last executing test programs: 13m10.951034748s ago: executing program 3 (id=592): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="020400020d00000000000000000000000300080080000000a3450e76106382d6c4a2e79f81ec0578030006000000000002004e21640101000000000000000000090001000000000000000900000000e003000500000000000200"], 0x68}, 0x1, 0x7}, 0x0) 13m10.837602904s ago: executing program 3 (id=593): getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0xb, 0x0, 0x2, 0x7, 0x8000000000000000, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r3, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x2, r4, r3, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, &(0x7f0000000040)={0x18, r3}) ioctl$FS_IOC_READ_VERITY_METADATA(r2, 0xc0286687, &(0x7f00000001c0)={0x1, 0x4, 0x12, &(0x7f0000000080)=""/18}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@bridge_getvlan={0x38, 0x72, 0x400, 0x70bd2d, 0x25dfdbfd, {0x7, 0x0, 0x0, r6}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x200400c4}, 0x80c0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x40010, 0xffffffffffffffff, 0x2000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140"], 0x164}, 0x1, 0x0, 0x0, 0x400480d}, 0x1000000) recvmmsg(r7, &(0x7f0000001640), 0x0, 0x34000, 0x0) 13m8.951203646s ago: executing program 3 (id=602): r0 = syz_usb_connect$uac1(0x2, 0xb8, &(0x7f0000000100)=ANY=[@ANYBLOB="12010103000000106b1d01014000010203010902a600030156c0020904000000010100000a24010101bb02010211240601040507000a0008000300020005052405060f0f2406020504020002200a000a00040c24020203020250800009010d2406050203078887000a00000924030101010505"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2000000000000046}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000480)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x81, 0x1, "d6"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x83, 0x2, "81f4"}, 0x0, 0x0}) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x0, 0x0, "ec9fe44d4dbe56a60274fcffffffffffffff14e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e006204df635e731a5bfcf142f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd400cfdfe756bc00d08e36655c00"}) r1 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0xc1105511, &(0x7f0000000040)) syz_usb_control_io(r0, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000980)=ANY=[@ANYBLOB="201532"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f00000009c0)=ANY=[@ANYBLOB="4007020008000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0xcdf9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2000000000000096"], 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=@newtclass={0x78, 0x28, 0x200, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x1, 0x2}, {0x10, 0xf}, {0xa, 0xe}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x21}}, @tclass_kind_options=@c_cake={0x9}, @tclass_kind_options=@c_tbf={0x8}, @TCA_RATE={0x6, 0x5, {0x4, 0x4}}, @tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_htb={{0x8}, {0x8, 0x2, [@TCA_HTB_OFFLOAD={0x4}]}}, @TCA_RATE={0x6, 0x5, {0x9, 0x5}}, @TCA_RATE={0x6, 0x5, {0x3, 0x80}}]}, 0x78}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'ip6gre0\x00', r4, 0x29, 0x7a, 0x0, 0x661, 0x50, @loopback, @private1, 0x1, 0x40, 0x1, 0xfffffffe}}) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000080)={0x50, 0xfffffffffffffffe, r7, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) syz_fuse_handle_req(r6, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0xb1, {0x0, 0x11}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000880)={{{@in=@private, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f00000006c0)=0xe8) syz_fuse_handle_req(r6, &(0x7f00000063c0)="16069e0731a5870b5ac65bfd9b91a7e716653baf3284123c3d79c2e4623bfce3cf6830b39d39dbfb683892faf63db2e5bb0b1b433cf833579e74013b4ea8f355a5c09495fe8c61d28cd02e45b3566edf12d57cffc21af2f5bf39ecac0357fc82209077a24db337c12ae02314029add5707337902ba33e57d9c9bca21ed67b70af77773116c4d879db6f665fd463b6e6ff77d65040bbf141cf712f4836fceca0f8de20a9800761cebd489a61d91a570fd4bf00fcdeb8427ae2f6e2aeace613460050b0af76fdc4b35d2594ea02f66e0b7acd3ba07f273ac3c053c374d381dd9b8015062228010ef2279cea2f09213bfc9a4a12f3dcd193f6834fd4f43b2f792516370778c0de3e98295ff03cf0f9eed3ebccc73c41cb694fe4d5b31e1c58c6f0bf3537536896a98d2ff60c28e2c9f1ffec24da84f0db2b9adaee389efdafca1712ae7442a15d3730442f2e4f3b5f52aeb29b85439916b08eeeb23268554fa740f8cf9ed82002253f67041936c2485562ce0e48ed8eb7dc306e5de779027b3e59f8c4018a2858a81c3cf3f46396b8a1f2e9f141d142486a673f036fa03ba16f548eb03c753bfc6d8afbfbf7411cf219509de39e1c80426eca62b7561794947466cee3721a58c7424108739bdb6925affb6963b5fb3ff06bbb154ad3ada8dc8779c23436dc08af46cd2dd7f0872067a082ac4930e39cac949c94c00334cc58e632d9ea823eeee7c2b22a6683e893905988ad9e1b36a65cca856667d11e86a7f320fb7378c0ea09dec63285d22db6cd05f60fbdd52f2e45e46ad52ace1e7dfd489e8ebd3ee2dce187074029b4a69eacafb882c8d40e0ed7a0591e3a51a274bb2e441f1c7c085df197763b54621c117fbe28a74c8a91f06135e906f3226f5a82169269411972c12c7782c3e78d96dcdd999a0aaa884559bb9e22038d17b94e15edfc5ef34aa1ca0855932441f7bad5a28f5081e6702896eb2bc98e8ab6c7869cca4b59955db2e7c3be817874e8a6414269f4e9f6739dcd872f1c1ac515baa1e4a65f62e0a4dcc0186a472a7baab8116fb386f19894778809f1063e5d2027740d089960dcf2b0eafe6b51e53f31dc5f2368caf1dae760e72162b5b90d0520dea6d659d95e4d92247b0027bafb51e414e4a37dfe3713e7e814cd9f19f60aa5af8468860b05dffd203d380c07cf59d74fa9f9e2e891a10bb470e80a57251dffc617d1b5ef8a31a4ec4d7fc9a91e67529c538f1a10d648cdc3c7318c4bee728e64d8606d5ddeaff33899fe65ef031c05295c81f2c743d61a5decb74270fc867b36a6e4ac388efd29a290ebd24131cc430890b4a097d436e3c88a97444566aa5cfa8ce3882020bea03acc1a82cd97c1891fec0f8859a282ec7ab3f42cdf5fedeb118fac62c8eb80abf665a35c100f28bc6343d79050b4c1e7253a7fa95a9a1be66970b442472e0dc073f584fcf2359e4d299d5d968d0ee9730359c8de094b56d660c38a27ae63f5302829727b2954e87e567ea23fbd9f598d82903615729ea90ab0ac6e75a225031c972ed1eb670a7d2b0d501714df4be97ca9c4c9dcdc0af4163035dcc3cd7ac08ff387330270db0da1801f907f43fac0e7f1a6c2d6317a2cedfa9f848a8d999732d7928d74021e0c295b6ade601b330dde391d04d380ad218a0271fb00aff626a2fbe4f4077c35931527d66f77651c8cfc0142e9fa1ca2d4410e36e4c3cd03dc84d55ff0c298a772cbcca8a58ad4bab2af1160a52185e0072c0b267e68c973254418f246b8145ce6cac8bb19b70d4130ea578487b6d927b866c2514026839b569bff7acd93fb4244e188e8d14628c746a4ab9fbf0377a90d14d9e3d8b73bdab1d136c1db3142f1e19818dab8642e2201b2c757358d304f0f9a530cce0520627c2995ecd750911d56ca6a7423501e369c9b26883510388731f12805f987e1c20cd47b1516bf0c0de7434998f0ceaeb4dba7b1563cfc1f860bdc58566979dd818ce552f1de8dd1835e31d2ae0d72b191818f479531a76a1cc3bbbdb3f0d965fb203e0b61291c92da846123fc54d3925101eb13d3ef4b2c8a25693cf99c4f01a6b16949711c831873f570a48d4105aa15d1a05c16ec4cb10b35e7a42d16036984adeb490fc6943491f530788d2935bcaf8d7330d044c7b49ad82d71ad575235fa7ad37b3366d8e8a57ac1078701d80aba7f2f1686bf02faa59f4f7e6c710166e7677170c6127cab49321cf0d97c3259bec73c952afeba9130ed0327b53d815faeddf8286aa3459c58fb72de2a9d1ec9e2599154159631fabd03b04b2eb67a7e2bf70080ab752755d6c46b8e85ac7686db35002e43e31ffa52d45816c3c0af32a3e503d123c1664107f4625afa962709370f1f858917411c7a9e1eee4123afa7c4be18be2980a8b1e737d10bc4d8c0154f77d9f2d53df51796f0b49700c0124e62e0f56256e660262a3bb578cd78d049c28ea3100c575e0d4561e0002917ce9f4148a942d98aee6abd348152728d31367752d7085de35741562bf7a2638dc93bd352895834d7b0fd57aff003d124cc6eb2f67c16553d737bccf678f7fc5aceebe74f547f174947ba7d616bf823f755bc298678e215e7a86ca2653d337f4245a57f02d02eebe3031787fba5be417c4ac28099257cb0118c7d54cfcdd42e5110ba207e490c11b991743fae8ca92c64ef31c4d0a2a04faefcd062fbae5f674cd85148ac6bd209852611ebfafd22df37eed13466bc5b16a101a55092476f290fb6898550a50c6ce9b86e6344f883019131e6345fd4a0e349c93fe3d86fd6f55cba922223e2ef19844a030eea3a5d97df6ed72a1a925b9f4305e63206840bd2374661d6b7d1a4ee8a28e15b87449e0dabc96010d0904e7470f50b2e78e245435bf32c66a56e48216a7631c5c75fe3f747202a3dbe766d478ff44b22b0dcf990202663102c3ffd32e855f7613d9b064901f4e4bd879b6b5b53fa52e05505890e2760da5a14df88a8ba2c3a51d2edca5ca50ee532f243b063a3979defb57d531593a2454d641468d3890a31f815d744d6065bdb394f84dfcb24a437138f1cf91a2ddbc6a9364178c2cc5a46127ffc87cb99a68718754196c0b41656feff12b26050979daf2c8f170e6c3d5aa0c360720c37c9a8d316a4ba929ed46562238027497c1f6ded44e080261aaf9ff45f66f5736bd395d7224226d2397e9cd756f10e1e470212cc3debb62cf5840ddaa4617ea209407d70e63d5abc3fa6a37f7a6585b1bd439e2e398ec9cf2d32ec32ff74b71e137142943098337626820d228a6e50a41985830b3320cd53b7a62e76d829aa627069f8f1c34c4c4480e59b69514dc41e1791462d66ca74f649beb79771b778163f5dd83d311d2d6c0ffb72665975415825e0d237bc5a788824a0ff4defb95e77e202653bc98a69a656f4c728611dd39f94e2431a8dce9c2912ef21988f7730f06fe9f54d121867606b28fcab4fa36bda014f2599f8a42d79c3cbae5294ad642eab232826d4993f389ad9922a6e979ed31cf1fa172c22c66424131403feccbc8c38bde43e8fe5203f22fb028ba2aece325bbd1c3233044bac084b6a97d489d045fd1836797888f2572eaae49022038a8e6882d5ce25e29a44649e19e8680d6726f39377ee02da7203885d16c492d67a03d8a59366872fa1c7c02980e76cd8063012e0bf9d9d8eb000599de8350ae40be1a8d230a0c3683ad67d624112adef5b6fe777b216cda54ee5fb44dd3079c6fac4196bc47d9b794e87d231b149b63d7c9878401e90ae29a2088c6fc3a01ad9497eae5522817bb6bd51fc4e5604c36756d59489afcab5f929e02365df869e088558514a440a2c9ac1118ca58adf991a0010d8e67217dda917d11161bb53dfe7c2f7c0e0608c4b3d7cc832ccc1a801b37d953ef82b499c0bfdfb185b269310e7e6da67ff572a8008a7ec89690d72782a6a67d8d2d59183c9d50fc25f3a59aa86ea20dd9ac752f88f976e94894bb800941fc2480165fc72e0852918c9f03d788f46e3466170ccde82f09cb31851762b8859e5e76e7cc5a8adf1db365d00d7e87ae64d3225aced8943bbb59467788c9679960532265326ee2e246a8d10d1bb7833a118a375a5eba587646c18d787dca530e50e355c0ff515deff7509ef544ba816e1861e0b5b41b16b7d59aeaad6abd9c53bb9d89746e5ddc80b4e3787a7a75287856e66dab716952aef73aeeb0d413e062ec4b6297775274a06c10d0f0bd454ea6235f1bb2e3e7256313c7200af9b0d2e6fb50a262c2a06a4d3c3bd09f532c5d54302877202a908382500da49f3a61a51d856c45d4c6942e769031586145d25d3f47ba6fe7cce45a143a8cb70b1df071ea5855405c19bfc37c8224826b3ba5faf772cb44218822f3954b93c2cddfefa251b7fa13aa000a1feb21397b5a3f414f9caa5a2f3a0bfc9f459fa1690e4d561b8b0e365689f15768baada5078f79a9010f80e9807f47909886288f8970949b8df6a94bc2b63b8b6279afcb93f9c2ab32f34cdb3c8c28724b796bf9e9ad6c113be470476dda8e8d0717bd6f796dfd19fe5b6e49c19481a5e08ae78a0789a5596ade77ce628f174bbd410dab88c1b871838da38307aa712ee75c1d8f2ce48c201c172ea76105bdc58245ebdac45b0ca74569d0e1a2cb7a7e0c406c002130eb8aa2caae79c373cb8a222284876a9c081beafba3991086769040408e5a89055ad7735f4dd6219164a775d72550a86c481b6ca067665b4820cc968fffaff19deb57dcd34a614df8bb48e1d347d1462cfeed6e10f737ef855200959eb4b7c95382c2e8f519388789534899ef41c5950ea9f6c4be99e7e2ccb97a50dea4f63ac21082eafd3400ffdf467698ea18b52f8c471d90fc2b0f62ce8323bb6b44e151ab5b7b30d051c2c308e7b352692dd1caf72bf3bf9fb893a13bb223c9c27003e6013765b25fae90aef30263872732b998234029937c69ae29c0496fc204039b24058c0b7fd471f94307fbce1edeadbc85709f0d8f35790f5d1620d47c58e0d6872e19a8fa00075a55102956fec023e57b9ca61402f8b11c2434dc1e381a5c73373fb0e97ed646063187d9ea30ad515e4b464aa87e96be68880479890a899f465aa21d1a0268f00ac91ee98b1ad3cbd04f44ca48ac0dfcc18278893fcb31e0eb70818ea40bf37c3d0bb619817626cf0c190f25e00130b0891f536dad5cd37cf8d0b2fe1ae01c14d943fc8b7df7d302266175680a795dc8792288013a0be47edb820e7cea6f48f63eb963d9a30fdca4bf3b90ecab17db2a81fdcf0586f8f10b97e0184d477fcdd60f1d93921add766778935faa387532482e0ff6849aeaafb7bb292dbfce203cc72b65644cabe871d09694e6b1beffcbafad856c79474889d89669f182daf2007ce6e9eca427eb39c75944854817036949c8eed6b60ae0e64b2b6e21f510f379c713ab3b7f9a5f46c6e434efb03376225a4eb0a2b6c0474e3d7d43d76767bfac3e206d46cafbcff56363a266496284d24993d6439cf6cb87d4ec013bce6c135a86bf354e02ac6150b84b88789d789fae8c8cc481475ac10581581173e6993f4f06d21a83fbe3858223256519ce6bbb48836f2263c8220df683f3c44ccd44dec4bf1671ded1e20d52b5c50781fceafa667fe6c30c646f41c3946e12be52d5a03013b20b50179e763ab7a0a6890e110618b4b9dbd60ee3f9826da13ba3e29436aa33480e566c1d850265e748714a4fcb4b4c29fae88807172c532142f061e18f518e73b66c20cbb0755aa28d95e5417aab931e219b0f6dea5c3dae5a7bebfa77b2faf8bcf03a3d3113a0e34faf4a888c5c28f1d3f5ab419e62e1eaeac0fa3007e81b9d56ac71d49ef40bc2eee2e5f69c38bb9b368e1a4654afcbeb92bb0f44638b2d9fa4ff999bb6ef6c4f88a74fd165c476aaf3126c3bc6bdc3ef8b38621b4fe6b5be149d6c78071264cc9e5c1c642ffeb78fd6940d056c25c87ec78334d0d4ac524c8e0ceee3f5d8c7d2388e957951da85418ffb1d9c13ee3d2547962508dd76a48a9ddd8dda9611cfad7d389e540550ba320678fe7372f3338853a4a4ef2e1af2f8b5675405b7fba9ce17a3ae5cf1ff2356d00f90780103dde8f6c45cba97c28a068dd48c97e3bcec8eb22f9b78bcbad28b42bcf318bdbb0c3abbdadc640f51bab0b2b4b6ede351d5d00d05b3612dbfe10aee408a24ede9ceca110e7d6ac554888d5520a194b36ef976d09b7ef9fbb795a10acff3b95e778b74b470bdd8f7181fa587dab606801c081071dad313adad541b765a0a7a82021bdb717eb8424b2cd822e673accb828ca2f7df3c6cd93ea9346561ca5eb3c74490a7a405c3db116e1e25d5a18fdcfad0886be410e6b8a31d3f29902b02ba6acac5c80e07faa9d3d79abb9092a77fedcc3ac69de40fc4b76a03680ce4374ee01769e12063d1dda40c22d4b6015b84f6961898a121105f37b18a145b7e8a61fc3aef6d1be4e78c20b0159535a2f29ecab6c9e56af3af562017a84d12f143ce5b782aff4c04043ca9d06cdddc595a6a52755cb2c4c9ebe37cc40a9587c098af6f51f31073f09aea0b6107ef605b5d0f2652d0163c5c5e48b6127d8276dd27b9c106903b66327d0e4a892a4c0e2a9ba42eb91a180a99b238838a3740409747a062bdca638b5cd54ac5a7a5100bb0973c8d23e66a8abb07449f731dac1892b54b2e64768db7d96c73c15a478b11d29ffda8d2077e8a89fc6014cd0954b4efe7e48cc6bb1b27f4544944d0bde3282ac6b8a9d71a4e6f5ed85f6d4a828ecdfdcd6d3db0bcc5fe00005eab6c291706795c3e6144e4083e3cc801db5b9bf968c406c8a9bf14df1cd5f2e50c8afe18214a61803ac30d28fcb15e3967a6f2a590533f068d08db107b90fb8dcdc5a1452aa0ccd9df2b25a737eb590a8d63037256dacdcd5d86fdaf5768b91afd6fbcbffddbc64faa181f0bb3214c8be92fb8d8fff1d35e13043bc6db9816f50b40180b5702750b75ad95426a02aa3ac81d156d08024359603af4d5f3e7fdc1893d3be9f5f6842bf2378dd8683fbe030aa6b1945196d484255cedf7790726cc98270173ccb92668b927da472836d3672b57fb525a058bfe743347bbef4862f4793372912f6af5680094d62df6fa0702f799eb333d33a449bbc4b28bcc27a1248c466d690179c950f9dfa79b016ad93e08dfd28ae2642d2383f1ec880e0118d96ffa81709af8a00198322af9f0028e96024bb38e432304cc4a008b1b2ff65a31110261833738d22cd2c7ce79f58a55b2f8d12dae2962efacf1480d460b09c8fd16b038b973b25fc363761e9fd168c8f1cb8783183d873dc28a9a863bf09bae6d3cffc5ed7bf18f9e14dde9a5b98aef370cb38e2bfc9bd0d0839fade2466f3e540a34fbf2c7636c96cebcedb89fdfca798694d3c2a98ea6f47ce64801c80229c964129612f0aea6fbd7f5732953d750dcdf16aa7850f372e86f4a624179a6451ef156a30a7cf6a9bab78e4c5154a280e57eb074b328760b5826caf86289cb45cda99ca9f7e3d56f326ca12f3c46d46c4098aaf285fbb6c4f7b4706c5f756dde9a984f6ae35c8261d6f68a7077120b622da6794f356082dc2dc7544d51ed444bd266c02fdcb80adcaea3644efb7a0856c87c94902e8005a50fdc8f8ccd79f5e9001f21e9332886a050f1d5514b83d40ba459b2aaa17d797a088378553a75c34dd47bcaa0a5629f08778697c282ec4ed416132fa45640baf81ca6f0ee6435b518bdfcaef9b9ccc875b0fca847e5cda079cbb80da651cd9530ca1ccc6c442158f9c8e84253d09d70dd510d9cf2fc23148e12f91cea9503c30db9ff13bc4ec269cd5c1cf722027bc6fee795048ccd4324e00d3c07c3ac0cbf5009f5ab633f3852630a22b9996aaaada2fe90b4a260a148cf4f735b31fb8db85a948e5998a8446ca00568991dbe3e211e7e1e8fb7959648d509f194a1c5e8e880d5093d455fbf74ffdb60190a7ea056ebdcc19e81434cf546426c52f36c0f5d53977256ef1b221b2ce30ee9fd91a849559fef842a8e375234f1dff1abcc9855aa2341de5d5f4d9bad7b9fdb2245991e7a133aad71463d035a50202f58e3c8676b527712b3f2794780e61874b2db8e13e6cbe47569e3ee8b68108e2a5d231bbb7566f809ee52ef969e907bf0c71a032c5994403b6b3dacea4ac44f6c5a9158db3367eb93d7e297d282cb12bf0a658793622297e8b976d9b1a0da0faa231e9d4b97818743e7d33c8178eb4137f98b1079551ec6e264031e03cbea9ef67c42f850a11ee4d8b66a63cb1133610a6d21a933b3328a0183eb7f95487f1c12126db2b10a8ec881d0313bdb67c75f959f1ebc92a33764558f9a0140597e8bd5cc32f5abaf12a7ba000b0f91c2f0df154ad6427e8fc038a19236ef8f5bc48d006ef8476d410a105be49ffb16edcc414ad5084ef92ba0aeb1556f6aafc854f4ee1183c7764b426788ff5f8b88d6c1104f0c11eea4150fb6c60d2dfad00ffc7aa8a333e03422c35a7042e3d8d88b8731785e85a9bb0b673b4a557126fa3af742259145937e34dc0d9676e101f9bfc68ef011bd316052b9ffae16c4316ce895fab6154b207fb00812854def2bf16e9c880863efe712fc932ace28b473b54d31f9e888c720414372eb3227865c17cbb42cf2c61ab3d5a1aebad6d4d97ff2de0b504c9f71e5b7edb245465045554cf165773e148d33b099a092544e14561ce8a3ce2242acde0c9b98e3c895c7ec654a7c38243f76e097aa3fc6491aa253dfe1364b1111d78f9c131e19d049d7a29094c45eaabfad1a66eb5f99c8f17be8d11fdf61e210bef0cecf35def31115e36a8a296dff6db1dab3530de1e9cc4b54d2cb421303bc1b6e423b8766a6e1304927b31de577394c7c36d3114884fe7a360cc96b78dc44f6db54df4d4699a9a20dd476d9d3656a2b640e916f8a7edcb3e55b49dff5e7d3da249db2caccb2a0900bb152010aad92a35e064a947d7c683c7a9301fdc7e62c7faa5d78f49d1821174a1246c921c1028cf379d584ad5670d370a6dc1b2187841ff5e63d8c4292b96cab01bdf0ca5bb2270447d9849bfebc2af7f52601109b5db2d9ca3220e37a288a96ce082adac8ae5225342b617b48cbb3cbb84fe972b46738c681b68e187cb47e6d65124340b932ba0b42ce9d209dbcc96deb0fb0d77017715e24f4b4e16af92d564f987e740001cc509406338b6d8e13563de816ff3932625d89c5fac7e2f4dcdd16c2ab585edafe9afe027329f8dcd1bfa4ec401e546f81b9be41e36d2c24fa9023d90ab54ee592ef06f58dfe9b091452d6286ac8e4e832a1af51f8f789de673cbc1c5a2e02f8c27e39ac6990dae09b601aaecda9aee073d781caa405bf5f4114051b3375256cd63bb6c5b43ff28a4812850988efb306960a2856e21a233872cd2f6c6a0b3344b57f47a03c3b5857ead89497b8a6e0a6d2a6b450eb09e8ede81b6692af0a748b44c4d55e5cef0b2e9b40e30002136390ce9369a61694a2ce27ca966d7cdb39ce1a0d68307165ec5634704b71638fe02a1872f8f514e471e311155e5187eeecfe4b22f8c487092f7e4f4a3ff267a1b6acdfd9eb2ce9fb20357a79a1ba203a3eb012fa07c88c44e28448bbbf4c0ebc6a35699bae1c1c4473d07f6253694beadd018ae8a51ddaac5fa70ccbaf023aedc60cd561be3cd38110b1ed7eddff96693595c2e6f5bd32e1c3d5323a07ff305dea1e6704bac01310720b29c214389344e3fa5da9ab9313290439954edd70940fb91b472a1a030b4ee895971c885fdded5ade6aa59b97e061f7d61dce170e6252df0e685232126cefdbe8629b2b95a166398404d9f149cd687224677c1d645a9536f336a23dcafb75102279ad86ad21c315f0834769ee536d04763fcea6b18f035f58c4004bf572031e5901362e3b3cbe42072e5f4b7d9012a19bda073c5f61224b9ed7165419a70131ba141e526acd304f09d213044da832c6d30032c88a2cd5a1767793b095e008f961f1aece028cc8ef2540ac6a4b3db9013c3d6b720440bc024e60afdc59ff45a58cfe5c642e773aee925c6967f2c7400f24072a67f3fed09b97f34cacf08514d69fb249fcb3588e37e9b865062eea0bec44caceae5457e8b465b31bea8f00404dfec9b927e726e2f44c0b4e1fa802a757fde76d45f227c1d68d801af6948f69405f12daea713d644ba18ca1ff9ca247cf77497d4af83e4f47ac5b85a3964f8dc7b3386d9750d97f020c2eec67f209eeff5835ffb70f9cd4caabfaab9d4c0977a576446e3a11bcc34715d80ca18730cb5b083296cde6e21c6414aee3b03786790089b7419aeb69d5ae9063ac75b108b330cdfaf81e557d31c01e9c3bb91ae14b00ee9e96a0456666a4bc84dfc321fbcd5e2ed13d1f31926cf2079739a17e30ae9d12529bbcf9f32cba4e70587364632ec3f5d63e4fcbcf2ee7cd6c489651ede7758a9da9e5872d3d80ad92fa14383468991e5b71950b70c2c4a184678222735ddc6ca61e37f93f34e93f4d5839c53b60e75aca79bc62d4eceecaadca8af22a1358457cc46ddc5c5d57997375d82976533f72991ad91bce2782b3a5476212ac1552f9395eb6de3d224aa5560718b7bf53c75d0115dd2b60939b493649f07241f1839775bd5f94fdf7b3355196437ead004dc3445b7d9d649cd1af670b1e0d770cb3bda45d2b6f4d1ca069ed9f2d7d9ff99d6806d4a5f481a0c8e432a176712618d5aa7b81a6401993214365062a0d87e6c13fbc45482f48c6bf68bdd0d436251926606400795bf0d4742167e2b63290d149771a8ffb1d1c3eca9165c5711b6694e9d81429a81cfb1f37b9e170953e83b4bb75bd6633115dcfb4f8414290f5412ec98bcd297422d35fe7054deeb2c0dc749a1ad7182277b542834aee2ab2380ae1ece6b62ea7339cc37f4a3415bc51333a37606fe3b76cacf8f44ae520665e3e4cf3f1bc96ce31aa06113b18ac754c1e99591cc8e7b30dc6f187fdc0419619f70d51911729fd030d55dfa69756f2f21998ef6b05bbb08656d484344f472ad2e7ee60609d2fccba02af3d5e5167a8c1544783fd3bee566abf94c8fcef91327c0b66acd5d59d257f7483acf7d09a937f5f26710ba933914215e33f1bef035233842c5d06aef75705f290db98745e580501802158f632e75b7754e9220517193dab915b00b9b57b65f3cacf2d3dda7679ce9662e4d1337f264dbc3dd4f59a8a778a84a2590c5dab9978018b39d705648bc29f5c9bc8ec5a068fc6677e3eee6ce36e7987edb5931116a46f91f4a2618e1567ced6c32405f977628491eb93cb67a938a8c4d409556be5aa2da58744fa589bc6d76b4e6352a23ef36ea895a29bcfe9aafa06ff3bffe1f242b030d456fa07d27adf671b0ad38bd2effb208c7121491d0572dd6b3073970ce3ad6df8aa2871a0262660fa7a764b9be28462e3a5b37955d6a640bd5bf1cc948d09391f030848f6cfd2c4aeebb3c886120fcde340c00cd471e3bee7c808c88e3ac81890b133810033d1efa2612b94bba1c34042a3936bcf11b53ec6b622a1347817bed6c23295b83648f961d55ea9fc05bcae02ceb44c", 0x2000, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x90, 0x0, 0x6, {0x3, 0x2, 0x8, 0x10, 0xfffffffa, 0x0, {0x4, 0x80000000, 0xffffffff, 0x12, 0x4, 0xdad, 0x1, 0x2, 0x6, 0x1000, 0x8, r9, r8, 0x40000200, 0x80}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) geteuid() r10 = openat2(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', &(0x7f00000003c0)={0x20000, 0x40, 0x5}, 0x5) r11 = syz_open_dev$media(&(0x7f00000001c0), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r11, 0xc0487c04, &(0x7f0000000700)={0x0, 0x0, 0x0, &(0x7f0000000480), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$XDP_TX_RING(r10, 0x11b, 0x3, &(0x7f0000000400)=0x1088, 0x4) sendmsg$nl_xfrm(r5, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x4040}, 0x20044000) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000ac0)={0x20, 0x15, 0x1, "e7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_disconnect(r0) 13m5.568709386s ago: executing program 3 (id=623): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000f00)=@nat={'nat\x00', 0x19, 0x0, 0xc0, [0x200000000e40, 0x0, 0x0, 0x200000000e70, 0x200000000ea0], 0x0, 0x0, &(0x7f0000000e40)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x138) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) fstatfs(r2, &(0x7f0000000200)=""/83) unshare(0x2c020400) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0), 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, 0x0, 0x20044804) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1000, 0xb20}, 0x48) syz_usb_connect(0x0, 0x24, 0x0, 0x0) move_mount(r5, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c0001800600060080350000971b02"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 13m2.427704363s ago: executing program 3 (id=640): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="020400030d00000000000000000000000300080080000000a3450e76106382d6c4a2e79f81ec0578030006000000002002004e21640101000000000000000000020001000000000000000900000000e0030005000000000002"], 0x68}, 0x1, 0x7}, 0x0) 13m1.881643321s ago: executing program 3 (id=641): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000380)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0, @ANYBLOB], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="00ea0edaaa91ab13e0471d998a2663f299b17a2a0f934393be839ecd863300f1830879f4279af7ef77df5930f1e8598779c664a3c1e55dc5008838d36628a45e028c621e750024be878f34094097f88bbc1378eda60fecaf0577c5349fd45dd40329b99ece26ed1c4c8992a225501b4b73c94e981d898d3a46904695176e790595178cece15f330b337119858eadcd1e2b00000000", @ANYRES32=r4, @ANYBLOB="01000000000000000000010000001c000180061414aa080006000100"/42], 0x30}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000800e0003006269746d61703a697000000005000400000000000900020073797a30000000000140ffffffff0c0001800800014080ffffff0500140002000000050005000200000005000100060000006744bf015f66af53c9bea42a79bb96d8d53867bd39b29997b2fa6c492ee927d6ed6f82677b63e3832c06000000cb1d214bbf0b18ac08bf27f9ea11b971d414bf00"/172], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1400000000000000445163b0449de7700a000400000000000000000adff9f0a5dc4259358b7b1b3dacc200bd1654105f5e65b3b776086d0f6431930024be03326af82560dd986035b7145bc8e875c778f8402bd7e50e33b8f9bdd9888c89d2aa214025"], 0x14}}, 0x0) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000050011fcfc505230d81a8ddebea88d38fe418bd61b7b40efc8079473e76b80f89c2fb79803a7091c617f8f0476cceee025aaadaa29fb8bcfbc0047e0876d5388f3e32aca152635384fa9f371f5c49784e0c00ed4684fcf096bef712253fa3e8273911dfcef6d389ad4e7af204c96cc1541305078b7cb86f29e7ab25d0182da772f17ad4178f2a23c115f1e6450865a9eb53604c795d1febf02bd35bb1369296594bd997e7ab532e1fed2ee31d50d0276627d24d4b7270e95ee3b787247c892dfab7b9b66"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="440000000206050000000000000000000000000005000100060000000900020073797a310000000017718bf50a3d7a7f944b2288b455040007800c000300686173683a697000040007800500040001000000af4cecc685c550eef24b870ba4af18d4364de6ff64a0fa41deaec19a352d8f5555459941e8014efe393813bbbc411b1e650a68027b4940c3f31ce03a6131f09401042edd2ae7bc8fabf83894704b756e895d3ac967f6fdcc45325dcfc9daeb154eee509d6c3712d5d72240aa873bdbde665d87d6ffd6a38aad9ba5e5418989afdf893e61d7841716ef750fccef"], 0x44}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000780)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r8, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="20000000000000002900000037000000000000000000000004a7f86dbdd824ac5c6642e1f4017400000000000edb74357c3c368c437c2a16ef61cd08b0393011c668ce81b883cf0d4dfc89b6ad6f69f264e1f4660e403a540792e0ec9d110408a966a50cc5160dd29494092ac0e7"], 0x20}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000041b653d2142146832000000000000000500010007000000"], 0x1c}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 13m1.153433735s ago: executing program 32 (id=641): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000380)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0, @ANYBLOB], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="00ea0edaaa91ab13e0471d998a2663f299b17a2a0f934393be839ecd863300f1830879f4279af7ef77df5930f1e8598779c664a3c1e55dc5008838d36628a45e028c621e750024be878f34094097f88bbc1378eda60fecaf0577c5349fd45dd40329b99ece26ed1c4c8992a225501b4b73c94e981d898d3a46904695176e790595178cece15f330b337119858eadcd1e2b00000000", @ANYRES32=r4, @ANYBLOB="01000000000000000000010000001c000180061414aa080006000100"/42], 0x30}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000800e0003006269746d61703a697000000005000400000000000900020073797a30000000000140ffffffff0c0001800800014080ffffff0500140002000000050005000200000005000100060000006744bf015f66af53c9bea42a79bb96d8d53867bd39b29997b2fa6c492ee927d6ed6f82677b63e3832c06000000cb1d214bbf0b18ac08bf27f9ea11b971d414bf00"/172], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1400000000000000445163b0449de7700a000400000000000000000adff9f0a5dc4259358b7b1b3dacc200bd1654105f5e65b3b776086d0f6431930024be03326af82560dd986035b7145bc8e875c778f8402bd7e50e33b8f9bdd9888c89d2aa214025"], 0x14}}, 0x0) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000050011fcfc505230d81a8ddebea88d38fe418bd61b7b40efc8079473e76b80f89c2fb79803a7091c617f8f0476cceee025aaadaa29fb8bcfbc0047e0876d5388f3e32aca152635384fa9f371f5c49784e0c00ed4684fcf096bef712253fa3e8273911dfcef6d389ad4e7af204c96cc1541305078b7cb86f29e7ab25d0182da772f17ad4178f2a23c115f1e6450865a9eb53604c795d1febf02bd35bb1369296594bd997e7ab532e1fed2ee31d50d0276627d24d4b7270e95ee3b787247c892dfab7b9b66"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="440000000206050000000000000000000000000005000100060000000900020073797a310000000017718bf50a3d7a7f944b2288b455040007800c000300686173683a697000040007800500040001000000af4cecc685c550eef24b870ba4af18d4364de6ff64a0fa41deaec19a352d8f5555459941e8014efe393813bbbc411b1e650a68027b4940c3f31ce03a6131f09401042edd2ae7bc8fabf83894704b756e895d3ac967f6fdcc45325dcfc9daeb154eee509d6c3712d5d72240aa873bdbde665d87d6ffd6a38aad9ba5e5418989afdf893e61d7841716ef750fccef"], 0x44}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000780)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r8, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="20000000000000002900000037000000000000000000000004a7f86dbdd824ac5c6642e1f4017400000000000edb74357c3c368c437c2a16ef61cd08b0393011c668ce81b883cf0d4dfc89b6ad6f69f264e1f4660e403a540792e0ec9d110408a966a50cc5160dd29494092ac0e7"], 0x20}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000041b653d2142146832000000000000000500010007000000"], 0x1c}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 15.121282705s ago: executing program 2 (id=3673): socket(0xa, 0x3, 0x3a) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000580)=0xe) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000080)=0x7f) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$l2tp(0x2, 0x2, 0x73) r2 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000400)={'ip6gre0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="df250a38f900316be558022cf16b59d5bc0c70e4ac29b1d79a7e1bd07015634f4b68d2bb7a9163c1d539f76db2464ec82cc6cbf9dfd66e4a925154c55276000a3282d00181ee5309e6d107c85096d3e33f599df2f255c4f69fd5f0a029e34eef4f96e8d3774c21c5e3f47d4bf43908870000000000", @ANYRES32=r5, @ANYBLOB="1400020000000000000000000000000000000001"], 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0xc010) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x0, 0x14) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r8 = socket(0x10, 0x3, 0x0) r9 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r9, 0xc040565e, &(0x7f00000003c0)={0xa, 0x0, 0x0, {0x80000004, 0x1, 0x2, 0x8800001}}) sendto$inet6(r8, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0xf) syz_open_dev$vim2m(0x0, 0x3, 0x2) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000000c0)=0x6) dup3(r1, r2, 0x80000) capget(&(0x7f0000000140)={0x20080522, 0xffffffffffffffff}, &(0x7f00000002c0)={0x7, 0x8, 0x6, 0x8, 0x1, 0xffffffff}) read$dsp(r0, &(0x7f00000011c0)=""/4117, 0x200021d5) socket$netlink(0x10, 0x3, 0xc) 13.996142308s ago: executing program 2 (id=3677): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) r1 = syz_io_uring_setup(0xec5, &(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x2, 0x0, 0x0, 0x4000, &(0x7f00000001c0), 0x1, 0x40}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x1223}}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) read$hidraw(r6, &(0x7f0000002340)=""/147, 0x93) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x800) syz_usb_ep_write(r4, 0x81, 0x1, &(0x7f0000000140)='\x00') io_uring_enter(r1, 0x2, 0x10a5, 0x3, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000300)="4800000014001d0d09074beafd0d8c560284606080ffe0064e204e20590000a2bc5603ca00000f7f8907000020008d42188fedc22e47ad8f75edc6d100000101ff0000000309ff", 0x47}], 0x1) ioctl$USBDEVFS_CLEAR_HALT(r0, 0xc0105502, &(0x7f0000000340)={0x1, 0x1}) 12.751070373s ago: executing program 4 (id=3682): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) dup(0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_emit_vhci(0x0, 0x7) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000180)={0x7, @raw_data="829b545515f7fdadbaa1561f6ae15e375d27e13bfbe8808afc2456883e55b9e4371336ee368aa9e148b7693a8ef30665353d190a5632e59e164c7c97b52a353ea53d02911e2cb95934dd7e58f6b5f252cd0b9f78cb6b6a3410e8b20a5915c2cef11a34089a32b094b8e944a7d96d0b666d7de34e0f8ab4db3a5be3d009c020e81d89a97011152b090ab8b6d61a7d45016faa9f4360f125d51d9602fe3e5c6ec09d398842393e5a98faedc1757bd8c778cbf32d462af40fd863e69020007b3e81693e54e92f7bfb7e"}) 11.030193536s ago: executing program 5 (id=3686): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_G_FBUF(r3, 0x8030560a, 0x0) ioctl$BLKTRACESTART(r2, 0x2272, 0x1000000000000) connect$inet6(r1, &(0x7f0000000000)={0xa, 0xfdfe, 0x7, @remote, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYRES64=r1, @ANYBLOB="d0a2667190d508ba50e2bb45c15d4b9b08a99195df2ccdaef3577047bc7f22aa9542a0192b5227410661e0520df7a77cb71328334b4da439", @ANYRESOCT=r1, @ANYRES8=r1, @ANYRESHEX], 0x0) 10.645179071s ago: executing program 4 (id=3688): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000001400)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000240)=""/233, 0xe9}, {&(0x7f0000000340)=""/250, 0xfa}, {&(0x7f00000001c0)=""/15, 0xf}, {&(0x7f0000000500)}, {&(0x7f0000000440)=""/156, 0x9c}, {&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000640)=""/113, 0x71}, {&(0x7f0000001500)=""/224}], 0x7, &(0x7f00000006c0)=""/136, 0x88}, 0xb54d}, {{0x0, 0xffffff71, &(0x7f0000001680)=[{&(0x7f0000000780)=""/165, 0xa5}, {&(0x7f0000000840)=""/126, 0x7e}, {&(0x7f00000008c0)=""/99, 0x63}, {&(0x7f0000000940)=""/107, 0x6b}, {&(0x7f00000009c0)=""/249, 0xf9}, {&(0x7f00000005c0)=""/8, 0x8}, {&(0x7f0000000ac0)=""/187, 0xbb}, {&(0x7f0000000b80)=""/143, 0x8f}, {&(0x7f0000000500)=""/92}], 0x8, &(0x7f0000000cc0)=""/162, 0xa2}, 0x5}, {{&(0x7f0000000d80)=@nfc_llcp, 0x80, &(0x7f0000001100)=[{&(0x7f0000000e00)=""/247, 0xf7}, {&(0x7f0000000f00)=""/253, 0xfd}, {&(0x7f0000001000)=""/248, 0xf8}], 0x2, &(0x7f0000001140)=""/123, 0x7b}, 0x8fcc}, {{&(0x7f00000011c0)=@nl=@proc, 0x80, &(0x7f0000001340)=[{&(0x7f0000001240)}, {&(0x7f0000001280)=""/142, 0x8e}], 0x2, &(0x7f0000001380)=""/127, 0x7f}}], 0x4, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000140)='/sys/kernel/oops_count', 0x40100, 0x3a) r3 = syz_io_uring_setup(0xbdf, &(0x7f0000000000)={0x0, 0x6d0a, 0x80, 0xfffefffd, 0x40000331, 0x0, r2}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x2000, 0xe, 0x0, 0x0) 10.335358649s ago: executing program 2 (id=3689): ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f0000000200)={{0xffffffffffffffff, 0x1, 0xfffffffe}, 0xe, 0x9}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000004, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x4, 0x4, 0x4, 0x3, 0x800, 0x1}, 0x48) close(r4) ioctl$KVM_RUN(r3, 0xae80, 0x0) 9.619253256s ago: executing program 4 (id=3692): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x6, 0x9, 0x8000000000000000, 0xf4a, 0x0, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2, 0x0, 0x0, 0x0, 0x1}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r6, 0x0, 0xf, &(0x7f00000009c0)=0x1238, 0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 8.91915902s ago: executing program 2 (id=3695): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000780)={0x10000000}) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) read$dsp(0xffffffffffffffff, &(0x7f0000000140)=""/40, 0x28) socket$netlink(0x10, 0x3, 0x13) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007000010d4220315000000000001090224000100000000090400000103000000092100000001220700090581030002000400d2113d619a6f4c83484bb603b84ab5f64f6db45b67f20d6808dabd7c4ca06bda1bea2c84aae98eb500b18e82824b5001e4c3e24bf2d254a6cbb2a0259afb1f6e41fe27c6d35b8be99208c97871255d1acc26d32182c90aec3844c455eccd552e666bebaa2754a95df2f2c92370ff6d194baa7efa326d930565154f75"], 0x0) 7.874991179s ago: executing program 5 (id=3697): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) (async, rerun: 32) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x3c00, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x1223}}) (async, rerun: 64) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) ioctl$int_in(r1, 0x5452, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3400000044000701feffffff00000000037c0000146a41358c1e2c9406000600800a0000100002"], 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) r5 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x8000, 0x8) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r5, 0x28, 0x2, &(0x7f0000000080)=0x6, 0x8) 6.917760852s ago: executing program 0 (id=3699): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000040000000e94000001"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r1}, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r1, 0x0}, 0x20) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="48010000160029062abd7000ffdbdf2520010000000000000000000000000001ac1414aa0000000000000000000000004e22d64c4e26040402002080730000007fb95e2ff2ecd61b9fa8d0e8834304671bbaa00d11a5ca540533cc1ab3fbe5a8501b3accaf6951bfb7dad4c0a20ae82d489a22eeca9aeb30c81310db49c9982231df2e5ec3de6e3aac173d25b1ed0e327fc8d9a82dca085c05f7fe468531d26b9af2b9a7ec6f6a8186", @ANYRESHEX=r1, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000004d233000000fe88000000000000000000000000000101040000000000000d000000000000000200000000000000ffff000000000000040000000000000006000000000000000000000000000000faffffffffffffff54450000000000000600000000000000ffffffffffffffff00100000000000000500000008000000030000002abd7000000000000a0001df1400000000000000010000000600000024000900030000000000000002000000000000000700000000000000c1000000000000002c001300e000000100000000000000000000000000000000000000000000000000000000000000000a000000"], 0x148}}, 0x0) r2 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r3, 0xc0cc5615, &(0x7f0000000100)={0x7, @output={0x1000, 0x1, {0x1, 0xcdcc}, 0x10000, 0xfffffffd}}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x0, 0x19) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x7, 0x9, 0x4, 0xfffffc2c}, {0x6, 0x9, 0x10, 0x4}]}) 6.64926297s ago: executing program 5 (id=3701): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) unshare(0x64000600) r2 = socket(0xf, 0x3, 0x7) getsockopt(r2, 0x0, 0x40, &(0x7f00000002c0)=""/96, &(0x7f00000000c0)=0x60) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2040000bbbbbbbbbbbb08004510003000800000000190b956000001ac1414aa030490781206183f2500000000670000e000000214b1bc942d93cc0ffbef01665cee17d9629322798841f45716cf6f80f952e57b0ea9bd2fdaf20f2fe6bb6fe5113067a51964abc695e777399dae1deb3f6402"], 0x0) setsockopt$packet_add_memb(r1, 0x107, 0x1, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000100)="b18ccc9e0836c8f3e8280084753d8b35a3f8e072052404dcf0b4851dfa8457ce47b97f6dfddb5f4d73f924a34d6a6652fe64020e43168545614863f9f184b6661c58ab4f99267ab80000c94d7157437af7eb4e382c218074c081e3da2149c7a630f35c13e5e09a6ed8813ecba757102cad1354953da865701de73e56", 0x7c) bind$qrtr(r2, &(0x7f0000000180)={0x2a, 0xffffffffffffffff, 0x4001}, 0xc) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2120, 0x0) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000340)={0x0, 0x11, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x10) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$PPPIOCGFLAGS1(r0, 0x8004745a, &(0x7f00000000c0)) 6.57092981s ago: executing program 4 (id=3702): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000a5f000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) ptrace(0x10, 0x1) 6.017753389s ago: executing program 0 (id=3703): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x6, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}}], 0x1, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r6}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r7, &(0x7f0000000300)=[{0x0}], 0x1) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="b7050000000000007910a800000000000700000000000c00950000000000000077e910f0fa61e854e3bee26743fffaf2512cc48c0a40f24ad5f1ac2f9fcbef945927e3986c2605be722a2961528b907781e19f6ceae4295464494aef673379c79eb728ad3b5adffa2e147c31b09e381d9f61b443695a0fa2dc01bd71b714616faee6a95c1928e29a94873ecb63b15bf2e834e5288842d104308c897f2457605572608b349c303498a49b1bba95af519ded454e788e32"], 0x0, 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000040)=ANY=[], 0x57) setsockopt$inet_mreqsrc(r4, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r8, &(0x7f0000000000)=0x2b00, 0x12) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) 6.013795522s ago: executing program 1 (id=3704): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r2 = epoll_create(0x7fffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) ioctl$KVM_GET_MSRS_sys(r3, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x484, 0x0, 0x6}]}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r8 = socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() sync_file_range(r0, 0xfffffffffffffff7, 0x7, 0x1) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x5}, 0x20) ioctl$UFFDIO_COPY(r7, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@bridge_delvlan={0x30, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r6}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x4}}}]}, 0x30}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x40000004}) close_range(r0, 0xffffffffffffffff, 0x0) 5.374053203s ago: executing program 2 (id=3705): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket(0x1d, 0x2, 0x6) r2 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r2, &(0x7f0000001300)=""/4096, 0xffffffffffffffd2) r3 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000600)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000ca32c7329458e68a330a721f000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000674ae874c8a3ac27c779eb000000000000000000000000000000fffffffffffffffd000000000000000000fcffffff00"/144]}, 0x108) ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xfffffffd, 0x4, 0xb, 0x8001}}) r5 = open(0x0, 0x64842, 0x389b0d52417bb201) pwritev2(r5, &(0x7f0000000240), 0x0, 0x7000, 0x0, 0x3) r6 = socket$qrtr(0x2a, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000}) fchown(r7, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x92e82) sendmsg$sock(r6, &(0x7f0000001540)={&(0x7f0000000140)=@pppoe={0x2a, 0x0, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}, 'lo\x00'}}, 0x80, 0x0}, 0x40000c0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x240480d4}, 0x4040) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00'], 0x28}}, 0x0) 5.204443053s ago: executing program 5 (id=3706): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r0, 0x0, 0x1, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=@newlink={0x70, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e23}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x9}]}}}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_MPLS]}, @IFLA_PHYS_PORT_ID={0x19, 0x22, "084ccbfe97e5877918f6873f243e45175d59811b93"}, @IFLA_NUM_RX_QUEUES={0x0, 0x20, 0x8000}]}, 0x70}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x541b, 0x40000000000ca43) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x440, 0x0) syz_emit_ethernet(0x22, &(0x7f0000000140)={@local, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x35}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa15, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0b04000000000000000002000000510004802c0001800b00010065787468647200001c0002800500020089000000a4aae8cbbdda4b3fe3636c826a4de0080001400000000d08000640000000040900010073797a30000000000900020073797a320000000014000000113143e5d2ddcc2144636252cb94a3855d0001dbe1ae19d88c015dac8d468a78a0953d0cb39bdc500d46be1e083ae19072c788be07b9742c484b"], 0x84}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 4.049628765s ago: executing program 5 (id=3707): setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x48f, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_io_uring_setup(0x1238, &(0x7f0000000380)={0x0, 0x80fd, 0x80, 0x2, 0xab9}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffff4, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r0, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004b41460860163209ea80010203010902120001000000080904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x2402) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x10001, 0x2) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000a40)={&(0x7f0000000640)=[{0x9, 0x3211, 0xdb, &(0x7f0000000940)="90d1b2ac3a97fe639f614c7c4307ac9c4a5e049ef1d3a6fb56f629531a2ba815731300549bb78c6d739e90bd92033d8954cda31c04f267e51f78465a1a654706e43048236fabd0717933fdf1c1d3b3c916939a4b3f19d24460cec331e6ba27f96964fb09c6671b4ed035e475a65e5e4010ac6f4593a59382441785c828df97b32378be0b79ff063262c4610a6fbb19e1d5f865b25b69c6534dd69f0890ca89b92f173b84c3a5b5df20ed8f89186735373dc027e8e9c61c1ca626d98ba479cea46328aaea8dab3e7ff4556484dd281bdbc74b305e4c5f7997b49efd"}], 0x1}) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000180)={&(0x7f0000000400)=[{0x1934, 0x1000, 0x0, 0x0}], 0x1}) 3.814651131s ago: executing program 4 (id=3708): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r2 = epoll_create(0x7fffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) ioctl$KVM_GET_MSRS_sys(r3, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x484, 0x0, 0x6}]}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r8 = socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() sync_file_range(r0, 0xfffffffffffffff7, 0x7, 0x1) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x5}, 0x20) ioctl$UFFDIO_COPY(r7, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@bridge_delvlan={0x30, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r6}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x4}}}]}, 0x30}}, 0x0) socket$kcm(0x10, 0x400000002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x40000004}) close_range(r0, 0xffffffffffffffff, 0x0) 3.492475934s ago: executing program 1 (id=3709): mbind(&(0x7f0000ff7000/0x7000)=nil, 0x7000, 0x3, &(0x7f0000000000)=0x2, 0x0, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0xa201, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x7b, {"440f22c03505000000440f22c00f3235000800000f3066baf80c470f01c8ef66bafc0cb8fac90000ef672e0f1f00360f7821c7442400a9f80b95c7442402a400c0fec7442406000000000f0114240f07460f09b9e30200000f32b9780300000d32c4a1a25d921e6b5458"}}], 0x7b}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x6, 0x35, 0xa, 0x6, 0x8, 0x31833137, 0xe4, 0x0, 0x9a, 0x1, 0x81, 0xfffffffffffffff3, 0x40000000000000, 0x9, 0x6, 0x3], 0x50000, 0x40100}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$FS_IOC_GETFSSYSFSPATH(r2, 0x40049409, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003e40), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000004080)={0x0, 0x0, &(0x7f0000004040)={&(0x7f0000000880)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002dbd7800ffdbdf25010000000c00018008000180"], 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) 2.757641824s ago: executing program 1 (id=3710): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000000)={r1, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r1, @in6={{0xa, 0x4e24, 0x5, @empty, 0x2800}}, 0xf, 0x0, 0x20000, 0x0, 0x36, 0x0, 0x4}, 0x9c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000005000000850000007d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xd, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) write$cgroup_freezer_state(r3, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7b130000a08800002c0012800f50128142daa48b143c4243ec290b0001006d616373650048f025b33835563267038389750500"], 0x4c}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001a00010025bd7000000000000a000000", @ANYRES32=r6, @ANYBLOB="00dcc40014000200070000000000000000deffffffffffdf130001"], 0x44}, 0x1, 0x0, 0x0, 0x20008041}, 0x8084) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8982, &(0x7f0000000080)={0x8, 'veth0_to_bond\x00', {'batadv_slave_1\x00'}}) 2.659326348s ago: executing program 2 (id=3711): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) (async) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) r2 = getpid() openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100), 0x10300, 0x0) ioctl$SG_BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0xc, 0x5, 0x3, 0x0, 0x5, r2}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a010800000000000000000100000040000000030a01080000000000000000010000000900030073797a32000000001400048008001e400000000008000140000000040900010073797a300000000064000000060a01040000000000000000010000000900020073797a32000000000900010073797a300000000038000480340001800c0001007061796c6f61640024000280080001400000000e080004400000000108000240000000020800034000000084140000001100010000000000000000000100000a"], 0xe0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a010800000000000000000100000040000000030a01080000000000000000010000000900030073797a32000000001400048008001e400000000008000140000000040900010073797a300000000064000000060a01040000000000000000010000000900020073797a32000000000900010073797a300000000038000480340001800c0001007061796c6f61640024000280080001400000000e080004400000000108000240000000020800034000000084140000001100010000000000000000000100000a"], 0xe0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004080}, 0x8ae257a062cc3564) sendmmsg$inet6(r4, &(0x7f0000000380)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev}, 0x1c, 0x0}}], 0x1, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r1, 0x0, 0xffffffdb) 2.559529763s ago: executing program 1 (id=3712): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x1, 0xf40) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) write$nci(r1, &(0x7f00000000c0)=ANY=[], 0xfffffd16) 2.535253244s ago: executing program 0 (id=3713): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000880)=[@code={0x1, 0x41, {"b9800000c00f3235000800000f30440f793492470f01d53e450f06f3406d260faef3c4437148f7de6540f40fe7280f08"}}], 0x41}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) r4 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040), 0xc000, 0x0) ioctl$KVM_CAP_MEMORY_FAULT_INFO(r4, 0x4068aea3, &(0x7f0000000100)) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000240)={0x2, 0xfc}, 0x2) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r5, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) r7 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0xc5501, 0x104) write$binfmt_misc(r7, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000000)={@local, 0x2}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x101ff, 0x7, 0x12000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.205917719s ago: executing program 1 (id=3714): r0 = socket(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={0x0, 0x3, r2, 0x5}) syz_open_dev$video(&(0x7f00000000c0), 0x2, 0x80) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}, {0xffe3, 0x2}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x800, 0x0, 0x3dc, 0x0, 0x3], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@bridge_delneigh={0x24, 0x1e, 0x1, 0xfffffff9, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x0, 0x80, 0x4a974a97055188a0}, [@NDA_VLAN={0x6, 0x5, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x944}, 0x40008) 2.189278741s ago: executing program 4 (id=3715): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000780)={0x10000000}) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) read$dsp(0xffffffffffffffff, &(0x7f0000000140)=""/40, 0x28) socket$netlink(0x10, 0x3, 0x13) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007000010d4220315000000000001090224000100000000090400000103000000092100000001220700090581030002000400d2113d619a6f4c83484bb603b84ab5f64f6db45b67f20d6808dabd7c4ca06bda1bea2c84aae98eb500b18e82824b5001e4c3e24bf2d254a6cbb2a0259afb1f6e41fe27c6d35b8be99208c97871255d1acc26d32182c90aec3844c455eccd552e666bebaa2754a95df2f2c92370ff6d194baa7efa326d930565154f75"], 0x0) 2.141090624s ago: executing program 0 (id=3716): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x28, 0x14, 0x509, 0x70bd28, 0xfffffffd, {0x2, 0x18, 0x0, 0x0, r1}, [@IFA_BROADCAST={0x8, 0x4, @broadcast}, @IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newtfilter={0x2c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x3}, {}, {0x7, 0xfff3}}, [@TCA_RATE={0x6, 0x5, {0xf5, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40840}, 0x24040084) 1.570648232s ago: executing program 0 (id=3717): ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRES16=r1], 0xfffffdef}, 0x1, 0x0, 0x0, 0x4811}, 0x0) syz_open_dev$evdev(0x0, 0x40, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030001000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044044) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4044055}, 0x40) writev(r2, &(0x7f00000028c0)=[{&(0x7f0000000280)="fc28069b4fbf17d797c1", 0xa}, {&(0x7f0000000400)}, {0x0}, {&(0x7f0000000600)}, {&(0x7f0000000700)}, {&(0x7f0000002780)}, {&(0x7f00000027c0)}], 0x7) 1.232085513s ago: executing program 1 (id=3718): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000a5f000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) ptrace(0x10, 0x1) 311.491324ms ago: executing program 0 (id=3719): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r2 = epoll_create(0x7fffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) ioctl$KVM_GET_MSRS_sys(r3, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x484, 0x0, 0x6}]}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r6 = socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() sync_file_range(r0, 0xfffffffffffffff7, 0x7, 0x1) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x5}, 0x20) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x40000004}) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 5 (id=3720): r0 = syz_open_dev$vbi(&(0x7f00000000c0), 0x1, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000880)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000900)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vxcan0\x00'}) listen(r2, 0x7ff) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) sendmmsg(r3, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)="7c220752098d1a03003fb4d50b17b9653538f559e8ca1a63dfa1a8f54135abe90913a7bb3930c14e8d1808268429578d92871b8681b42a7a264d4c578a7c26845616d98fc09729e3d8c0aa68e95af732c067f9dd1d9fdd4ee2008561e5a690de23248e60f4ab6390f520377d0a68cc822a17c773be19ee5b51b2428acd21725b17f5fadc10e18e574983e260010d619f74dd4c30", 0x94}], 0x1, &(0x7f0000000480)=ANY=[], 0x170}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000f40)="f48f2d", 0x7313485bca3e9141}], 0x1}}], 0x2, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}]}, {0x0, [0x30]}}, &(0x7f0000000280)=""/197, 0x2b, 0xc5, 0x1, 0x9}, 0x28) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRESDEC=r4, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200000002001000a9fe00"/28], 0x50) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) accept(r6, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x4010, r5, 0x3558a000) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x109000, 0xaa) fsetxattr(r7, &(0x7f00000000c0)=@known='user.incfs.size\x00', 0x0, 0x0, 0x3) r8 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x3a, 0x98, 0x2a, 0x8, 0xccd, 0x10a3, 0x23a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x57, 0x33, 0x19}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f0000000a00)={0x2c, &(0x7f00000006c0)=ANY=[@ANYBLOB="200006"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000180)={0x7, @raw_data="829b545515f7fdadbaa1561f6ae15e375d27e13bfbe8808afc2456883e55b9e4371336ee368aa9e148b7693a8ef30665353d190a5632e59e164c7c97b52a353ea53d02911e2cb95934dd7e58f6b5f252cd0b9f78cb6b6a3410e8b20a5915c2cef11a34089a32b094b8e944a7d96d0b666d7de34e0f8ab4db3a5be3d009c020e81d89a97011152b090ab8b6d61a7d45016faa9f4360f125d51d9602fe3e5c6ec09d398842393e5a98faedc1757bd8c778cbf32d462af40fd863e69020007b3e81693e54e92f7bfb7e"}) kernel console output (not intermixed with test programs): 910.759703][T20222] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 910.768056][T20230] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 910.800444][T20230] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 910.810615][T20222] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 910.821876][T20222] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 910.833021][T20230] Node 0 DMA32 free:1215080kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:79096kB inactive_anon:0kB active_file:83580kB inactive_file:160932kB unevictable:1536kB writepending:472kB zspages:0kB present:3129332kB managed:2564264kB mlocked:0kB bounce:0kB free_pcp:34148kB local_pcp:18436kB free_cma:0kB [ 910.871897][T20230] lowmem_reserve[]: 0 0 0 0 0 [ 910.877551][T20230] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 910.983953][T20230] lowmem_reserve[]: 0 0 0 0 0 [ 910.990146][T20230] Node 1 Normal free:3880684kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:20kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:31160kB local_pcp:13924kB free_cma:0kB [ 911.104757][T20230] lowmem_reserve[]: 0 0 0 0 0 [ 911.110035][T20230] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 911.147517][T20230] Node 0 DMA32: 35*4kB (UE) 116*8kB (UME) 55*16kB (E) 103*32kB (UE) 319*64kB (UME) 223*128kB (UME) 87*256kB (UME) 50*512kB (UME) 19*1024kB (UME) 6*2048kB (ME) 262*4096kB (UM) = 1206972kB [ 911.214294][T20230] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 911.375482][T20230] Node 1 Normal: 217*4kB (UME) 67*8kB (UE) 47*16kB (UE) 138*32kB (UME) 45*64kB (UME) 14*128kB (UME) 9*256kB (UM) 7*512kB (UME) 7*1024kB (UME) 5*2048kB (UE) 939*4096kB (UM) = 3880684kB [ 911.424865][T20230] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 911.458231][T20230] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 911.482503][T20230] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 911.493496][T20230] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 911.523323][T20230] 75794 total pagecache pages [ 911.542744][T20230] 0 pages in swap cache [ 911.555139][T20230] Free swap = 124996kB [ 911.561071][T20230] Total swap = 124996kB [ 911.592626][T20230] 2097051 pages RAM [ 911.605449][ T7809] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 911.618075][T20263] netlink: 'syz.0.3353': attribute type 4 has an invalid length. [ 911.628934][T20230] 0 pages HighMem/MovableOnly [ 911.634846][T20230] 424343 pages reserved [ 911.779298][T20230] 0 pages cma reserved [ 911.847489][ T7809] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 911.866188][ T7809] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 911.875797][ T7809] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.903238][ T7809] usb 3-1: config 0 descriptor?? [ 911.908806][ T185] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 912.075434][ T185] usb 1-1: Using ep0 maxpacket: 16 [ 912.083223][ T185] usb 1-1: config 0 has no interfaces? [ 912.091404][ T185] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 912.101148][ T185] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 912.119242][ T185] usb 1-1: Manufacturer: syz [ 912.160013][ T185] usb 1-1: config 0 descriptor?? [ 912.356838][ T7809] keytouch 0003:0926:3333.003B: fixing up Keytouch IEC report descriptor [ 912.403562][ T7809] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.003B/input/input110 [ 912.851956][ T7809] keytouch 0003:0926:3333.003B: input,hidraw1: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 912.932900][T20263] trusted_key: syz.0.3353 sent an empty control message without MSG_MORE. [ 913.677827][T20282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.730614][T20282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 914.444819][T15283] usb 3-1: USB disconnect, device number 45 [ 914.725634][T20301] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3361'. [ 914.743797][ T7809] usb 1-1: USB disconnect, device number 70 [ 914.802476][T20301] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 914.864560][T20304] ptrace attach of "./syz-executor exec"[18723] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   H  8   \x09 §џџџџџџџ ўџџњ џџџџ [ 915.261345][T20301] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 915.975810][T15264] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 916.147528][T15264] usb 5-1: Using ep0 maxpacket: 8 [ 916.154939][T15264] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 916.163448][T15264] usb 5-1: config 0 has no interface number 0 [ 916.206070][T15264] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 916.221186][T20324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 916.235664][T15264] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 916.246021][T15264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.272243][T15264] usb 5-1: config 0 descriptor?? [ 916.304836][T20324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 916.324475][T15264] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 916.473535][T20333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 916.483793][T20333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 916.497194][T20333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 916.507960][T20333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 916.644597][ T7809] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 916.696043][ T5946] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 916.805683][ T7809] usb 1-1: Using ep0 maxpacket: 8 [ 916.823838][ T7809] usb 1-1: config 10 has an invalid interface number: 193 but max is 0 [ 916.832976][ T7809] usb 1-1: config 10 has no interface number 0 [ 916.843596][ T7809] usb 1-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice=be.93 [ 916.853018][ T5946] usb 3-1: Using ep0 maxpacket: 32 [ 916.860375][ T7809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.870005][ T5946] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.883852][ T7809] usb 1-1: Product: syz [ 916.894075][ T7809] usb 1-1: Manufacturer: syz [ 916.900967][ T7809] usb 1-1: SerialNumber: syz [ 916.905993][ T5946] usb 3-1: New USB device found, idVendor=093a, idProduct=262c, bcdDevice=ae.31 [ 916.915786][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.927801][ T5946] usb 3-1: Product: syz [ 916.938138][ T5946] usb 3-1: Manufacturer: syz [ 916.944727][ T5946] usb 3-1: SerialNumber: syz [ 916.952917][ T5946] usb 3-1: config 0 descriptor?? [ 916.963632][ T5946] gspca_main: gspca_pac7302-2.14.0 probing 093a:262c [ 917.139754][T20329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 917.161161][T20329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 917.186639][ T7809] rtsx_usb 1-1:10.193: probe with driver rtsx_usb failed with error -22 [ 917.212708][ T7809] usb 1-1: USB disconnect, device number 71 [ 917.297744][T20340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 917.321302][T20340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 917.334044][T20338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 917.344778][T20338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 917.485622][ T5946] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 917.492616][ T5946] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 918.058642][T20350] IPVS: set_ctl: invalid protocol: 44 172.20.20.38:20001 [ 918.180232][T20352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 918.385044][T20352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 918.878278][T20357] ptrace attach of "./syz-executor exec"[16543] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 919.293958][T20364] usb usb8: usbfs: process 20364 (syz.5.3380) did not claim interface 0 before use [ 919.398528][T20366] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 919.406839][T20366] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 919.436794][T20366] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 919.525697][ T7809] usb 3-1: USB disconnect, device number 46 [ 919.926618][T20371] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3382'. [ 920.225452][ T7809] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 920.399560][ T7809] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 920.419632][ T7809] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 920.474860][ T7809] usb 3-1: New USB device found, idVendor=0499, idProduct=103e, bcdDevice=4e.18 [ 920.492157][ T7809] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.509238][ T7809] usb 3-1: Product: syz [ 920.516890][ T7809] usb 3-1: Manufacturer: syz [ 920.588761][ T7809] usb 3-1: SerialNumber: syz [ 920.612146][ T7809] usb 3-1: config 0 descriptor?? [ 920.673634][T20367] netlink: 'syz.1.3381': attribute type 4 has an invalid length. [ 920.852779][ T7809] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 920.992452][ T7809] usb 3-1: USB disconnect, device number 47 [ 921.077963][T11637] udevd[11637]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 921.789835][ T7809] usb 5-1: USB disconnect, device number 53 [ 921.948896][ T185] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 922.186642][ T185] usb 3-1: Using ep0 maxpacket: 8 [ 922.342441][ T185] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 922.364038][ T185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.388546][ T185] usb 3-1: Product: syz [ 922.400718][ T185] usb 3-1: Manufacturer: syz [ 922.412069][ T185] usb 3-1: SerialNumber: syz [ 922.415469][T15284] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 922.446915][ T185] usb 3-1: config 0 descriptor?? [ 922.718333][T15284] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 922.728003][T15284] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.744288][T15284] usb 5-1: Product: syz [ 922.778521][ T185] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 922.778680][T15284] usb 5-1: Manufacturer: syz [ 922.815654][T15284] usb 5-1: SerialNumber: syz [ 923.303350][T20414] ptrace attach of "./syz-executor exec"[8238] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 923.448518][T15284] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 923.752130][T15284] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 923.781465][T15284] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 924.045529][ T185] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 924.055258][T15284] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 924.093589][T15284] usb 5-1: USB disconnect, device number 54 [ 924.115489][T15283] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 924.175085][T20427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 924.201829][T20427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 924.386265][T20422] usb usb8: usbfs: process 20422 (syz.1.3396) did not claim interface 0 before use [ 924.398595][T20422] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 924.426170][T15283] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 924.446547][T15283] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 924.470358][T20422] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 924.479101][T20422] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 924.525768][T15283] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 924.535820][T15283] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.594035][T15283] usb 1-1: config 0 descriptor?? [ 925.256490][T15283] cp2112 0003:10C4:EA90.003C: unknown main item tag 0x0 [ 925.293050][T15283] cp2112 0003:10C4:EA90.003C: hidraw1: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 925.451642][T15283] cp2112 0003:10C4:EA90.003C: Part Number: 0x82 Device Version: 0xFE [ 925.674768][T20416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.710998][T20416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.719415][T15264] usb 3-1: USB disconnect, device number 48 [ 925.745675][T15284] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 925.916175][T15284] usb 5-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 925.924943][T15284] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 925.957517][T15284] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 925.977091][T15284] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 925.987542][T15284] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 926.030120][T15284] usb 5-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 926.050166][T15284] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.079623][T15284] usb 5-1: config 0 descriptor?? [ 926.108044][T15283] cp2112 0003:10C4:EA90.003C: error requesting SMBus config [ 926.149272][T15283] cp2112 0003:10C4:EA90.003C: probe with driver cp2112 failed with error -71 [ 926.195167][T15283] usb 1-1: USB disconnect, device number 72 [ 926.555949][T15283] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 926.606147][T20473] loop3: detected capacity change from 0 to 7 [ 926.633437][T20473] Dev loop3: unable to read RDB block 7 [ 926.649872][T20473] loop3: unable to read partition table [ 926.663698][T20473] loop3: partition table beyond EOD, truncated [ 926.682628][T20473] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 926.723884][T15284] usbhid 5-1:0.0: can't add hid device: -71 [ 926.731567][T15283] usb 1-1: Using ep0 maxpacket: 8 [ 926.739292][T15283] usb 1-1: config 6 has an invalid interface number: 2 but max is 0 [ 926.756515][T15284] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 926.764675][T15283] usb 1-1: config 6 has no interface number 0 [ 926.780860][T15283] usb 1-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 926.794744][T20477] ptrace attach of "./syz-executor exec"[18723] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c [ 926.803399][T15284] usb 5-1: USB disconnect, device number 55 [ 926.902530][T15283] usb 1-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 926.914741][T15283] usb 1-1: config 6 interface 2 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 926.927316][T15283] usb 1-1: config 6 interface 2 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 926.963089][T15283] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 927.005370][T15283] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.033287][T15283] usb 1-1: Product: syz [ 927.043620][T15283] usb 1-1: Manufacturer: syz [ 927.055400][T15283] usb 1-1: SerialNumber: syz [ 927.083244][T15283] hso 1-1:6.2: Failed to find BULK IN ep [ 927.279014][T15284] usb 1-1: USB disconnect, device number 73 [ 927.360646][T20485] openvswitch: netlink: Message has 16 unknown bytes. [ 927.711694][T20492] x_tables: duplicate underflow at hook 1 [ 927.930019][T20496] netlink: 'syz.0.3414': attribute type 12 has an invalid length. [ 927.980025][T20496] netlink: 'syz.0.3414': attribute type 29 has an invalid length. [ 928.055600][T20496] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3414'. [ 928.065429][T20496] netlink: 'syz.0.3414': attribute type 2 has an invalid length. [ 928.077828][T20496] netlink: 23 bytes leftover after parsing attributes in process `syz.0.3414'. [ 928.885060][T20250] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 929.055410][T20250] usb 1-1: Using ep0 maxpacket: 8 [ 929.067264][T20250] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 929.077766][T20250] usb 1-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 929.096167][T20250] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 929.110354][T20515] loop3: detected capacity change from 0 to 7 [ 929.117265][T20515] Dev loop3: unable to read RDB block 7 [ 929.150305][T20515] loop3: unable to read partition table [ 929.166455][T20250] usb 1-1: config 0 descriptor?? [ 929.180027][T20515] loop3: partition table beyond EOD, truncated [ 929.191706][T20250] usb 1-1: bad CDC descriptors [ 929.205910][T20250] cdc_acm 1-1:0.0: Control and data interfaces are not separated! [ 929.223967][T20515] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 929.244231][T20250] cdc_acm 1-1:0.0: This needs exactly 3 endpoints [ 929.262493][T20250] cdc_acm 1-1:0.0: probe with driver cdc_acm failed with error -22 [ 929.391533][T20505] fuse: Bad value for 'fd' [ 929.831259][T20527] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3423'. [ 930.061915][T20531] FAULT_INJECTION: forcing a failure. [ 930.061915][T20531] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 930.080023][T20531] CPU: 0 UID: 0 PID: 20531 Comm: syz.2.3425 Tainted: G L syzkaller #0 PREEMPT(full) [ 930.080055][T20531] Tainted: [L]=SOFTLOCKUP [ 930.080062][T20531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 930.080074][T20531] Call Trace: [ 930.080083][T20531] [ 930.080092][T20531] dump_stack_lvl+0x189/0x250 [ 930.080128][T20531] ? __pfx____ratelimit+0x10/0x10 [ 930.080155][T20531] ? __pfx_dump_stack_lvl+0x10/0x10 [ 930.080178][T20531] ? __pfx__printk+0x10/0x10 [ 930.080205][T20531] ? __might_fault+0xb0/0x130 [ 930.080241][T20531] should_fail_ex+0x414/0x560 [ 930.080275][T20531] _copy_from_iter+0x1cd/0x1630 [ 930.080310][T20531] ? __build_skb_around+0x22d/0x3c0 [ 930.080340][T20531] ? __pfx__copy_from_iter+0x10/0x10 [ 930.080366][T20531] ? __alloc_skb+0x2f1/0x430 [ 930.080386][T20531] ? __pfx___alloc_skb+0x10/0x10 [ 930.080417][T20531] ? netlink_sendmsg+0x642/0xb30 [ 930.080438][T20531] ? skb_put+0x11b/0x210 [ 930.080460][T20531] netlink_sendmsg+0x6b2/0xb30 [ 930.080492][T20531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.080517][T20531] ? aa_sock_msg_perm+0xf1/0x1b0 [ 930.080542][T20531] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 930.080569][T20531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.080593][T20531] __sock_sendmsg+0x21c/0x270 [ 930.080621][T20531] ____sys_sendmsg+0x505/0x820 [ 930.080648][T20531] ? __pfx_____sys_sendmsg+0x10/0x10 [ 930.080677][T20531] ? import_iovec+0x74/0xa0 [ 930.080705][T20531] ___sys_sendmsg+0x21f/0x2a0 [ 930.080728][T20531] ? __pfx____sys_sendmsg+0x10/0x10 [ 930.080756][T20531] ? rcu_read_lock_any_held+0xb3/0x120 [ 930.080806][T20531] ? __fget_files+0x2a/0x420 [ 930.080826][T20531] ? __fget_files+0x3a0/0x420 [ 930.080856][T20531] __x64_sys_sendmsg+0x19b/0x260 [ 930.080880][T20531] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 930.080911][T20531] ? __pfx_ksys_write+0x10/0x10 [ 930.080941][T20531] ? do_syscall_64+0xbe/0xf80 [ 930.080972][T20531] do_syscall_64+0xfa/0xf80 [ 930.081000][T20531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.081045][T20531] ? clear_bhb_loop+0x60/0xb0 [ 930.081069][T20531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.081088][T20531] RIP: 0033:0x7f3f0878f749 [ 930.081106][T20531] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 930.081129][T20531] RSP: 002b:00007f3f09551038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 930.081151][T20531] RAX: ffffffffffffffda RBX: 00007f3f089e5fa0 RCX: 00007f3f0878f749 [ 930.081166][T20531] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 930.081179][T20531] RBP: 00007f3f09551090 R08: 0000000000000000 R09: 0000000000000000 [ 930.081192][T20531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 930.081204][T20531] R13: 00007f3f089e6038 R14: 00007f3f089e5fa0 R15: 00007f3f08b0fa28 [ 930.081236][T20531] [ 930.398685][T20537] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3426'. [ 930.582566][T20543] ptrace attach of "./syz-executor exec"[19068] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c [ 930.981016][T20547] usb usb8: usbfs: process 20547 (syz.4.3428) did not claim interface 0 before use [ 931.088487][T20548] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 931.097371][T20548] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 931.105910][T20548] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 931.286894][T20550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 931.296525][T20550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 931.508946][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.520690][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.569771][T19753] usb 1-1: USB disconnect, device number 74 [ 932.033722][T20562] FAULT_INJECTION: forcing a failure. [ 932.033722][T20562] name failslab, interval 1, probability 0, space 0, times 0 [ 932.075747][T20562] CPU: 1 UID: 0 PID: 20562 Comm: syz.1.3436 Tainted: G L syzkaller #0 PREEMPT(full) [ 932.075777][T20562] Tainted: [L]=SOFTLOCKUP [ 932.075784][T20562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 932.075795][T20562] Call Trace: [ 932.075802][T20562] [ 932.075811][T20562] dump_stack_lvl+0x189/0x250 [ 932.075839][T20562] ? __pfx____ratelimit+0x10/0x10 [ 932.075866][T20562] ? __pfx_dump_stack_lvl+0x10/0x10 [ 932.075885][T20562] ? __pfx__printk+0x10/0x10 [ 932.075921][T20562] ? kmalloc_reserve+0xbd/0x290 [ 932.075944][T20562] ? __lock_acquire+0x6b6/0x2cf0 [ 932.075973][T20562] should_fail_ex+0x414/0x560 [ 932.076006][T20562] should_failslab+0xa8/0x100 [ 932.076028][T20562] kmem_cache_alloc_noprof+0x74/0x6f0 [ 932.076051][T20562] ? skb_clone+0x212/0x3a0 [ 932.076075][T20562] skb_clone+0x212/0x3a0 [ 932.076098][T20562] __netlink_deliver_tap+0x404/0x850 [ 932.076128][T20562] ? netlink_deliver_tap+0x2e/0x1b0 [ 932.076151][T20562] netlink_deliver_tap+0x19c/0x1b0 [ 932.076174][T20562] netlink_unicast+0x7fa/0x9e0 [ 932.076202][T20562] ? __pfx_netlink_unicast+0x10/0x10 [ 932.076223][T20562] ? netlink_sendmsg+0x642/0xb30 [ 932.076242][T20562] ? skb_put+0x11b/0x210 [ 932.076262][T20562] netlink_sendmsg+0x805/0xb30 [ 932.076291][T20562] ? __pfx_netlink_sendmsg+0x10/0x10 [ 932.076315][T20562] ? aa_sock_msg_perm+0xf1/0x1b0 [ 932.076339][T20562] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 932.076367][T20562] ? __pfx_netlink_sendmsg+0x10/0x10 [ 932.076388][T20562] __sock_sendmsg+0x21c/0x270 [ 932.076417][T20562] ____sys_sendmsg+0x505/0x820 [ 932.076443][T20562] ? __pfx_____sys_sendmsg+0x10/0x10 [ 932.076474][T20562] ? import_iovec+0x74/0xa0 [ 932.076499][T20562] ___sys_sendmsg+0x21f/0x2a0 [ 932.076524][T20562] ? __pfx____sys_sendmsg+0x10/0x10 [ 932.076552][T20562] ? rcu_read_lock_any_held+0xb3/0x120 [ 932.076606][T20562] ? __fget_files+0x2a/0x420 [ 932.076626][T20562] ? __fget_files+0x3a0/0x420 [ 932.076656][T20562] __x64_sys_sendmsg+0x19b/0x260 [ 932.076680][T20562] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 932.076710][T20562] ? __pfx_ksys_write+0x10/0x10 [ 932.076739][T20562] ? do_syscall_64+0xbe/0xf80 [ 932.076770][T20562] do_syscall_64+0xfa/0xf80 [ 932.076795][T20562] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.076814][T20562] ? clear_bhb_loop+0x60/0xb0 [ 932.076837][T20562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.076855][T20562] RIP: 0033:0x7fa2dc38f749 [ 932.076874][T20562] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 932.076891][T20562] RSP: 002b:00007fa2dd296038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 932.076920][T20562] RAX: ffffffffffffffda RBX: 00007fa2dc5e5fa0 RCX: 00007fa2dc38f749 [ 932.076934][T20562] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 932.076947][T20562] RBP: 00007fa2dd296090 R08: 0000000000000000 R09: 0000000000000000 [ 932.076959][T20562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 932.076970][T20562] R13: 00007fa2dc5e6038 R14: 00007fa2dc5e5fa0 R15: 00007fa2dc70fa28 [ 932.077001][T20562] [ 932.420417][T20572] netlink: 'syz.2.3437': attribute type 16 has an invalid length. [ 932.428419][T20572] netlink: 'syz.2.3437': attribute type 17 has an invalid length. [ 932.433338][T20567] bridge0: port 1(bridge_slave_0) entered disabled state [ 932.448091][T20567] bridge0: port 2(bridge_slave_1) entered disabled state [ 932.556356][T15264] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 932.583537][T20572] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 932.670197][T20581] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 932.705425][T15264] usb 1-1: Using ep0 maxpacket: 16 [ 932.718578][T15264] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 7.00 [ 932.728661][T15264] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.745731][T15264] usb 1-1: Product: syz [ 932.749969][T15264] usb 1-1: Manufacturer: syz [ 932.756136][T15264] usb 1-1: SerialNumber: syz [ 932.774375][T15264] usb 1-1: config 0 descriptor?? [ 932.790475][T15264] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 932.808912][T15264] usb 1-1: Detected FT2232H [ 932.984882][T20565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 933.025273][T20565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 933.056911][T15264] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 933.064161][T15264] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 933.102257][T15264] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 933.116659][T15264] usb 1-1: USB disconnect, device number 75 [ 933.123308][T15264] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 933.126533][T15264] ftdi_sio 1-1:0.0: device disconnected [ 933.167442][T20592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 933.167789][T20592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 933.231153][T20594] loop3: detected capacity change from 0 to 7 [ 933.243692][T20594] Dev loop3: unable to read RDB block 7 [ 933.243725][T20594] loop3: unable to read partition table [ 933.243845][T20594] loop3: partition table beyond EOD, truncated [ 933.243856][T20594] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 933.403730][T20599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 933.415148][T20599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 933.485250][T20601] ptrace attach of "./syz-executor exec"[19068] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c [ 933.924704][T20609] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3449'. [ 934.101136][T20612] FAULT_INJECTION: forcing a failure. [ 934.101136][T20612] name failslab, interval 1, probability 0, space 0, times 0 [ 934.143619][T20612] CPU: 1 UID: 0 PID: 20612 Comm: syz.1.3450 Tainted: G L syzkaller #0 PREEMPT(full) [ 934.143650][T20612] Tainted: [L]=SOFTLOCKUP [ 934.143658][T20612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 934.143669][T20612] Call Trace: [ 934.143677][T20612] [ 934.143686][T20612] dump_stack_lvl+0x189/0x250 [ 934.143713][T20612] ? __pfx____ratelimit+0x10/0x10 [ 934.143744][T20612] ? __pfx_dump_stack_lvl+0x10/0x10 [ 934.143766][T20612] ? __pfx__printk+0x10/0x10 [ 934.143791][T20612] ? kmalloc_reserve+0xbd/0x290 [ 934.143814][T20612] ? __lock_acquire+0x6b6/0x2cf0 [ 934.143851][T20612] should_fail_ex+0x414/0x560 [ 934.143884][T20612] should_failslab+0xa8/0x100 [ 934.143905][T20612] kmem_cache_alloc_noprof+0x74/0x6f0 [ 934.143932][T20612] ? skb_clone+0x212/0x3a0 [ 934.143959][T20612] skb_clone+0x212/0x3a0 [ 934.143984][T20612] __netlink_deliver_tap+0x404/0x850 [ 934.144019][T20612] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.144043][T20612] netlink_deliver_tap+0x19c/0x1b0 [ 934.144067][T20612] netlink_unicast+0x7fa/0x9e0 [ 934.144094][T20612] ? __pfx_netlink_unicast+0x10/0x10 [ 934.144116][T20612] ? netlink_sendmsg+0x642/0xb30 [ 934.144137][T20612] ? skb_put+0x11b/0x210 [ 934.144158][T20612] netlink_sendmsg+0x805/0xb30 [ 934.144191][T20612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.144217][T20612] ? aa_sock_msg_perm+0xf1/0x1b0 [ 934.144240][T20612] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 934.144264][T20612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.144283][T20612] __sock_sendmsg+0x21c/0x270 [ 934.144307][T20612] ____sys_sendmsg+0x505/0x820 [ 934.144329][T20612] ? __pfx_____sys_sendmsg+0x10/0x10 [ 934.144353][T20612] ? import_iovec+0x74/0xa0 [ 934.144373][T20612] ___sys_sendmsg+0x21f/0x2a0 [ 934.144393][T20612] ? __pfx____sys_sendmsg+0x10/0x10 [ 934.144415][T20612] ? rcu_read_lock_any_held+0xb3/0x120 [ 934.144457][T20612] ? __fget_files+0x2a/0x420 [ 934.144473][T20612] ? __fget_files+0x3a0/0x420 [ 934.144497][T20612] __x64_sys_sendmsg+0x19b/0x260 [ 934.144517][T20612] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 934.144542][T20612] ? __pfx_ksys_write+0x10/0x10 [ 934.144567][T20612] ? do_syscall_64+0xbe/0xf80 [ 934.144592][T20612] do_syscall_64+0xfa/0xf80 [ 934.144616][T20612] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.144632][T20612] ? clear_bhb_loop+0x60/0xb0 [ 934.144651][T20612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.144667][T20612] RIP: 0033:0x7fa2dc38f749 [ 934.144683][T20612] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 934.144698][T20612] RSP: 002b:00007fa2dd296038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 934.144716][T20612] RAX: ffffffffffffffda RBX: 00007fa2dc5e5fa0 RCX: 00007fa2dc38f749 [ 934.144729][T20612] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 934.144740][T20612] RBP: 00007fa2dd296090 R08: 0000000000000000 R09: 0000000000000000 [ 934.144750][T20612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 934.144760][T20612] R13: 00007fa2dc5e6038 R14: 00007fa2dc5e5fa0 R15: 00007fa2dc70fa28 [ 934.144787][T20612] [ 935.000462][T20633] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3454'. [ 936.092982][T20647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 936.128897][T20647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 936.305461][T20647] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 936.686567][ T2989] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 936.723727][ T2989] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 936.741395][ T2989] bond0 (unregistering): Released all slaves [ 936.774053][T20625] netlink: 'syz.0.3452': attribute type 18 has an invalid length. [ 936.802893][T20625] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3452'. [ 936.820389][ T2989] !: left promiscuous mode [ 936.916343][T20625] netlink: 'syz.0.3452': attribute type 18 has an invalid length. [ 936.917119][ T1008] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 936.933120][T20625] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3452'. [ 936.981614][ T1008] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 936.991058][ T1008] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 937.010596][ T1008] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 937.043573][ T2989] tipc: Disabling bearer [ 937.049761][ T2989] tipc: Left network mode [ 937.126359][T20667] loop3: detected capacity change from 0 to 7 [ 937.134042][T20667] Dev loop3: unable to read RDB block 7 [ 937.146869][T20667] loop3: unable to read partition table [ 937.165649][T20667] loop3: partition table beyond EOD, truncated [ 937.171892][T20667] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 937.453433][T20678] syzkaller1: entered promiscuous mode [ 937.464113][T20678] syzkaller1: entered allmulticast mode [ 937.498248][T20678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.524838][T20678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.634219][ T2989] hsr_slave_0: left promiscuous mode [ 937.653450][ T2989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 937.678085][ T2989] batadv0: mtu less than device minimum [ 937.694739][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.706548][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.718829][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.730322][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.741715][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.752978][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.764164][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.775372][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.786581][ T2989] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 937.833352][ T2989] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 937.842742][ T2989] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 937.868224][ T2989] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 937.877574][ T2989] batman_adv: batadv0: Interface deactivated: dummy0 [ 937.885079][ T2989] batman_adv: batadv0: Removing interface: dummy0 [ 937.913259][ T2989] veth1_macvtap: left promiscuous mode [ 937.919785][ T2989] veth0_macvtap: left promiscuous mode [ 937.927445][ T2989] veth1_vlan: left promiscuous mode [ 937.933123][ T2989] veth0_vlan: left promiscuous mode [ 937.945432][ T5946] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 938.099225][ T5946] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 938.108968][ T5946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 938.123661][ T5946] usb 5-1: Product: syz [ 938.140451][ T5946] usb 5-1: Manufacturer: syz [ 938.145105][ T5946] usb 5-1: SerialNumber: syz [ 938.164653][ T5946] usb 5-1: config 0 descriptor?? [ 938.173881][ T2989] team0 (unregistering): Port device batadv1 removed [ 938.181681][ T5946] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 938.612702][ T2989] team0 (unregistering): Port device team_slave_1 removed [ 938.721560][ T2989] team0 (unregistering): Port device team_slave_0 removed [ 938.888130][T20693] ptrace attach of "./syz-executor exec"[18723] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 939.245850][T20688] FAULT_INJECTION: forcing a failure. [ 939.245850][T20688] name failslab, interval 1, probability 0, space 0, times 0 [ 939.357287][T20688] CPU: 1 UID: 0 PID: 20688 Comm: syz.0.3463 Tainted: G L syzkaller #0 PREEMPT(full) [ 939.357321][T20688] Tainted: [L]=SOFTLOCKUP [ 939.357330][T20688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 939.357343][T20688] Call Trace: [ 939.357351][T20688] [ 939.357361][T20688] dump_stack_lvl+0x189/0x250 [ 939.357394][T20688] ? __pfx____ratelimit+0x10/0x10 [ 939.357420][T20688] ? __pfx_dump_stack_lvl+0x10/0x10 [ 939.357443][T20688] ? __pfx__printk+0x10/0x10 [ 939.357476][T20688] ? __pfx___might_resched+0x10/0x10 [ 939.357494][T20688] ? fs_reclaim_acquire+0x7d/0x100 [ 939.357527][T20688] should_fail_ex+0x414/0x560 [ 939.357567][T20688] should_failslab+0xa8/0x100 [ 939.357589][T20688] __kmalloc_noprof+0xcb/0x800 [ 939.357615][T20688] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 939.357645][T20688] ? rcu_is_watching+0x15/0xb0 [ 939.357674][T20688] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 939.357711][T20688] genl_family_rcv_msg_doit+0xb8/0x300 [ 939.357746][T20688] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 939.357781][T20688] ? apparmor_capable+0x137/0x1a0 [ 939.357811][T20688] ? bpf_lsm_capable+0x9/0x20 [ 939.357833][T20688] ? security_capable+0x7e/0x2e0 [ 939.357861][T20688] genl_rcv_msg+0x60e/0x790 [ 939.357895][T20688] ? __pfx_genl_rcv_msg+0x10/0x10 [ 939.357922][T20688] ? __pfx_wg_set_device_doit+0x10/0x10 [ 939.357958][T20688] netlink_rcv_skb+0x208/0x470 [ 939.357981][T20688] ? __pfx_genl_rcv_msg+0x10/0x10 [ 939.358010][T20688] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 939.358050][T20688] ? down_read+0x274/0x2e0 [ 939.358068][T20688] ? genl_rcv+0xd/0x40 [ 939.358095][T20688] genl_rcv+0x28/0x40 [ 939.358119][T20688] netlink_unicast+0x82f/0x9e0 [ 939.358149][T20688] ? __pfx_netlink_unicast+0x10/0x10 [ 939.358171][T20688] ? netlink_sendmsg+0x642/0xb30 [ 939.358192][T20688] ? skb_put+0x11b/0x210 [ 939.358214][T20688] netlink_sendmsg+0x805/0xb30 [ 939.358247][T20688] ? __pfx_netlink_sendmsg+0x10/0x10 [ 939.358273][T20688] ? aa_sock_msg_perm+0xf1/0x1b0 [ 939.358298][T20688] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 939.358326][T20688] ? __pfx_netlink_sendmsg+0x10/0x10 [ 939.358350][T20688] __sock_sendmsg+0x21c/0x270 [ 939.358380][T20688] ____sys_sendmsg+0x505/0x820 [ 939.358407][T20688] ? __pfx_____sys_sendmsg+0x10/0x10 [ 939.358438][T20688] ? import_iovec+0x74/0xa0 [ 939.358464][T20688] ___sys_sendmsg+0x21f/0x2a0 [ 939.358488][T20688] ? __pfx____sys_sendmsg+0x10/0x10 [ 939.358517][T20688] ? rcu_read_lock_any_held+0xb3/0x120 [ 939.358576][T20688] ? __fget_files+0x2a/0x420 [ 939.358601][T20688] ? __fget_files+0x3a0/0x420 [ 939.358632][T20688] __x64_sys_sendmsg+0x19b/0x260 [ 939.358657][T20688] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 939.358689][T20688] ? __pfx_ksys_write+0x10/0x10 [ 939.358720][T20688] ? do_syscall_64+0xbe/0xf80 [ 939.358749][T20688] do_syscall_64+0xfa/0xf80 [ 939.358776][T20688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 939.358794][T20688] ? clear_bhb_loop+0x60/0xb0 [ 939.358818][T20688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 939.358837][T20688] RIP: 0033:0x7fc3a398f749 [ 939.358855][T20688] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 939.358874][T20688] RSP: 002b:00007fc3a47f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 939.358895][T20688] RAX: ffffffffffffffda RBX: 00007fc3a3be6090 RCX: 00007fc3a398f749 [ 939.358911][T20688] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 939.358925][T20688] RBP: 00007fc3a47f1090 R08: 0000000000000000 R09: 0000000000000000 [ 939.358938][T20688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 939.358951][T20688] R13: 00007fc3a3be6128 R14: 00007fc3a3be6090 R15: 00007fc3a3d0fa28 [ 939.358984][T20688] [ 939.875700][ T5946] gspca_sunplus: reg_w_riv err -110 [ 939.881048][ T5946] sunplus 5-1:0.0: probe with driver sunplus failed with error -110 [ 939.969155][ T5946] usb 5-1: USB disconnect, device number 56 [ 940.251342][ T2989] IPVS: stop unused estimator thread 0... [ 940.837291][T20717] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3468'. [ 940.889437][T20717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.898794][T20717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.965967][T20719] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3471'. [ 941.014444][T20721] xt_hashlimit: max too large, truncated to 1048576 [ 941.078800][T20719] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 941.253587][T20719] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 941.493949][T20726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3473'. [ 941.775282][T20726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3473'. [ 943.275653][T20745] ptrace attach of "./syz-executor exec"[18723] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 944.650431][T20774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 945.477365][T20774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 945.546893][T20774] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20004 [ 945.554279][T20775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 945.573307][T20775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 945.623345][T20774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 945.641706][T20774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 945.984786][T20769] net_ratelimit: 30 callbacks suppressed [ 945.984809][T20769] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 946.033637][T20769] netlink: 'syz.2.3482': attribute type 4 has an invalid length. [ 946.090799][T20784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3486'. [ 946.167164][T20784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3486'. [ 946.268196][T15281] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 946.437390][T15281] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 946.454264][T15281] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 946.467653][T15281] usb 5-1: config 0 interface 0 has no altsetting 0 [ 946.474680][T15281] usb 5-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 946.485123][T15281] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.499307][T15281] usb 5-1: config 0 descriptor?? [ 946.732924][T20783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.751244][T20783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.844976][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 946.844989][ T30] audit: type=1326 audit(1764936968.409:2965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 946.924353][ T30] audit: type=1326 audit(1764936968.449:2966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 946.952224][ T30] audit: type=1326 audit(1764936968.449:2967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 946.990063][ T30] audit: type=1326 audit(1764936968.449:2968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.019182][T15281] usbhid 5-1:0.0: can't add hid device: -71 [ 947.036960][T15281] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 947.044988][ T30] audit: type=1326 audit(1764936968.459:2969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.072017][T15281] usb 5-1: USB disconnect, device number 57 [ 947.080328][ T30] audit: type=1326 audit(1764936968.459:2970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=284 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.110847][ T30] audit: type=1326 audit(1764936968.459:2971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.133702][ T30] audit: type=1326 audit(1764936968.459:2972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.227983][T15284] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 947.255377][ T30] audit: type=1326 audit(1764936968.459:2973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.308907][ T30] audit: type=1326 audit(1764936968.459:2974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20782 comm="syz.4.3487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 947.461477][T15284] usb 3-1: Using ep0 maxpacket: 8 [ 947.548172][T15284] usb 3-1: config 162 has an invalid interface number: 113 but max is 0 [ 947.556863][T15284] usb 3-1: config 162 has an invalid descriptor of length 10, skipping remainder of the config [ 947.625675][T15284] usb 3-1: config 162 has no interface number 0 [ 947.632034][T15284] usb 3-1: config 162 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 947.648578][T15284] usb 3-1: config 162 interface 113 has no altsetting 0 [ 947.658714][T15284] usb 3-1: New USB device found, idVendor=067b, idProduct=23f3, bcdDevice=68.d3 [ 947.677988][T15284] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.688740][T15284] usb 3-1: Product: syz [ 947.693085][T15284] usb 3-1: Manufacturer: syz [ 947.698927][T15284] usb 3-1: SerialNumber: syz [ 947.915511][ T5921] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 947.951715][T15284] pl2303 3-1:162.113: required endpoints missing [ 947.964268][T15284] usb 3-1: USB disconnect, device number 49 [ 948.404338][ T5921] usb 5-1: Using ep0 maxpacket: 16 [ 948.422016][ T5921] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 948.437821][ T5921] usb 5-1: config 1 has no interface number 0 [ 948.474324][ T5921] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 948.510012][ T5921] usb 5-1: config 1 interface 105 altsetting 2 endpoint 0x82 has invalid maxpacket 1224, setting to 1024 [ 948.553142][T20823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 948.574078][ T5921] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 948.612709][ T5921] usb 5-1: config 1 interface 105 has no altsetting 0 [ 948.634710][T20823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 948.635108][ T5921] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 948.677054][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.685095][ T5921] usb 5-1: Product: syz [ 948.710442][ T5921] usb 5-1: Manufacturer: syz [ 948.715128][ T5921] usb 5-1: SerialNumber: syz [ 948.747290][T20809] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 948.754556][T20809] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 948.790188][T20825] kvm: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x808 [ 948.819410][T20825] kvm: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x8e0 [ 948.843314][T20825] kvm_intel: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x827 [ 948.859647][T20825] kvm: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x867 [ 948.869812][T20832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 948.882613][T20832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 948.895745][T20825] kvm: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x827 [ 948.907143][T20825] kvm: kvm [20824]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x867 [ 949.232426][T20809] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 949.251772][T20809] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 949.668288][ T5921] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 949.683064][ T5921] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 949.718518][ T5921] aqc111 5-1:1.105 eth5: register 'aqc111' at usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, fe:ec:45:db:0a:d8 [ 949.901381][T20850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 949.913960][T20850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 949.966473][T19753] usb 5-1: USB disconnect, device number 58 [ 949.978798][T19753] aqc111 5-1:1.105 eth5: unregister 'aqc111' usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 950.186163][ T5921] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 950.226046][T19753] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 950.253537][T19753] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 950.286267][T19753] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 950.345405][ T5921] usb 3-1: device descriptor read/64, error -71 [ 950.647524][ T5921] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 950.785914][T20867] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3506'. [ 950.795692][ T5921] usb 3-1: device descriptor read/64, error -71 [ 950.917328][ T5921] usb usb3-port1: attempt power cycle [ 951.286118][ T5921] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 951.315936][ T5921] usb 3-1: device descriptor read/8, error -71 [ 951.572072][ T5921] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 951.602364][ T5921] usb 3-1: device descriptor read/8, error -71 [ 951.718033][ T5921] usb usb3-port1: unable to enumerate USB device [ 951.729466][T20885] netlink: 'syz.5.3509': attribute type 18 has an invalid length. [ 951.758097][T20885] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3509'. [ 951.783356][T20885] netlink: 'syz.5.3509': attribute type 18 has an invalid length. [ 951.801500][T20885] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3509'. [ 952.352971][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 952.352989][ T30] audit: type=1326 audit(1764936973.919:2983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20903 comm="syz.5.3513" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f187598f749 code=0x0 [ 952.782223][T20919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 952.903662][T20919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 953.035403][T15281] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 953.235413][T15281] usb 5-1: Using ep0 maxpacket: 16 [ 953.887717][T20946] binder: 20944:20946 ioctl 3ba0 200000000000 returned -22 [ 953.935409][ T5921] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 954.490149][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 954.542540][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 954.667551][ T5921] usb 3-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 954.705380][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.746215][ T5921] usb 3-1: config 0 descriptor?? [ 954.761053][T20940] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 955.046070][T20957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.074878][T20957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.097683][T15281] usb 5-1: device descriptor read/all, error -71 [ 955.109737][T20957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.122287][T20957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.361669][T20960] kAFS: unable to lookup cell '' [ 955.657339][ T5921] usbhid 3-1:0.0: can't add hid device: -71 [ 955.691033][ T5921] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 955.729332][ T5921] usb 3-1: USB disconnect, device number 54 [ 956.095590][T20975] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 956.110168][T20975] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 956.118313][T19753] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 956.226582][T20984] loop3: detected capacity change from 0 to 7 [ 956.237354][T20984] Dev loop3: unable to read RDB block 7 [ 956.242981][T20984] loop3: unable to read partition table [ 956.260048][T20984] loop3: partition table beyond EOD, truncated [ 956.268811][T20984] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 956.294389][T19753] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 956.313609][T20986] xt_CT: You must specify a L4 protocol and not use inversions on it [ 956.325414][T19753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 956.333501][T19753] usb 1-1: Product: syz [ 956.338512][T19753] usb 1-1: Manufacturer: syz [ 956.343132][T19753] usb 1-1: SerialNumber: syz [ 956.357811][T20986] netlink: 'syz.4.3534': attribute type 21 has an invalid length. [ 956.371552][T20986] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3534'. [ 956.482591][T20991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 956.493455][T20992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3536'. [ 956.494662][T20991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 956.566424][T20966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 956.587006][T20966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 956.604318][T20995] kAFS: unable to lookup cell '' [ 956.724254][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 956.742141][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 956.755439][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 956.766923][T19753] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 956.790648][T19753] usb 1-1: USB disconnect, device number 76 [ 957.102146][T21009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 957.115865][T21009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 958.046198][T21029] loop3: detected capacity change from 0 to 7 [ 958.073631][T10683] Dev loop3: unable to read RDB block 7 [ 958.079562][T15264] usb 3-1: new full-speed USB device number 55 using dummy_hcd [ 958.111334][T10683] loop3: unable to read partition table [ 958.132848][T10683] loop3: partition table beyond EOD, truncated [ 958.148773][T21029] Dev loop3: unable to read RDB block 7 [ 958.154702][T21029] loop3: unable to read partition table [ 958.177317][T21029] loop3: partition table beyond EOD, truncated [ 958.196593][T21029] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 958.257692][T15264] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 958.289157][T15264] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 958.352482][T15264] usb 3-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 958.387073][T15264] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.417966][T15264] usb 3-1: config 0 descriptor?? [ 958.430515][T21024] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 958.695498][T15281] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 958.835578][T15281] usb 1-1: device descriptor read/64, error -71 [ 959.003680][T21039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.033222][T21039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.098665][T15281] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 959.245684][T15281] usb 1-1: device descriptor read/64, error -71 [ 959.329018][T15264] usbhid 3-1:0.0: can't add hid device: -71 [ 959.335275][T15264] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 959.351094][T15264] usb 3-1: USB disconnect, device number 55 [ 959.357815][T15281] usb usb1-port1: attempt power cycle [ 959.705602][T15281] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 959.727665][T15281] usb 1-1: device descriptor read/8, error -71 [ 959.965746][T15281] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 960.017571][T15281] usb 1-1: device descriptor read/8, error -71 [ 960.057377][T21064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 960.071901][T21065] loop3: detected capacity change from 0 to 7 [ 960.082688][T10683] Dev loop3: unable to read RDB block 7 [ 960.089393][T10683] loop3: unable to read partition table [ 960.095857][T10683] loop3: partition table beyond EOD, truncated [ 960.103270][T21065] Dev loop3: unable to read RDB block 7 [ 960.109791][T21064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 960.112037][T21065] loop3: unable to read partition table [ 960.124324][T21065] loop3: partition table beyond EOD, truncated [ 960.137559][T15281] usb usb1-port1: unable to enumerate USB device [ 960.154235][T21065] loop_reread_partitions: partition scan of loop3 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 960.332965][T21073] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3562'. [ 961.845473][T15284] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 962.025473][T15284] usb 1-1: Using ep0 maxpacket: 16 [ 962.059341][T15284] usb 1-1: config 0 has an invalid interface number: 223 but max is 0 [ 962.081588][T15284] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 962.116821][T15284] usb 1-1: config 0 has no interface number 0 [ 962.247676][T15284] usb 1-1: config 0 interface 223 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 962.282158][T15284] usb 1-1: config 0 interface 223 has no altsetting 0 [ 962.318475][T15284] usb 1-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 962.358335][T15284] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 962.375632][T15284] usb 1-1: Product: syz [ 962.385741][T15284] usb 1-1: Manufacturer: syz [ 962.396808][T15284] usb 1-1: SerialNumber: syz [ 962.416996][T15284] usb 1-1: config 0 descriptor?? [ 962.535399][ T185] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 962.635800][T20250] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 962.682207][T21084] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 962.700823][ T185] usb 3-1: Using ep0 maxpacket: 8 [ 962.710762][ T185] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 962.730076][ T185] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 962.764165][ T185] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 962.777396][ T185] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 962.790546][T20250] usb 5-1: Using ep0 maxpacket: 8 [ 962.805515][ T185] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 962.820514][T20250] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 962.833613][T20250] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.846942][T15284] usb 1-1: Can not set alternate setting to 1, error: -71 [ 962.850962][ T185] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 962.873545][ T185] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.882890][T15284] synaptics_usb 1-1:0.223: probe with driver synaptics_usb failed with error -71 [ 962.887860][T20250] pvrusb2: Hardware description: Terratec Grabster AV400 [ 962.900779][T20250] pvrusb2: ********** [ 962.913102][T20250] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 962.925064][T21102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.933978][T20250] pvrusb2: Important functionality might not be entirely working. [ 962.936577][T15284] usb 1-1: USB disconnect, device number 81 [ 962.953349][T20250] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 962.965722][T20250] pvrusb2: ********** [ 962.969858][T21103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.970251][T21102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 963.002320][T21103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 963.159152][T21106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 963.173003][T21106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 963.204088][T20250] usb 5-1: USB disconnect, device number 61 [ 963.212123][ T2349] pvrusb2: Invalid write control endpoint [ 963.282933][ T2349] pvrusb2: Invalid write control endpoint [ 963.295120][ T2349] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 963.306627][ T2349] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 963.314195][ T2349] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 963.324681][ T2349] pvrusb2: Device being rendered inoperable [ 963.335087][ T2349] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 963.364902][ T2349] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 963.558615][ T2349] pvrusb2: Attached sub-driver cx25840 [ 963.600096][ T2349] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 963.632521][ T2349] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 964.128339][T20250] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 964.296052][T20250] usb 5-1: Using ep0 maxpacket: 32 [ 964.312217][T20250] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 964.354555][T20250] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 964.381119][T20250] usb 5-1: config 0 descriptor?? [ 964.593991][T20250] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 964.602914][T20250] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 964.621855][T20250] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 964.635629][T20250] usb 5-1: media controller created [ 964.751150][T20250] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 964.871853][T20250] DVB: Unable to find symbol dib7000p_attach() [ 964.882795][T20250] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 965.011357][T20250] rc_core: IR keymap rc-dib0700-rc5 not found [ 965.022002][T20250] Registered IR keymap rc-empty [ 965.031249][T20250] dvb-usb: could not initialize remote control. [ 965.040003][T20250] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 965.060455][T20250] usb 5-1: USB disconnect, device number 62 [ 965.129558][T20250] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 965.155759][T19753] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 965.325433][T19753] usb 1-1: Using ep0 maxpacket: 32 [ 965.359026][T19753] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 965.376433][T19753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.384710][T19753] usb 1-1: Product: syz [ 965.395127][T19753] usb 1-1: Manufacturer: syz [ 965.400167][T19753] usb 1-1: SerialNumber: syz [ 965.411522][T19753] usb 1-1: config 0 descriptor?? [ 965.442542][T19753] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 965.453651][ T5921] usb 3-1: USB disconnect, device number 56 [ 965.463772][T21148] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3584'. [ 965.505480][T21150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 965.514322][T21150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 965.801388][T21158] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 965.823190][T21158] bond2 (unregistering): Released all slaves [ 966.063642][T19753] gspca_ov534_9: reg_w failed -71 [ 966.405589][T19753] gspca_ov534_9: Unknown sensor 0000 [ 966.406349][T19753] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 966.425574][T19753] usb 1-1: USB disconnect, device number 82 [ 966.946297][T19753] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 967.129160][T19753] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 967.139386][T19753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.172897][T19753] usb 1-1: Product: syz [ 967.183055][T19753] usb 1-1: Manufacturer: syz [ 967.188037][T19753] usb 1-1: SerialNumber: syz [ 967.469427][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 967.493910][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 967.570281][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 967.593193][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 967.617244][T21188] kAFS: unable to lookup cell '' [ 967.634299][T19753] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 967.828799][T19753] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 967.868968][T19753] usb 1-1: USB disconnect, device number 83 [ 967.936613][ T5946] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 967.984959][ T5211] loop6: [POWERTEC] p1 p2 p3 [ 968.000012][ T5211] loop6: p1 start 1684957538 is beyond EOD, truncated [ 968.008527][ T5211] loop6: p2 size 2097152 extends beyond EOD, truncated [ 968.041429][ T5211] loop6: p3 start 1734541312 is beyond EOD, truncated [ 968.065453][ T5946] usb 3-1: device descriptor read/64, error -71 [ 968.092214][T21207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 968.132054][T21207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 968.309184][ T5946] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 968.475453][ T5946] usb 3-1: device descriptor read/64, error -71 [ 968.505768][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 968.514760][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 968.616871][ T5946] usb usb3-port1: attempt power cycle [ 968.630197][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 968.643237][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 969.245438][ T5946] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 969.316135][ T5946] usb 3-1: device descriptor read/8, error -71 [ 969.565727][ T5946] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 969.664756][ T5946] usb 3-1: device descriptor read/8, error -71 [ 969.775774][ T5946] usb usb3-port1: unable to enumerate USB device [ 969.862460][T21236] netlink: 'syz.0.3607': attribute type 15 has an invalid length. [ 969.888815][T12175] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 969.899926][T12175] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 969.908643][T12175] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 969.931120][T21236] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3607'. [ 969.941913][T12175] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 969.968014][T12175] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 970.030669][T12139] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 970.040466][T12139] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 970.050905][T12139] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 970.060122][T12139] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 970.078104][T12139] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 970.164593][T15264] usb 6-1: USB disconnect, device number 115 [ 970.484483][ T2989] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 970.499591][ T2989] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.050432][ T2989] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 971.065447][ T2989] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.177435][T20250] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 971.293968][T15264] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 971.364206][ T1008] tipc: Resetting bearer [ 971.365404][T20250] usb 1-1: Using ep0 maxpacket: 32 [ 971.382796][T21239] chnl_net:caif_netlink_parms(): no params data found [ 971.386776][T20250] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 971.405482][T20250] usb 1-1: config 0 has no interface number 0 [ 971.425433][T20250] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 971.465388][T20250] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 971.487001][T20250] usb 1-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 971.497929][ T2989] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 971.508313][ T2989] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.521323][T20250] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.527117][T15264] usb 3-1: config 0 has an invalid interface number: 231 but max is 2 [ 971.538101][T15264] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 971.544283][T20250] usb 1-1: config 0 descriptor?? [ 971.578926][T15264] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 971.611095][ T2989] batman_adv: batadv0: Interface deactivated: netdevsim0 [ 971.620012][T15264] usb 3-1: config 0 has no interface number 0 [ 971.626898][T15264] usb 3-1: config 0 interface 231 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 971.668250][T15264] usb 3-1: config 0 interface 231 has no altsetting 0 [ 971.689153][ T2989] batman_adv: batadv0: Removing interface: netdevsim0 [ 971.701473][T15264] usb 3-1: New USB device found, idVendor=19d2, idProduct=1181, bcdDevice=e8.2b [ 971.718925][T15264] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.729620][ T2989] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 971.755479][T15264] usb 3-1: Product: syz [ 971.759695][T15264] usb 3-1: Manufacturer: syz [ 971.764440][ T2989] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.779799][T21257] openvswitch: netlink: Duplicate key (type 21). [ 971.789726][T15264] usb 3-1: SerialNumber: syz [ 971.815109][T15264] usb 3-1: config 0 descriptor?? [ 971.990500][T21262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.001816][T21257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.002285][T21262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.017216][T21239] bridge0: port 1(bridge_slave_0) entered blocking state [ 972.028548][T21266] FAULT_INJECTION: forcing a failure. [ 972.028548][T21266] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 972.042163][T21239] bridge0: port 1(bridge_slave_0) entered disabled state [ 972.065017][T21239] bridge_slave_0: entered allmulticast mode [ 972.071978][T21259] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.072469][T21257] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.091276][T21239] bridge_slave_0: entered promiscuous mode [ 972.091519][T21259] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.097351][T21266] CPU: 1 UID: 0 PID: 21266 Comm: syz.1.3612 Tainted: G L syzkaller #0 PREEMPT(full) [ 972.097389][T21266] Tainted: [L]=SOFTLOCKUP [ 972.097400][T21266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 972.097413][T21266] Call Trace: [ 972.097421][T21266] [ 972.097430][T21266] dump_stack_lvl+0x189/0x250 [ 972.097565][T21266] ? __pfx____ratelimit+0x10/0x10 [ 972.097592][T21266] ? __pfx_dump_stack_lvl+0x10/0x10 [ 972.097614][T21266] ? __pfx__printk+0x10/0x10 [ 972.097652][T21266] should_fail_ex+0x414/0x560 [ 972.097684][T21266] _copy_to_user+0x31/0xb0 [ 972.097708][T21266] simple_read_from_buffer+0xe1/0x170 [ 972.097748][T21266] proc_fail_nth_read+0x1b3/0x220 [ 972.097787][T21266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 972.097817][T21266] ? rw_verify_area+0x2a6/0x4d0 [ 972.097842][T21266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 972.097870][T21266] vfs_read+0x200/0xa30 [ 972.097894][T21266] ? fdget_pos+0x247/0x320 [ 972.097918][T21266] ? __pfx___mutex_lock+0x10/0x10 [ 972.097946][T21266] ? __pfx_vfs_read+0x10/0x10 [ 972.097974][T21266] ? __fget_files+0x2a/0x420 [ 972.097996][T21266] ? __fget_files+0x3a0/0x420 [ 972.098015][T21266] ? __fget_files+0x2a/0x420 [ 972.098043][T21266] ksys_read+0x145/0x250 [ 972.098071][T21266] ? __pfx_ksys_read+0x10/0x10 [ 972.098099][T21266] ? do_syscall_64+0xbe/0xf80 [ 972.098129][T21266] do_syscall_64+0xfa/0xf80 [ 972.098157][T21266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 972.098176][T21266] ? clear_bhb_loop+0x60/0xb0 [ 972.098199][T21266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 972.098218][T21266] RIP: 0033:0x7fa2dc38e15c [ 972.098235][T21266] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 972.098252][T21266] RSP: 002b:00007fa2dd296030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 972.098273][T21266] RAX: ffffffffffffffda RBX: 00007fa2dc5e5fa0 RCX: 00007fa2dc38e15c [ 972.098288][T21266] RDX: 000000000000000f RSI: 00007fa2dd2960a0 RDI: 0000000000000004 [ 972.098300][T21266] RBP: 00007fa2dd296090 R08: 0000000000000000 R09: 0000000000000000 [ 972.098312][T21266] R10: 000000002000c0c5 R11: 0000000000000246 R12: 0000000000000001 [ 972.098325][T21266] R13: 00007fa2dc5e6038 R14: 00007fa2dc5e5fa0 R15: 00007fa2dc70fa28 [ 972.098356][T21266] [ 972.332840][T12175] Bluetooth: hci4: command tx timeout [ 972.344603][T21239] bridge0: port 2(bridge_slave_1) entered blocking state [ 972.351846][T21239] bridge0: port 2(bridge_slave_1) entered disabled state [ 972.359373][T21239] bridge_slave_1: entered allmulticast mode [ 972.367575][T21239] bridge_slave_1: entered promiscuous mode [ 972.434050][T21259] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.458838][T21259] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.513075][T21239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 972.528439][T15264] cdc_ether 3-1:0.231: skipping garbage [ 972.534031][T15264] usb 3-1: bad CDC descriptors [ 972.555102][T20250] usbhid 1-1:0.1: can't add hid device: -71 [ 972.561945][T20250] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 972.596584][T20250] usb 1-1: USB disconnect, device number 84 [ 972.638665][T15264] usb 3-1: USB disconnect, device number 61 [ 972.679774][T21239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 972.771110][ T2989] bridge_slave_1: left allmulticast mode [ 972.779789][ T2989] bridge_slave_1: left promiscuous mode [ 972.789212][ T2989] bridge0: port 2(bridge_slave_1) entered disabled state [ 972.799696][ T2989] bridge_slave_0: left allmulticast mode [ 972.805509][ T2989] bridge_slave_0: left promiscuous mode [ 972.811556][ T2989] bridge0: port 1(bridge_slave_0) entered disabled state [ 973.432097][ T2989] bond2 (unregistering): (slave gre1): Releasing backup interface [ 973.498504][ T30] audit: type=1326 audit(1764936995.069:2984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 973.522816][ T30] audit: type=1326 audit(1764936995.069:2985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 973.571520][ T2989] gre1 (unregistering): left promiscuous mode [ 973.595402][ T30] audit: type=1326 audit(1764936995.069:2986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 973.768570][T21291] usb usb8: usbfs: process 21291 (syz.4.3618) did not claim interface 0 before use [ 973.905807][ T30] audit: type=1326 audit(1764936995.069:2987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.009280][ T30] audit: type=1326 audit(1764936995.069:2988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.058606][ T30] audit: type=1326 audit(1764936995.069:2989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.133418][ T2989] bond4 (unregistering): (slave geneve2): Releasing active interface [ 974.152528][ T30] audit: type=1326 audit(1764936995.069:2990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.188690][ T30] audit: type=1326 audit(1764936995.069:2991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.275392][ T30] audit: type=1326 audit(1764936995.069:2992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.345401][ T30] audit: type=1326 audit(1764936995.069:2993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21288 comm="syz.4.3618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f5405b8f749 code=0x7ffc0000 [ 974.455615][T12175] Bluetooth: hci4: command tx timeout [ 974.785618][ T2989] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 974.795749][ T2989] bond0 (unregistering): Released all slaves [ 974.808163][ T2989] bond1 (unregistering): Released all slaves [ 974.905424][T19753] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 974.940159][ T2989] bond2 (unregistering): Released all slaves [ 975.060883][ T2989] bond3 (unregistering): (slave veth3): Releasing active interface [ 975.069503][T19753] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 975.079701][T19753] usb 1-1: config 0 interface 0 has no altsetting 0 [ 975.086510][T19753] usb 1-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 975.096036][T19753] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.096382][ T2989] bond3 (unregistering): (slave veth0_to_bond): Releasing active interface [ 975.106894][T19753] usb 1-1: config 0 descriptor?? [ 975.121888][ T2989] bond3 (unregistering): Released all slaves [ 975.262907][ T2989] bond4 (unregistering): Released all slaves [ 975.277204][T21239] team0: Port device team_slave_0 added [ 975.304210][T21291] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 975.355151][T21239] team0: Port device team_slave_1 added [ 975.395200][T21291] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 975.408949][T21291] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 975.453869][ T2989] tipc: Disabling bearer [ 975.460024][ T2989] tipc: Disabling bearer [ 975.531982][T21303] xt_TCPMSS: Only works on TCP SYN packets [ 975.560851][ T2989] tipc: Left network mode [ 975.566433][T21239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 975.576054][T21239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.719151][T21239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 975.764026][ T7576] usb 1-1: USB disconnect, device number 85 [ 975.784419][T21312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 975.793353][T21239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 975.802286][T21239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.831346][T21312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 975.852941][T21312] IPVS: set_ctl: invalid protocol: 12 172.20.20.170:20003 [ 975.880831][T21239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 975.902139][ T2989] IPVS: stopping master sync thread 19090 ... [ 976.102043][T21239] hsr_slave_0: entered promiscuous mode [ 976.117403][T21239] hsr_slave_1: entered promiscuous mode [ 976.494363][T21328] netlink: 'syz.0.3627': attribute type 4 has an invalid length. [ 976.545960][T21329] netlink: 'syz.0.3627': attribute type 4 has an invalid length. [ 976.547967][T12175] Bluetooth: hci4: command tx timeout [ 976.740847][T21337] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3628'. [ 976.964689][ T2989] hsr_slave_0: left promiscuous mode [ 976.992106][ T2989] hsr_slave_1: left promiscuous mode [ 977.004556][ T2989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 977.017751][ T2989] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 977.106177][ T2989] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 977.113585][ T2989] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 977.153841][ T2989] veth1_macvtap: left promiscuous mode [ 977.159739][ T2989] veth0_macvtap: left promiscuous mode [ 977.165932][ T2989] veth1_vlan: left promiscuous mode [ 977.171719][ T2989] veth0_vlan: left promiscuous mode [ 977.529184][ T2989] team0 (unregistering): Port device batadv1 removed [ 977.549826][ T2989] pim6reg (unregistering): left allmulticast mode [ 977.845501][T19907] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 977.964911][ T2989] team0 (unregistering): Port device team_slave_1 removed [ 977.994381][T19907] usb 5-1: device descriptor read/64, error -71 [ 978.024803][ T2989] team0 (unregistering): Port device team_slave_0 removed [ 978.245503][T19907] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 978.385405][T19907] usb 5-1: device descriptor read/64, error -71 [ 978.495975][T19907] usb usb5-port1: attempt power cycle [ 978.615580][T12175] Bluetooth: hci4: command tx timeout [ 978.635119][T21358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3632'. [ 978.775515][T19294] wlan0: Trigger new scan to find an IBSS to join [ 978.875070][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 978.875092][ T30] audit: type=1326 audit(1764937000.429:3021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 978.885620][T19907] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 978.941331][ T30] audit: type=1326 audit(1764937000.429:3022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 978.980013][T19907] usb 5-1: device descriptor read/8, error -71 [ 978.987146][ T30] audit: type=1326 audit(1764937000.429:3023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.053160][ T30] audit: type=1326 audit(1764937000.429:3024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.081605][T21368] program syz.1.3635 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 979.338261][ T30] audit: type=1326 audit(1764937000.429:3025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.361561][ T30] audit: type=1326 audit(1764937000.429:3026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.387405][ T30] audit: type=1326 audit(1764937000.429:3027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.411419][ T30] audit: type=1326 audit(1764937000.429:3028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.453787][ T30] audit: type=1326 audit(1764937000.429:3029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.479934][ T30] audit: type=1326 audit(1764937000.429:3030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21359 comm="syz.2.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f3f0878f749 code=0x7ffc0000 [ 979.504249][T19907] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 979.546739][T21364] usb usb8: usbfs: process 21364 (syz.2.3633) did not claim interface 0 before use [ 979.561711][T21364] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 979.570729][T21364] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 979.579425][T21364] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 979.626395][T19907] usb 5-1: device descriptor read/8, error -71 [ 979.766454][T19907] usb usb5-port1: unable to enumerate USB device [ 980.285022][T21239] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 980.337926][T21239] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 980.368386][T21239] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 980.392784][T21239] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 980.427800][ T2989] IPVS: stop unused estimator thread 0... [ 980.673298][T21239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 980.807769][T21239] 8021q: adding VLAN 0 to HW filter on device team0 [ 981.166764][T19753] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 981.186581][ T3863] bridge0: port 1(bridge_slave_0) entered blocking state [ 981.193732][ T3863] bridge0: port 1(bridge_slave_0) entered forwarding state [ 981.364629][ T3863] bridge0: port 2(bridge_slave_1) entered blocking state [ 981.371788][ T3863] bridge0: port 2(bridge_slave_1) entered forwarding state [ 981.466300][T19753] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 981.477693][T19753] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 981.489016][T19753] usb 5-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 981.498515][T19753] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.518626][T19753] usb 5-1: config 0 descriptor?? [ 981.533350][T21405] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 981.547823][T21417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 981.591203][T21239] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 981.601738][T21239] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 981.614261][T21417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 981.825557][ T5946] usb 3-1: new low-speed USB device number 62 using dummy_hcd [ 981.878074][T21239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 982.058389][ T5946] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 982.099269][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.114000][ T5946] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.128426][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.141357][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.157911][ T5946] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 982.165588][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.177718][ T5946] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.255442][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.325054][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.343283][ T5946] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 982.351326][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.435486][ T5946] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.475372][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.500115][ T5946] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.775575][ T3863] wlan0: Trigger new scan to find an IBSS to join [ 982.897540][ T5946] usb 3-1: string descriptor 0 read error: -22 [ 982.904175][ T5946] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 982.923797][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.041355][T21239] veth0_vlan: entered promiscuous mode [ 983.053476][T21239] veth1_vlan: entered promiscuous mode [ 983.283240][T21239] veth0_macvtap: entered promiscuous mode [ 983.311268][T21239] veth1_macvtap: entered promiscuous mode [ 983.438233][T21239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 983.542974][T21239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 983.677578][T11860] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.679769][ T5946] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 983.708187][ T5946] usb 3-1: USB disconnect, device number 62 [ 983.753691][T11860] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.778873][T11860] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.814449][T11860] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.842922][T19753] usbhid 5-1:0.0: can't add hid device: -71 [ 983.865500][T15264] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 983.884853][T19753] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 983.921004][ T2964] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 983.936450][T19753] usb 5-1: USB disconnect, device number 67 [ 983.998679][T19294] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 984.005539][T15264] usb 1-1: device descriptor read/64, error -71 [ 984.018301][T21438] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3647'. [ 984.045368][T19294] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 984.108993][ T2964] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 984.128883][ T2964] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 984.246846][T15264] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 984.431540][T21453] vlan2: entered allmulticast mode [ 984.438220][T21453] bridge0: port 3(vlan2) entered blocking state [ 984.444994][T21453] bridge0: port 3(vlan2) entered disabled state [ 984.458813][T21453] vlan2: entered promiscuous mode [ 984.472320][ T7576] usb 3-1: new full-speed USB device number 63 using dummy_hcd [ 984.472647][T19753] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 984.480338][T15264] usb 1-1: device descriptor read/64, error -71 [ 984.607497][T15264] usb usb1-port1: attempt power cycle [ 984.648110][ T7576] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 984.657201][ T7576] usb 3-1: config 0 has no interface number 1 [ 984.668553][ T7576] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 984.672010][T19753] usb 5-1: config 0 has an invalid interface number: 160 but max is 0 [ 984.718499][T19753] usb 5-1: config 0 has no interface number 0 [ 984.765263][T19753] usb 5-1: config 0 interface 160 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 984.779660][ T7576] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 984.792248][ T7576] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 984.793988][T19753] usb 5-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=9e.4e [ 984.813962][ T7576] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 984.826665][T19753] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.865045][ T7576] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 984.873637][T19753] usb 5-1: Product: syz [ 984.902841][T19753] usb 5-1: Manufacturer: syz [ 984.907795][T19753] usb 5-1: SerialNumber: syz [ 984.908179][ T7576] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 984.930917][T19753] usb 5-1: config 0 descriptor?? [ 984.942480][ T7576] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 984.943996][T19753] uvcvideo 5-1:0.160: Found UVC 0.00 device syz (05ac:8501) [ 984.951877][T15264] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 984.975587][T19753] uvcvideo 5-1:0.160: No valid video chain found. [ 985.033938][T15264] usb 1-1: device descriptor read/8, error -71 [ 985.045211][ T7576] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.055328][ T7576] usb 3-1: Product: syz [ 985.059616][ T7576] usb 3-1: Manufacturer: syz [ 985.064196][ T7576] usb 3-1: SerialNumber: syz [ 985.072045][ T7576] usb 3-1: config 0 descriptor?? [ 985.082088][T21440] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 985.112928][ T7576] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 985.139375][ T7576] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 985.160625][T21438] netlink: 7076 bytes leftover after parsing attributes in process `syz.4.3647'. [ 985.210357][T21438] openvswitch: netlink: Flow key attr not present in new flow. [ 985.233955][T15281] usb 5-1: USB disconnect, device number 68 [ 985.277284][ T7576] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 985.286993][T15264] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 985.316055][T15264] usb 1-1: device descriptor read/8, error -71 [ 985.463459][T15264] usb usb1-port1: unable to enumerate USB device [ 987.082434][T21499] loop9: detected capacity change from 0 to 7 [ 987.095038][T21499] Dev loop9: unable to read RDB block 7 [ 987.518366][T21499] loop9: unable to read partition table [ 987.685778][T21499] loop9: partition table beyond EOD, truncated [ 987.692015][T21499] loop_reread_partitions: partition scan of loop9 (ўшЂЋxќ—Ÿбр– ) failed (rc=-5) [ 987.902512][ T5946] usb 3-1: USB disconnect, device number 63 [ 988.055855][T15281] usb 1-1: new full-speed USB device number 90 using dummy_hcd [ 988.243857][T15281] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 988.265270][T21517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 988.304228][T15281] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 988.345531][T15281] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 988.354697][T15281] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 988.363101][T21517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 988.395463][T15281] usb 1-1: config 0 descriptor?? [ 988.404318][T21500] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 988.689163][T15281] usbhid 1-1:0.0: can't add hid device: -71 [ 988.708425][T15281] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 988.720885][T15281] usb 1-1: USB disconnect, device number 90 [ 989.089935][T21532] bridge0: port 2(bridge_slave_1) entered disabled state [ 989.097760][T21532] bridge0: port 1(bridge_slave_0) entered disabled state [ 989.207633][T15281] usb 3-1: new low-speed USB device number 64 using dummy_hcd [ 989.417408][T15281] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 989.430118][T15281] usb 3-1: config 179 has no interface number 0 [ 989.440495][T15281] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 989.463512][T15281] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 989.484967][T15281] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 989.569925][T15281] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 58368, setting to 8 [ 989.585353][T15281] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 989.609195][T15281] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 989.618755][T15281] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 989.657401][ T5946] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 989.794688][T21534] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 989.834971][T15281] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 989.845716][ T5946] usb 6-1: Using ep0 maxpacket: 8 [ 989.975523][T15281] xpad 3-1:179.65: probe with driver xpad failed with error -90 [ 990.028356][ T5946] usb 6-1: config 127 has an invalid interface number: 171 but max is 1 [ 990.037488][ T5946] usb 6-1: config 127 has no interface number 1 [ 990.043820][ T5946] usb 6-1: config 127 interface 171 has no altsetting 0 [ 990.081384][ T5946] usb 6-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 990.123071][ T5946] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 990.138186][ T5946] usb 6-1: Product: syz [ 990.145766][ T5946] usb 6-1: Manufacturer: syz [ 990.394820][ T5946] usb 6-1: SerialNumber: syz [ 990.510566][T19907] usb 3-1: USB disconnect, device number 64 [ 991.721636][T21576] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3667'. [ 992.040854][T21576] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3667'. [ 992.315437][T20250] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 992.451164][ T5946] xr_serial 6-1:127.171: xr_serial converter detected [ 992.483485][ T5946] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 992.493049][T20250] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 992.517168][ T5946] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 992.533065][T20250] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 992.555651][T20250] usb 1-1: config 0 has no interface number 0 [ 992.571803][ T5946] usb 6-1: USB disconnect, device number 116 [ 992.589576][T20250] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 992.610805][ T5946] xr_serial 6-1:127.171: device disconnected [ 992.617139][T20250] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.646320][T20250] usb 1-1: Product: syz [ 992.654522][T20250] usb 1-1: Manufacturer: syz [ 992.665385][T20250] usb 1-1: SerialNumber: syz [ 992.687321][T20250] usb 1-1: config 0 descriptor?? [ 992.718342][T20250] ims_pcu 1-1:0.41: Missing CDC union descriptor [ 992.729428][T20250] ims_pcu 1-1:0.41: probe with driver ims_pcu failed with error -22 [ 992.826749][T21598] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3670'. [ 992.950931][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.958749][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.983048][ T7576] usb 1-1: USB disconnect, device number 91 [ 993.403319][T21604] netlink: 'syz.2.3673': attribute type 15 has an invalid length. [ 993.437622][T21604] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3673'. [ 993.485430][T15284] usb 6-1: new full-speed USB device number 117 using dummy_hcd [ 993.531524][T21607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 993.541828][T21607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 993.647784][T15284] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 993.660425][T15284] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 993.673239][T15284] usb 6-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 993.683233][T15284] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 993.696976][T15284] usb 6-1: config 0 descriptor?? [ 993.712973][T21602] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 994.517297][T21616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 994.539438][T21616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 994.668329][T15264] usb 1-1: new full-speed USB device number 92 using dummy_hcd [ 994.908745][T15264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 994.946342][T15264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 994.946399][T15264] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 994.946423][T15264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.949783][T15264] usb 1-1: config 0 descriptor?? [ 994.974451][T21614] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 995.065513][T20250] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 995.225479][T20250] usb 3-1: Using ep0 maxpacket: 16 [ 995.231894][T21625] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3679'. [ 995.240064][T20250] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 995.254045][T20250] usb 3-1: config 0 interface 0 has no altsetting 0 [ 995.260819][T20250] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 995.285682][T20250] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.305142][T21625] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3679'. [ 995.322227][T20250] usb 3-1: config 0 descriptor?? [ 996.126237][T21637] usb usb8: usbfs: process 21637 (syz.2.3677) did not claim interface 0 before use [ 996.139680][T15284] usbhid 6-1:0.0: can't add hid device: -71 [ 996.147440][T15284] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 996.158531][T15284] usb 6-1: USB disconnect, device number 117 [ 996.479689][T21634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 996.679501][T21634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 997.113363][T15264] usbhid 1-1:0.0: can't add hid device: -71 [ 997.147359][T15264] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 997.178317][T15264] usb 1-1: USB disconnect, device number 92 [ 997.463875][T20250] usbhid 3-1:0.0: can't add hid device: -71 [ 997.492679][T20250] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 997.536300][T20250] usb 3-1: USB disconnect, device number 65 [ 997.721543][T21651] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 997.734393][T21651] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 997.765414][T19907] usb 6-1: new full-speed USB device number 118 using dummy_hcd [ 997.905601][T19907] usb 6-1: device descriptor read/64, error -71 [ 998.158766][T19907] usb 6-1: new full-speed USB device number 119 using dummy_hcd [ 998.295568][T19907] usb 6-1: device descriptor read/64, error -71 [ 998.406122][T19907] usb usb6-port1: attempt power cycle [ 998.509182][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 998.509202][ T30] audit: type=1326 audit(1764937020.079:3059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.565911][ T30] audit: type=1326 audit(1764937020.079:3060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.590213][ T30] audit: type=1326 audit(1764937020.119:3061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.613626][ T30] audit: type=1326 audit(1764937020.119:3062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.651290][T21666] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 998.657810][T21666] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 998.718893][T21666] vhci_hcd vhci_hcd.0: Device attached [ 998.724607][ T30] audit: type=1326 audit(1764937020.139:3063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=243 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.769366][T21668] vhci_hcd: connection closed [ 998.769835][ T2989] vhci_hcd: stop threads [ 998.786261][T19907] usb 6-1: new full-speed USB device number 120 using dummy_hcd [ 998.805421][ T2989] vhci_hcd: release socket [ 998.810244][T19907] usb 6-1: device descriptor read/8, error -71 [ 998.850418][ T2989] vhci_hcd: disconnect device [ 998.895437][ T30] audit: type=1326 audit(1764937020.139:3064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 998.984643][ T30] audit: type=1326 audit(1764937020.139:3065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 999.018053][ T30] audit: type=1326 audit(1764937020.159:3066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 999.085581][ T30] audit: type=1326 audit(1764937020.159:3067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 999.177104][T19907] usb 6-1: new full-speed USB device number 121 using dummy_hcd [ 999.204590][ T30] audit: type=1326 audit(1764937020.159:3068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21664 comm="syz.1.3691" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2dc38f749 code=0x7ffc0000 [ 999.272376][T19907] usb 6-1: device descriptor read/8, error -71 [ 999.364376][T21678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 999.374329][T21678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 999.485844][T19907] usb usb6-port1: unable to enumerate USB device [ 999.585447][ T9] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 999.737974][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 999.747287][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 999.760144][ T9] usb 1-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 999.807382][ T9] usb 1-1: config 1 interface 0 has no altsetting 1 [ 999.817684][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 999.827270][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.835276][ T9] usb 1-1: Product: syz [ 999.840219][ T9] usb 1-1: Manufacturer: syz [ 999.844822][ T9] usb 1-1: SerialNumber: syz [ 999.936927][ T9] smsusb:smsusb_probe: board id=8, interface number 0 [ 1000.074665][T21686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.131362][ T9] smsusb:smsusb_probe: Device initialized with return code -19 [ 1000.196051][T21686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.363083][ T9] usb 1-1: USB disconnect, device number 93 [ 1000.616435][T15264] usb 3-1: new full-speed USB device number 66 using dummy_hcd [ 1000.862967][T15264] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1000.916877][T11860] wlan0: Trigger new scan to find an IBSS to join [ 1000.945683][T21696] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3697'. [ 1000.954709][T15264] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1000.994042][T15264] usb 3-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 1001.040648][T15264] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.052990][T21687] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1001.059789][T21687] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1001.148281][T15264] usb 3-1: config 0 descriptor?? [ 1001.158593][T21690] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1001.195939][T21687] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1001.951143][T21704] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3699'. [ 1002.151523][T21713] ptrace attach of "./syz-executor exec"[18582] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 1003.017007][T15264] usbhid 3-1:0.0: can't add hid device: -71 [ 1003.122679][T12175] Bluetooth: hci4: command 0x0c1a tx timeout [ 1003.165510][T15264] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1003.186889][T15264] usb 3-1: USB disconnect, device number 66 [ 1003.375611][T21730] netlink: 'syz.0.3703': attribute type 4 has an invalid length. [ 1003.431159][T21731] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3706'. [ 1003.883424][T21731] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3706'. [ 1005.230288][T12175] Bluetooth: hci4: command 0x0c1a tx timeout [ 1005.328906][ T5921] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1005.745972][T21755] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3710'. [ 1005.805451][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 1005.817959][T14211] wlan0: Trigger new scan to find an IBSS to join [ 1005.843429][ T5921] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1005.863050][ T5921] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.969820][ T5921] usb 6-1: Product: syz [ 1005.974032][ T5921] usb 6-1: Manufacturer: syz [ 1006.010019][ T5921] usb 6-1: SerialNumber: syz [ 1006.051107][ T5921] usb 6-1: config 0 descriptor?? [ 1006.103198][ T5921] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1006.118571][T21761] syz_tun: entered allmulticast mode [ 1006.143225][T21760] syz_tun: left allmulticast mode [ 1006.188302][ T5921] usb 6-1: setting power ON [ 1006.192871][ T5921] dvb-usb: bulk message failed: -22 (2/0) [ 1006.268454][ T5921] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1006.326338][ T5921] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1006.454671][ T5921] usb 6-1: media controller created [ 1006.479208][ T5921] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1006.506041][ T5921] usb 6-1: selecting invalid altsetting 6 [ 1006.511888][ T5921] usb 6-1: digital interface selection failed (-22) [ 1006.535713][ T5921] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1006.633338][ T5921] usb 6-1: setting power OFF [ 1006.640930][ T5921] dvb-usb: bulk message failed: -22 (2/0) [ 1006.658725][ T5921] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1006.731736][ T5921] (NULL device *): no alternate interface [ 1006.889111][ T5921] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1006.906149][T12217] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.255678][T12175] Bluetooth: hci4: command 0x0c1a tx timeout [ 1007.275585][T15281] usb 5-1: new full-speed USB device number 69 using dummy_hcd [ 1007.515134][T15281] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1007.537674][T15281] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1007.563209][T15281] usb 5-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 1007.581628][T15281] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1007.659410][T15281] usb 5-1: config 0 descriptor?? [ 1007.716705][T21780] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1007.933140][T21789] ptrace attach of "./syz-executor exec"[18723] was attempted by " Рџ аџ №Ѕ Рџ Рџ аџ рџ №џ Аџ Рџ џџџџ   \x0c 8   \x09 §џџџџџџџ ўџџњ џџџџ [ 1008.435817][T19907] usb 6-1: USB disconnect, device number 122 [ 1008.936021][ T31] INFO: task kworker/0:5:13303 blocked for more than 143 seconds. [ 1008.959552][ T31] Tainted: G L syzkaller #0 [ 1008.973098][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1009.010067][ T31] task:kworker/0:5 state:D stack:20848 pid:13303 tgid:13303 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1009.160282][ T31] Workqueue: usb_hub_wq hub_event [ 1009.217782][ T31] Call Trace: [ 1009.262939][ T31] [ 1009.368592][ T31] __schedule+0x14bc/0x5000 [ 1009.475510][ T31] ? __pfx___schedule+0x10/0x10 [ 1009.705536][ T31] ? schedule+0x91/0x360 [ 1009.732429][ T31] schedule+0x165/0x360 [ 1009.832860][ T31] schedule_timeout+0x9a/0x270 [ 1009.844494][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1009.850352][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1009.856323][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1009.861812][ T31] ? wait_for_completion+0x267/0x5d0 [ 1009.868730][ T31] wait_for_completion+0x2bf/0x5d0 [ 1009.912619][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1009.964066][ T31] i2c_del_adapter+0x568/0x6c0 [ 1009.991103][ T31] ? kfree+0x1c0/0x660 [ 1009.999522][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1010.007184][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 1010.022382][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 1010.028481][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 1010.033893][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 1010.040149][ T31] usb_probe_interface+0x668/0xc30 [ 1010.045863][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 1010.055625][ T31] really_probe+0x26d/0x9e0 [ 1010.065047][ T31] __driver_probe_device+0x18c/0x2f0 [ 1010.072261][T15281] usbhid 5-1:0.0: can't add hid device: -71 [ 1010.116123][ T31] driver_probe_device+0x4f/0x430 [ 1010.123569][T15281] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1010.245574][ T31] __device_attach_driver+0x2ce/0x530 [ 1010.254527][ T31] bus_for_each_drv+0x251/0x2e0 [ 1010.260917][T15281] usb 5-1: USB disconnect, device number 69 [ 1010.267119][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1010.284293][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1010.292039][ T31] __device_attach+0x2b8/0x400 [ 1010.305487][ T31] ? __pfx___device_attach+0x10/0x10 [ 1010.313301][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1010.334842][ T31] bus_probe_device+0x185/0x260 [ 1010.344981][ T31] device_add+0x7b6/0xb50 [ 1010.353311][ T31] usb_set_configuration+0x1a87/0x20e0 [ 1010.361510][ T31] usb_generic_driver_probe+0x8d/0x150 [ 1010.369142][ T31] usb_probe_device+0x1c4/0x390 [ 1010.374286][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 1010.381374][ T31] really_probe+0x26d/0x9e0 [ 1010.386277][ T31] __driver_probe_device+0x18c/0x2f0 [ 1010.391749][ T31] driver_probe_device+0x4f/0x430 [ 1010.401806][ T31] __device_attach_driver+0x2ce/0x530 [ 1010.420828][ T31] bus_for_each_drv+0x251/0x2e0 [ 1010.430920][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1010.444041][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1010.457849][ T31] __device_attach+0x2b8/0x400 [ 1010.464959][ T31] ? __pfx___device_attach+0x10/0x10 [ 1010.478133][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1010.485877][ T31] bus_probe_device+0x185/0x260 [ 1010.490849][ T31] device_add+0x7b6/0xb50 [ 1010.499752][ T31] usb_new_device+0xa39/0x16f0 [ 1010.505841][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 1010.515658][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1010.525617][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1010.531528][ T31] hub_event+0x2958/0x4a20 [ 1010.542828][ T31] ? __pfx_hub_event+0x10/0x10 [ 1010.548868][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1010.564914][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1010.571153][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1010.585475][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1010.593614][ T31] process_scheduled_works+0xad1/0x1770 [ 1010.605463][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1010.612866][ T31] worker_thread+0x8a0/0xda0 [ 1010.621757][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1010.629592][ T31] ? __kthread_parkme+0x7b/0x200 [ 1010.635471][ T9] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1010.635804][ T31] kthread+0x711/0x8a0 [ 1010.655516][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1010.660876][ T31] ? __pfx_kthread+0x10/0x10 [ 1010.665937][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1010.671332][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1010.677796][ T31] ? __pfx_kthread+0x10/0x10 [ 1010.684809][ T31] ret_from_fork+0x599/0xb30 [ 1010.689763][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1010.695725][ T31] ? __switch_to_asm+0x39/0x70 [ 1010.700549][ T31] ? __switch_to_asm+0x33/0x70 [ 1010.705647][ T31] ? __pfx_kthread+0x10/0x10 [ 1010.710258][ T31] ret_from_fork_asm+0x1a/0x30 [ 1010.715037][ T31] [ 1010.719045][ T31] [ 1010.719045][ T31] Showing all locks held in the system: [ 1010.728658][ T31] 6 locks held by kworker/0:0/9: [ 1010.733622][ T31] #0: ffff8880226a7948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1010.759044][ T31] #1: ffffc900000e7b80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1010.784523][ T31] #2: ffff88802877b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 1010.795448][ T9] usb 6-1: device descriptor read/64, error -71 [ 1010.829392][ T31] #3: ffff88802877e518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21b8/0x4a20 [ 1010.850314][ T31] #4: ffff8880287fa368 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21e5/0x4a20 [ 1010.860756][ T31] #5: ffff8880b883a7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 1010.871207][ T31] 1 lock held by khungtaskd/31: [ 1010.876277][ T31] #0: ffffffff8df41cc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1010.886257][ T31] 2 locks held by getty/5606: [ 1010.890943][ T31] #0: ffff888033c1f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1010.901684][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1010.913068][ T31] 4 locks held by udevd/11503: [ 1010.917921][ T31] #0: ffff88806436ad58 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe20 [ 1010.927792][ T31] #1: ffff888059779488 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 [ 1010.937515][ T31] #2: ffff888054de6968 (kn->active#21){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 1010.948510][ T31] #3: ffff8881442e1198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1010.958072][ T31] 5 locks held by kworker/0:5/13303: [ 1010.963367][ T31] #0: ffff8880226a7948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1010.976019][ T31] #1: ffffc9000c487b80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1010.987973][ T31] #2: ffff8880285f3198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 1010.996936][ T31] #3: ffff8881442e1198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1011.006275][ T31] #4: ffff888046a4e160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1011.017993][ T31] 2 locks held by kworker/u8:25/19293: [ 1011.024190][ T31] #0: ffff888140f21148 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1011.035507][ T9] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1011.043279][ T31] #1: ffffc90004a17b80 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1011.056641][ T31] [ 1011.058982][ T31] ============================================= [ 1011.058982][ T31] [ 1011.083392][ T31] NMI backtrace for cpu 0 [ 1011.083414][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1011.083435][ T31] Tainted: [L]=SOFTLOCKUP [ 1011.083439][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1011.083446][ T31] Call Trace: [ 1011.083451][ T31] [ 1011.083456][ T31] dump_stack_lvl+0x189/0x250 [ 1011.083474][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1011.083487][ T31] ? __pfx__printk+0x10/0x10 [ 1011.083508][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1011.083523][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1011.083545][ T31] ? __pfx__printk+0x10/0x10 [ 1011.083573][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1011.083604][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1011.083626][ T31] watchdog+0xf3c/0xf80 [ 1011.083643][ T31] ? watchdog+0x1e2/0xf80 [ 1011.083659][ T31] kthread+0x711/0x8a0 [ 1011.083674][ T31] ? __pfx_watchdog+0x10/0x10 [ 1011.083687][ T31] ? __pfx_kthread+0x10/0x10 [ 1011.083701][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1011.083715][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1011.083729][ T31] ? __pfx_kthread+0x10/0x10 [ 1011.083743][ T31] ret_from_fork+0x599/0xb30 [ 1011.083754][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1011.083768][ T31] ? __switch_to_asm+0x39/0x70 [ 1011.083780][ T31] ? __switch_to_asm+0x33/0x70 [ 1011.083792][ T31] ? __pfx_kthread+0x10/0x10 [ 1011.083806][ T31] ret_from_fork_asm+0x1a/0x30 [ 1011.083826][ T31] [ 1011.083830][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1011.243229][ C1] NMI backtrace for cpu 1 [ 1011.243249][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1011.243274][ C1] Tainted: [L]=SOFTLOCKUP [ 1011.243281][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1011.243296][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1011.243326][ C1] Code: 53 ec 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 fd 1b 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1011.243342][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 1011.243360][ C1] RAX: af83d4a9ec0dbf00 RBX: ffffffff8197438a RCX: af83d4a9ec0dbf00 [ 1011.243377][ C1] RDX: 0000000000000001 RSI: ffffffff8d78259c RDI: ffffffff8bbffbe0 [ 1011.243390][ C1] RBP: ffffc90000197f10 R08: ffff8880b893359b R09: 1ffff110171266b3 [ 1011.243404][ C1] R10: dffffc0000000000 R11: ffffed10171266b4 R12: ffffffff8f811670 [ 1011.243418][ C1] R13: 1ffff11003957b70 R14: 0000000000000001 R15: 0000000000000001 [ 1011.243430][ C1] FS: 0000000000000000(0000) GS:ffff888126192000(0000) knlGS:0000000000000000 [ 1011.243445][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1011.243458][ C1] CR2: 00007fc3a3bb7198 CR3: 000000002a074000 CR4: 00000000003526f0 [ 1011.243473][ C1] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 1011.243485][ C1] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1011.243498][ C1] Call Trace: [ 1011.243506][ C1] [ 1011.243513][ C1] default_idle+0x13/0x20 [ 1011.243531][ C1] default_idle_call+0x73/0xb0 [ 1011.243549][ C1] do_idle+0x1ea/0x520 [ 1011.243568][ C1] ? ct_nmi_exit+0x14b/0x1d0 [ 1011.243595][ C1] ? __pfx_do_idle+0x10/0x10 [ 1011.243622][ C1] cpu_startup_entry+0x44/0x60 [ 1011.243641][ C1] start_secondary+0x101/0x110 [ 1011.243666][ C1] common_startup_64+0x13e/0x147 [ 1011.243695][ C1] [ 1011.535423][ T9] usb 6-1: device descriptor read/64, error -71 [ 1011.645725][ T9] usb usb6-port1: attempt power cycle [ 1014.636598][ T5211] udevd[5211]: worker [11503] /devices/platform/dummy_hcd.1/usb2/2-1 is taking a long time [ 1015.976055][ T1336] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1018.537728][ T5925] kworker/1:6 (5925) used greatest stack depth: 15864 bytes left