] usb 1-1: 5:0: cannot get min/max values for control 8 (id 5) [ 1133.807415][ T5902] usb 4-1: 0:2 : does not exist [ 1133.826622][T12881] usb 1-1: USB disconnect, device number 126 [ 1133.896242][ T5902] usb 4-1: USB disconnect, device number 24 [ 1134.380801][T19472] SELinux: Context system_u:object_r:systemd_logger_exec_t:s0 is not valid (left unmapped). [ 1135.334861][ T8005] hsr_slave_0: left promiscuous mode [ 1135.346507][ T8005] hsr_slave_1: left promiscuous mode [ 1135.374581][ T8005] veth1_macvtap: left promiscuous mode [ 1135.380566][ T8005] veth0_macvtap: left promiscuous mode [ 1135.472535][ T8005] pimreg (unregistering): left allmulticast mode [ 1135.835500][ T5956] usb 3-1: USB disconnect, device number 3 [ 1135.842747][T12881] usb 1-1: new full-speed USB device number 127 using dummy_hcd [ 1136.033580][T12881] usb 1-1: not running at top speed; connect to a high speed hub [ 1136.043037][T12881] usb 1-1: config 8 has an invalid interface number: 27 but max is 0 [ 1136.137028][T12881] usb 1-1: config 8 has no interface number 0 [ 1136.143278][T12881] usb 1-1: config 8 interface 27 has no altsetting 0 [ 1136.258548][T12881] usb 1-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=8f.69 [ 1136.270112][ T5875] usb 6-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-ec168.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1136.321757][T12881] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.335581][ T5875] dvb_usb_ec168 6-1:0.1: probe with driver dvb_usb_ec168 failed with error -110 [ 1136.354533][T12881] usb 1-1: Product: syz [ 1136.377198][T12881] usb 1-1: Manufacturer: syz [ 1136.381926][T12881] usb 1-1: SerialNumber: syz [ 1136.387144][ T5875] usb 6-1: USB disconnect, device number 106 [ 1136.737010][ T5875] usb 6-1: new full-speed USB device number 107 using dummy_hcd [ 1136.766156][T19493] fuse: Bad value for 'fd' [ 1137.761894][T19508] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3691'. [ 1137.903169][ T5875] usb 6-1: device not accepting address 107, error -71 [ 1137.988319][ T5860] lo speed is unknown, defaulting to 1000 [ 1137.994107][ T5860] infiniband syz0: ib_query_port failed (-19) [ 1138.027722][T12881] mvusb_mdio 1-1:8.27: probe with driver mvusb_mdio failed with error -5 [ 1138.042045][T12881] usb 1-1: USB disconnect, device number 127 [ 1138.077026][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1138.086743][T19520] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3696'. [ 1138.097430][T19520] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3696'. [ 1138.161052][T19520] bond0: (slave bond_slave_1): Releasing backup interface [ 1138.269575][ T5875] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1138.342976][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1138.353275][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1138.364153][ T9] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1138.373317][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 1138.381804][ T9] usb 3-1: SerialNumber: syz [ 1138.436720][ T8005] IPVS: stop unused estimator thread 0... [ 1138.442931][ T5875] usb 6-1: Using ep0 maxpacket: 8 [ 1138.466720][ T5875] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1138.476611][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.487140][ T5875] usb 6-1: Product: syz [ 1138.491520][ T5875] usb 6-1: Manufacturer: syz [ 1138.496229][ T5875] usb 6-1: SerialNumber: syz [ 1138.512024][ T5875] usb 6-1: config 0 descriptor?? [ 1138.724540][ T5875] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1138.794629][ T9] usb 3-1: 0:2 : does not exist [ 1138.812350][ T9] usb 3-1: USB disconnect, device number 4 [ 1139.971652][ T30] audit: type=1400 audit(1760412284.646:974): avc: denied { listen } for pid=19541 comm="syz.2.3701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1141.088674][ T5875] usb write operation failed. (-71) [ 1141.216220][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 1141.241631][ T5875] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1141.265105][ T5875] dvbdev: DVB: registering new adapter (Terratec H7) [ 1141.283105][ T5875] usb 6-1: media controller created [ 1141.315182][ T5875] usb read operation failed. (-71) [ 1141.340813][ T5875] usb write operation failed. (-71) [ 1141.948232][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xDA, changing to 0x8A [ 1141.951609][ T5875] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1141.970711][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 4 [ 1142.011281][ T5875] usb 6-1: USB disconnect, device number 108 [ 1142.018176][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1142.029853][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1142.064333][ T10] usb 1-1: Product: syz [ 1142.164047][ T10] usb 1-1: Manufacturer: syz [ 1142.264621][ T10] usb 1-1: SerialNumber: syz [ 1142.329693][ T10] usb 1-1: config 0 descriptor?? [ 1143.717595][ T30] audit: type=1400 audit(1760412288.266:975): avc: denied { ioctl } for pid=19573 comm="syz.5.3709" path="/418/file0" dev="tmpfs" ino=2214 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1145.039013][ T30] audit: type=1326 audit(1760412289.716:976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.132836][ T30] audit: type=1326 audit(1760412289.736:977): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.156153][ C1] vkms_vblank_simulate: vblank timer overrun [ 1145.226092][ T30] audit: type=1326 audit(1760412289.776:978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.351295][ T30] audit: type=1326 audit(1760412289.776:979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.417559][ T30] audit: type=1326 audit(1760412289.776:980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.690421][ T30] audit: type=1326 audit(1760412289.776:981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.714284][ T30] audit: type=1326 audit(1760412289.776:982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1145.737700][ C1] vkms_vblank_simulate: vblank timer overrun [ 1145.968679][ T30] audit: type=1326 audit(1760412289.776:983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1146.131100][ T30] audit: type=1326 audit(1760412289.776:984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1146.154486][ C1] vkms_vblank_simulate: vblank timer overrun [ 1146.177089][ T30] audit: type=1326 audit(1760412289.776:985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19560 comm="syz.3.3706" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d538eec9 code=0x7fc00000 [ 1146.349578][T19603] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 1146.369812][ C0] Oops: divide error: 0000 [#1] SMP KASAN NOPTI [ 1146.370046][ T5875] usb 1-1: USB disconnect, device number 2 [ 1146.376065][ C0] CPU: 0 UID: 0 PID: 19603 Comm: syz.1.3715 Not tainted syzkaller #0 PREEMPT(full) [ 1146.376088][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1146.376098][ C0] RIP: 0010:comedi_buf_write_free+0x414/0x720 [ 1146.407292][ C0] Code: 02 00 00 31 d2 f7 74 24 1c 48 8b 54 24 30 48 c1 ea 03 0f b6 14 2a 41 03 44 24 38 84 d2 74 09 80 fa 03 0f 8e 66 02 00 00 31 d2 <41> f7 b4 24 80 00 00 00 48 8b 44 24 48 48 c1 e8 03 41 89 54 24 38 [ 1146.426923][ C0] RSP: 0018:ffffc90000007d20 EFLAGS: 00010046 [ 1146.432988][ C0] RAX: 0000000000000001 RBX: ffffc9000338c000 RCX: ffffffff88cbbe1f [ 1146.440941][ C0] RDX: 0000000000000000 RSI: ffffffff88c96640 RDI: 0000000000000004 [ 1146.448890][ C0] RBP: dffffc0000000000 R08: 0000000000000004 R09: 0000000000000001 [ 1146.456839][ C0] R10: 0000000000000001 R11: ffff88807b88f83c R12: ffff88807b88f800 [ 1146.464789][ C0] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff88cbbd60 [ 1146.472765][ C0] FS: 00007fc4b3ff66c0(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 [ 1146.481685][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1146.488251][ C0] CR2: 000000110c390002 CR3: 0000000034fa0000 CR4: 00000000003526f0 [ 1146.496202][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1146.504149][ C0] DR3: 3a810b1eb6134bdc DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1146.512101][ C0] Call Trace: [ 1146.515363][ C0] [ 1146.518190][ C0] comedi_buf_write_samples+0x3fc/0x640 [ 1146.523737][ C0] das16m1_handler+0x203/0x5a0 [ 1146.528486][ C0] das16m1_interrupt+0xb7/0x1c0 [ 1146.533330][ C0] ? __pfx_das16m1_interrupt+0x10/0x10 [ 1146.538800][ C0] __handle_irq_event_percpu+0x236/0x920 [ 1146.544442][ C0] handle_irq_event+0xab/0x1e0 [ 1146.549202][ C0] handle_edge_irq+0x3ca/0x9e0 [ 1146.553954][ C0] __common_interrupt+0xd0/0x2f0 [ 1146.558876][ C0] common_interrupt+0xba/0xe0 [ 1146.563537][ C0] [ 1146.566444][ C0] [ 1146.569353][ C0] asm_common_interrupt+0x26/0x40 [ 1146.574353][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 1146.580752][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 47 30 f6 48 89 df e8 8e 9b 30 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 45 a6 20 f6 65 8b 05 7e a5 3b 08 85 c0 74 16 5b [ 1146.600336][ C0] RSP: 0018:ffffc900047efa58 EFLAGS: 00000246 [ 1146.606385][ C0] RAX: 0000000000000002 RBX: ffffffff9ae082e0 RCX: 0000000000000006 [ 1146.614333][ C0] RDX: 0000000000000000 RSI: ffffffff8db032d9 RDI: ffffffff8bf1e2c0 [ 1146.622280][ C0] RBP: 0000000000000287 R08: 0000000000000001 R09: 0000000000000001 [ 1146.630245][ C0] R10: ffffffff90832dd7 R11: 0000000000000001 R12: ffffffff8f072d60 [ 1146.638222][ C0] R13: 0000000000000003 R14: 0000000000000000 R15: 1ffff920008fdf5b [ 1146.646177][ C0] serial8250_config_port+0x1742/0x5040 [ 1146.651710][ C0] ? __pfx_serial8250_config_port+0x10/0x10 [ 1146.657583][ C0] ? __pfx___release_region+0x10/0x10 [ 1146.662938][ C0] univ8250_config_port+0x279/0x3b0 [ 1146.668117][ C0] ? serial8250_release_std_resource+0x204/0x2e0 [ 1146.674431][ C0] uart_ioctl+0xfd5/0x3080 [ 1146.678833][ C0] ? __pfx_uart_ioctl+0x10/0x10 [ 1146.683668][ C0] ? tomoyo_path_number_perm+0x18d/0x580 [ 1146.689288][ C0] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1146.695166][ C0] ? __pfx_uart_ioctl+0x10/0x10 [ 1146.700000][ C0] tty_ioctl+0x661/0x1680 [ 1146.704316][ C0] ? __pfx_tty_ioctl+0x10/0x10 [ 1146.709063][ C0] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1146.715895][ C0] ? hook_file_ioctl_common+0x145/0x410 [ 1146.721421][ C0] ? selinux_file_ioctl+0x180/0x270 [ 1146.726604][ C0] ? selinux_file_ioctl+0xb4/0x270 [ 1146.731718][ C0] ? __pfx_tty_ioctl+0x10/0x10 [ 1146.736463][ C0] __x64_sys_ioctl+0x18e/0x210 [ 1146.741207][ C0] do_syscall_64+0xcd/0xfa0 [ 1146.745691][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1146.751561][ C0] RIP: 0033:0x7fc4b5d8eec9 [ 1146.755955][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1146.775540][ C0] RSP: 002b:00007fc4b3ff6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1146.783932][ C0] RAX: ffffffffffffffda RBX: 00007fc4b5fe6090 RCX: 00007fc4b5d8eec9 [ 1146.791888][ C0] RDX: 0000000000000000 RSI: 0000000000005453 RDI: 0000000000000007 [ 1146.799834][ C0] RBP: 00007fc4b5e11f91 R08: 0000000000000000 R09: 0000000000000000 [ 1146.807787][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1146.815738][ C0] R13: 00007fc4b5fe6128 R14: 00007fc4b5fe6090 R15: 00007ffcb3530608 [ 1146.823692][ C0] [ 1146.826689][ C0] Modules linked in: [ 1146.830564][ C0] ---[ end trace 0000000000000000 ]--- [ 1146.835995][ C0] RIP: 0010:comedi_buf_write_free+0x414/0x720 [ 1146.842052][ C0] Code: 02 00 00 31 d2 f7 74 24 1c 48 8b 54 24 30 48 c1 ea 03 0f b6 14 2a 41 03 44 24 38 84 d2 74 09 80 fa 03 0f 8e 66 02 00 00 31 d2 <41> f7 b4 24 80 00 00 00 48 8b 44 24 48 48 c1 e8 03 41 89 54 24 38 [ 1146.861638][ C0] RSP: 0018:ffffc90000007d20 EFLAGS: 00010046 [ 1146.867686][ C0] RAX: 0000000000000001 RBX: ffffc9000338c000 RCX: ffffffff88cbbe1f [ 1146.875637][ C0] RDX: 0000000000000000 RSI: ffffffff88c96640 RDI: 0000000000000004 [ 1146.883586][ C0] RBP: dffffc0000000000 R08: 0000000000000004 R09: 0000000000000001 [ 1146.891536][ C0] R10: 0000000000000001 R11: ffff88807b88f83c R12: ffff88807b88f800 [ 1146.899483][ C0] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff88cbbd60 [ 1146.907431][ C0] FS: 00007fc4b3ff66c0(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 [ 1146.916338][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1146.922900][ C0] CR2: 000000110c390002 CR3: 0000000034fa0000 CR4: 00000000003526f0 [ 1146.930852][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1146.938803][ C0] DR3: 3a810b1eb6134bdc DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1146.946755][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 1146.954123][ C0] Kernel Offset: disabled [ 1146.958421][ C0] Rebooting in 86400 seconds..