last executing test programs: 11m49.071993871s ago: executing program 0 (id=415): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0xa0002) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r6, 0xc0505405, &(0x7f0000001200)={{0x3, 0x2, 0x1, 0x3}, 0x400, 0x4, 0x6}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)={{0x1, 0x1, 0x18, r1, {0x80}}, './file0\x00'}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r9, 0x0, 0x48b, &(0x7f0000000100)={0x2, 'geneve0\x00', 0x2a34}, 0x18) getsockopt$IP_VS_SO_GET_DAEMON(r9, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) fsopen(&(0x7f0000000140)='exfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='\xc5% ', &(0x7f00000008c0)='0X#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) fstat(r1, 0x0) quotactl$Q_GETQUOTA(0xffffffff80000701, 0x0, 0x0, &(0x7f0000000340)) r11 = dup(r10) ioctl$KVM_SET_MSRS(r11, 0xc008ae88, &(0x7f00000000c0)=ANY=[@ANYBLOB="82000000000000048d"]) 11m46.185746459s ago: executing program 0 (id=419): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000080)={0xffff7fff, 0xfffffffa, 0x10000}, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x8002, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x9b) socket$packet(0x11, 0x2, 0x300) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x1104004, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="050000008f000000d4000000100000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000280)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x3}, 0x10}, 0x94) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff}) lseek(r2, 0xe, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) 11m45.837935954s ago: executing program 0 (id=421): utimensat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', &(0x7f0000000080)={{0x0, 0xea60}, {0x0, 0xffffffffffffffff}}, 0x0) setxattr$trusted_overlay_opaque(&(0x7f00000005c0)='./file0\x00', 0x0, 0x0, 0x0, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) getpriority(0x2, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0x106f, &(0x7f0000000040)={0x0, 0x1, 0x40, 0x2, 0x401a}, &(0x7f0000000100), 0x0) r1 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='%(0.', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=@base={0x1, 0x8, 0x4932, 0x7f, 0x1, 0x1}, 0xab) syz_usb_connect(0x2, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000200)={@initdev, 0x0}, 0x0) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f0000000f00)=0x5) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000ec0)={r2, r3, 0x25, 0x0, @void}, 0x10) r4 = socket$isdn(0x22, 0x2, 0x26) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x80044944, 0x0) syz_open_dev$evdev(&(0x7f0000000600), 0x6a28, 0x309000) syz_usb_connect(0x2, 0x653, &(0x7f0000000640)={{0x12, 0x1, 0x110, 0x1a, 0xaf, 0x26, 0xff, 0xaf0, 0x7041, 0x9d5f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x641, 0x1, 0x2, 0x2, 0x100, 0x84, [{{0x9, 0x4, 0xbc, 0x2, 0xf, 0x3f, 0xfd, 0x20, 0x4, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "8181d282"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x75f3e095, 0x4, 0x31ba, 0x3}}], [{{0x9, 0x5, 0xe, 0x10, 0x3ff, 0x4, 0x13, 0x56, [@generic={0xba, 0x21, "4a9261669be6de1182fa855526f98e2d250d5d730b3ade70f3c92894f0a44cb2fe4bb5ef178b033da667b7ca7370e96fe36db65360b9a3bfc84f685505f6f37587b9a7a730b6f77e74ed0faf2b25774eadcc9fcb1ae4533fd577af80dc749794c36102d182f6f2abf6c8f5dc94d3cedb1b35a6ebb9e1da0e937c00ab76a181b207e7b264fded7cec9cf2ca5cbe92a5a0770941abc664dbacb0520c7a146004a4ac4291419919cc9d36944d579acf69bea3baf9ec1b3837f7"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x40, 0x4, 0x4, 0x6}}, {{0x9, 0x5, 0x2, 0x0, 0x20, 0xff, 0x7, 0x8, [@generic={0xdc, 0xc, "0b0ee24983327137fcf3e5de2423b962089e923eb237c8aeca997e093770ca21ab2143e394241417b0bb325add1d73151ac4cfa6e2726a83f784dafaf190e90cc9e44f5432553f1f832197815efd9d8ed2dafb3acc6667b03c245ea70189c32aa281b72ca82837d054a5f7380cfeb6203329055efbfd855136c30efe95551d64fa107623e811d8898cca23129026f63b63fd6724f59a3ab2caafd35531f4e708c86b98cfc91fc955fff42b6744a7c19b4897b55d2ccd6c22d62dc463c3bdc560bd6a196733cc5bfc3067c04c1e77b83f5996f82c8d28797ea8b3"}, @generic={0x6d, 0x31, "5412b03c6e28e1d628db3526466b1eb7bbfe770888eaad6a5cfcca99c7ebeb89b3f382c7de94969759f8ba533aa1daa084d9232d3f8953d403424f607259076a38dddb99aaee64c8a2612fa3fe80d7f040480ed4400b55d6f4ce21cc375d00ef5b0596083a842a036a4336"}]}}, {{0x9, 0x5, 0x1, 0x3, 0x20, 0x7, 0x5, 0xb, [@generic={0x6b, 0x4, "2527d7dd2636565dddb1180372ea6fa9e95bbdf60248af839cecb326899993c3cbb2dbe994d180bbf7421e83cb33e5be8bcc536d1be810c16c7256030b28735cf6d71bc4f5406d76229ec0454b97e69612f71891d2c4612f84d9ff4659b668bb29b347ae3a01a77732"}]}}, {{0x9, 0x5, 0xf, 0x1, 0x20, 0xc, 0x3, 0x2}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0xb, 0x6, 0xff, [@generic={0xb6, 0x31, "8f837530f14bfb847b8f0079b39cec763603c29c2fca8556c788824359c7f8061b728f404882f9824889ba9b28136e63825918f0107d7f5e4177a08cf27d6c5809099b71f551a69631ec03fc3dc781769587f3967d73f08099350fca84b4814bc0a7c26b58004767680b6b023a4e0719100cf520e5008a6db802a0696dcba70777e6a5b672a55ca81b070e3ed3f104dc8fc47c8169c1b89987061fd382984ce6ca19578dcf5315ddad04c3ec2c10c21c1ad6cc44"}, @generic={0xa5, 0xd, "571598f393d7949b771a63cb9fd62fc0128b344155e9e3a02434ea4a247f370908c1a52f39af49e26c87a9100ac8ae336eabdcda5d8bc69601ac1b8f73885e9dcc9f8462f0a270b3dbf7f569999f141a1ee8b5e90fdca1ede930a4917da81c28f23244a067cd06b8a3aff90daada39beb282a9ce2ff6a8b687b4a1b13d4701c32313c0d8c07f23b2b7fb68081134fa676b861404b202c3efac962c461b0a10303cc71a"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x4b, 0x0, 0x7, [@generic={0xf5, 0xb, "2ec158430079c9be99a8a3f1f6aa71ba1dd551fbf4ff28e5d39ec356a1adab02898d684bc8aff61ac2268a35dbea71c4a7372915783cb48a2afa438aed73341d49b7b4aba1757e0e585b3edab285a7b9602e2f3be615a7896a0141ce82775fd9b41686e3c0b69d919a2019ca2d18853dbb7255c87d812bcebdeea1e4ce7b9aa3d75e7c98be12a7055b23fffb245d6137fc261c9621a8b048da16c1951b8c3c880a9a7436edffd3ec762b0373999fb95552859a4821f3f2be7e8f9b98b5cc501e36b9887f72cce30da67e715840ff85b695bae9b67ba1ea5ff7e6ecedd5a4872833b43aa71ba8d51b83c3cd293d50593d74071f"}]}}, {{0x9, 0x5, 0x8, 0x3, 0x40, 0x5, 0x1, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x980d}]}}, {{0x9, 0x5, 0x3, 0x4, 0x10, 0x0, 0x80, 0xd, [@generic={0x5, 0x23, "7ce148"}, @generic={0x2, 0x4}]}}, {{0x9, 0x5, 0x82, 0x8, 0x10, 0x1, 0x2, 0x80, [@generic={0xac, 0x4, "9394f25614c56ac369a1ef726280e4ef52945121bcd915f4a03ea75bb5b0e9ff75edd635059b1f9c84b70bd6e6c116d38ceb1c9670952402ae27960a4ae9e149bb246d374a2936b0128f141ea2192b10491ac228110a758d878ac583fa798f92d208f20eb62e7431cf24b6b6eab065aa6e41531c689d1c8707d487cf5d1b153bacea2e136d8bc38953d2df0c85c61e47e990b182fa71e58f60d70c8d979cab9505a3e58cc8611ebc6a45"}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x7f, 0x98, 0x5}}, {{0x9, 0x5, 0xb, 0x10, 0x3ff, 0x6, 0x72, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0x9}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0xa, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x13, 0xb}]}}, {{0x9, 0x5, 0xa, 0xa, 0x400, 0x44, 0xed, 0x5}}, {{0x9, 0x5, 0x72978d76d9957db0, 0x0, 0x10, 0x5e, 0x5, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xcc, 0xfff8}]}}]}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x8, 0x8, 0x3, 0x20, 0xfd}, 0xfd, &(0x7f0000000040)={0x5, 0xf, 0xfd, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x6, 0x0, 0x9, 0xf0f, 0x8000}, @generic={0xe2, 0x10, 0xa, "b1b0de003952c1f78978c81bcfce1bd1367a9f896bfc5bb6d97ccc08f7e094398d42d3fee1e08851ef895ff3691e373dc0859d74e0ef90b0c4dc9fbba6cd6a47cc21fdf38677438b8e25b3b4750cfbbfb87d993cfe41bd1a5befff866b6c17af68a71730155ba1fbf0a0dea02f532112b49d292b28a7e0c7308c8d8e3be988c4a6e4f7c6e21125541547ee94b561380afca139587d785f4d04f31d90a5b796dc77a3610d73aa6d3f1990dc18e1f7d3746fdb1e19dae068dbbe9704db2256e9976909960cd6d533be2fef0a5e2c5f49fe7fb8a768776e2d446ab5df652e12d7"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x9, 0x1, 0x5}]}, 0x6, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x40a}}, {0xea, &(0x7f0000000f40)=@string={0xea, 0x3, "cba9fdc7a74b697db6ddd8ef48ec148fac5a652a22ffc2d7ef1bf4315c3c8e6786a7eaeeeb02dd7799dbc7d2248b03dee19914965b434303a2db3661bd9730cc806461745fa8212432180ae8966c3bc6143efddc446b2a5dfce34b871aca084d60f6835cc5c0cdcbedc1d3deb64b307af55487b567baf9244520302dca969a0f9cfd7976355d171ad7ad134937a4d90a8f4b6d4671d6d64bbe31e373740679069dbd97c9550cc945e13163265427b8faffdaba8b317f2210442b007ef23acc0e566974fe0f97059c3f86e8988d90dad16625679bd063b0e7b5119418e79576feb69f793fa8c36a5c"}}, {0xd4, &(0x7f0000000340)=@string={0xd4, 0x3, "c955dd5d573046a1abef1ae8912adeb4a501870502455a7da95b3223501a3df0ce0c48c42cccca9d57911d6ca39d15cba6a9e46665093b396463a05da9fbb02367e213e200eafa40abfab1a6fb132a4a9f841d2f6e7e7b6e9234dd4e1f357c98b32ba26ee2f2599bd6f09254a6174c9719fdd1ecaadfcee53c974b84f3f3e853a6d3026bc27e06d9c211de9d4ae6d2569e8f7e9d239a37459e99fb5f435bc743924ce2e1bfd4ae75bd3027b515e8fda7ac80eaaebaa420542198f9daecbff3e3f2c0f44790d0cdc1e75fb74eb4c62a155b32"}}, {0xf9, &(0x7f0000001040)=@string={0xf9, 0x3, "caa30776d623d8b1576f9ee2096a80c9dc36d724914301e44b8f85162ae5acc99d410385eaa72405b893141e6a3e7475976f90fe2c1a703caa6e4fcc21e8e555f95620fb15a749a777f0a34345205d34590315c749d2b9c15420e367e9c01d6da83d86e43f7f583b3ff6ce50c52e9596c9c89f4d282250e0a7e949f439371532e8d4605be9b1f7b564a31cfc7c7c727199fe38ec742a96d9dda526d610adfb8335b4b7e766c815f36bb1f4de3ac76877d3c15fee341c5dfc7f607ca83629f26d1037ef70279bc99f79bf15fdace28d5016aaccabd3d0c84258b956deda7251eae34b61a5182d5e3a89e37b101a565fe398e246a2a72648"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x340a}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x407}}]}) 11m43.942897395s ago: executing program 0 (id=431): syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_connect(0x0, 0x10e, &(0x7f0000000380)=ANY=[@ANYBLOB="120100006a249f08"], 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002240), 0x2, 0x0) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002240), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) (async) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) chroot(&(0x7f0000002940)='./file0\x00') pivot_root(&(0x7f0000000040)='./file0/../file0/../file0/../file0/../file0\x00', &(0x7f0000000600)='./file0/../file0/../file0/../file0\x00') syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 11m43.527376941s ago: executing program 0 (id=432): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x9}]}}]}, 0x3c}}, 0x90) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040a8002b00", 0x34}], 0x1}, 0x20000880) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0xfe33) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000002080)={0xc, {"a2e3ad214fc752f91b3e090987f70e06d038e7ff7fc6e5539b3264078b089b0e083f63090890e0878f0e1ac6e7049b334c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b313b0d3b6d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d780231c9c99a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa3647f17b28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f068bb87af8b90fd8f08876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b281769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833fea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e51074b41bc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) ioctl$TIOCL_PASTESEL(r4, 0x541c, &(0x7f0000000000)) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x3b) 11m43.006321184s ago: executing program 0 (id=436): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e24, @loopback}}}, 0x84) 11m42.360057074s ago: executing program 32 (id=436): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e24, @loopback}}}, 0x84) 11.649351251s ago: executing program 3 (id=2792): utimensat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', &(0x7f0000000080)={{0x0, 0xea60}, {0x0, 0xffffffffffffffff}}, 0x0) setxattr$trusted_overlay_opaque(&(0x7f00000005c0)='./file0\x00', 0x0, 0x0, 0x0, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) getpriority(0x2, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0x106f, &(0x7f0000000040)={0x0, 0x1, 0x40, 0x2, 0x401a}, &(0x7f0000000100), 0x0) r1 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='%(0.', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=@base={0x1, 0x8, 0x4932, 0x7f, 0x1, 0x1}, 0xab) syz_usb_connect(0x2, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000200)={@initdev, 0x0}, 0x0) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f0000000f00)=0x5) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000ec0)={r2, r3, 0x25, 0x0, @void}, 0x10) r4 = socket$isdn(0x22, 0x2, 0x26) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x80044944, 0x0) syz_open_dev$evdev(&(0x7f0000000600), 0x6a28, 0x309000) syz_usb_connect(0x2, 0x616, &(0x7f0000000640)={{0x12, 0x1, 0x110, 0x1a, 0xaf, 0x26, 0xff, 0xaf0, 0x7041, 0x9d5f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x604, 0x1, 0x2, 0x2, 0x100, 0x84, [{{0x9, 0x4, 0xbc, 0x2, 0xf, 0x3f, 0xfd, 0x20, 0x4, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "8181d282"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x75f3e095, 0x4, 0x31ba, 0x3}}], [{{0x9, 0x5, 0xe, 0x10, 0x3ff, 0x4, 0x13, 0x56, [@generic={0xba, 0x21, "4a9261669be6de1182fa855526f98e2d250d5d730b3ade70f3c92894f0a44cb2fe4bb5ef178b033da667b7ca7370e96fe36db65360b9a3bfc84f685505f6f37587b9a7a730b6f77e74ed0faf2b25774eadcc9fcb1ae4533fd577af80dc749794c36102d182f6f2abf6c8f5dc94d3cedb1b35a6ebb9e1da0e937c00ab76a181b207e7b264fded7cec9cf2ca5cbe92a5a0770941abc664dbacb0520c7a146004a4ac4291419919cc9d36944d579acf69bea3baf9ec1b3837f7"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x40, 0x4, 0x4, 0x6}}, {{0x9, 0x5, 0x2, 0x0, 0x20, 0xff, 0x7, 0x8, [@generic={0xdc, 0xc, "0b0ee24983327137fcf3e5de2423b962089e923eb237c8aeca997e093770ca21ab2143e394241417b0bb325add1d73151ac4cfa6e2726a83f784dafaf190e90cc9e44f5432553f1f832197815efd9d8ed2dafb3acc6667b03c245ea70189c32aa281b72ca82837d054a5f7380cfeb6203329055efbfd855136c30efe95551d64fa107623e811d8898cca23129026f63b63fd6724f59a3ab2caafd35531f4e708c86b98cfc91fc955fff42b6744a7c19b4897b55d2ccd6c22d62dc463c3bdc560bd6a196733cc5bfc3067c04c1e77b83f5996f82c8d28797ea8b3"}, @generic={0x6d, 0x31, "5412b03c6e28e1d628db3526466b1eb7bbfe770888eaad6a5cfcca99c7ebeb89b3f382c7de94969759f8ba533aa1daa084d9232d3f8953d403424f607259076a38dddb99aaee64c8a2612fa3fe80d7f040480ed4400b55d6f4ce21cc375d00ef5b0596083a842a036a4336"}]}}, {{0x9, 0x5, 0x1, 0x3, 0x20, 0x7, 0x5, 0xb, [@generic={0x58, 0x4, "2527d7dd2636565dddb1180372ea6fa9e95bbdf60248af839cecb326899993c3cbb2dbe994d180bbf7421e83cb33e5be8bcc536d1be810c16c7256030b28735cf6d71bc4f5406d76229ec0454b97e69612f71891d2c4"}]}}, {{0x9, 0x5, 0xf, 0x1, 0x20, 0xc, 0x3, 0x2}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0xb, 0x6, 0xff, [@generic={0xb6, 0x31, "8f837530f14bfb847b8f0079b39cec763603c29c2fca8556c788824359c7f8061b728f404882f9824889ba9b28136e63825918f0107d7f5e4177a08cf27d6c5809099b71f551a69631ec03fc3dc781769587f3967d73f08099350fca84b4814bc0a7c26b58004767680b6b023a4e0719100cf520e5008a6db802a0696dcba70777e6a5b672a55ca81b070e3ed3f104dc8fc47c8169c1b89987061fd382984ce6ca19578dcf5315ddad04c3ec2c10c21c1ad6cc44"}, @generic={0x2, 0xd}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x4b, 0x0, 0x7, [@generic={0xf5, 0xb, "2ec158430079c9be99a8a3f1f6aa71ba1dd551fbf4ff28e5d39ec356a1adab02898d684bc8aff61ac2268a35dbea71c4a7372915783cb48a2afa438aed73341d49b7b4aba1757e0e585b3edab285a7b9602e2f3be615a7896a0141ce82775fd9b41686e3c0b69d919a2019ca2d18853dbb7255c87d812bcebdeea1e4ce7b9aa3d75e7c98be12a7055b23fffb245d6137fc261c9621a8b048da16c1951b8c3c880a9a7436edffd3ec762b0373999fb95552859a4821f3f2be7e8f9b98b5cc501e36b9887f72cce30da67e715840ff85b695bae9b67ba1ea5ff7e6ecedd5a4872833b43aa71ba8d51b83c3cd293d50593d74071f"}]}}, {{0x9, 0x5, 0x8, 0x3, 0x40, 0x5, 0x1, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x980d}]}}, {{0x9, 0x5, 0x3, 0x4, 0x10, 0x0, 0x80, 0xd, [@generic={0x5, 0x23, "7ce148"}, @generic={0x7b, 0x4, "2a3e2fb83e195a771e78c526e5e2296b4c70d3d48be4011db5c73df345aa123bdc5a1ed83f7c47bdbd641db866b0f732ddcb8ac56aa62a86eebbeaff6300e85167e7d9169658d768bb94b23997eeb735f6d373418062c17edf08eda1f6d771751f292ece5e80117e0bf67eeca9a2d34f0337bf0d44582bbba0"}]}}, {{0x9, 0x5, 0x82, 0x8, 0x10, 0x1, 0x2, 0x80, [@generic={0xac, 0x4, "9394f25614c56ac369a1ef726280e4ef52945121bcd915f4a03ea75bb5b0e9ff75edd635059b1f9c84b70bd6e6c116d38ceb1c9670952402ae27960a4ae9e149bb246d374a2936b0128f141ea2192b10491ac228110a758d878ac583fa798f92d208f20eb62e7431cf24b6b6eab065aa6e41531c689d1c8707d487cf5d1b153bacea2e136d8bc38953d2df0c85c61e47e990b182fa71e58f60d70c8d979cab9505a3e58cc8611ebc6a45"}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x7f, 0x98, 0x5}}, {{0x9, 0x5, 0xb, 0x10, 0x3ff, 0x6, 0x72, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0x9}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0xa, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x13, 0xb}]}}, {{0x9, 0x5, 0xa, 0xa, 0x400, 0x44, 0xed, 0x5}}, {{0x9, 0x5, 0x72978d76d9957db0, 0x0, 0x10, 0x5e, 0x5, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xcc, 0xfff8}]}}]}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x8, 0x8, 0x3, 0x20, 0xfd}, 0xfd, &(0x7f0000000040)={0x5, 0xf, 0xfd, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x6, 0x0, 0x9, 0xf0f, 0x8000}, @generic={0xe2, 0x10, 0xa, "b1b0de003952c1f78978c81bcfce1bd1367a9f896bfc5bb6d97ccc08f7e094398d42d3fee1e08851ef895ff3691e373dc0859d74e0ef90b0c4dc9fbba6cd6a47cc21fdf38677438b8e25b3b4750cfbbfb87d993cfe41bd1a5befff866b6c17af68a71730155ba1fbf0a0dea02f532112b49d292b28a7e0c7308c8d8e3be988c4a6e4f7c6e21125541547ee94b561380afca139587d785f4d04f31d90a5b796dc77a3610d73aa6d3f1990dc18e1f7d3746fdb1e19dae068dbbe9704db2256e9976909960cd6d533be2fef0a5e2c5f49fe7fb8a768776e2d446ab5df652e12d7"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x9, 0x1, 0x5}]}, 0x6, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x40a}}, {0xea, &(0x7f0000000f40)=@string={0xea, 0x3, "cba9fdc7a74b697db6ddd8ef48ec148fac5a652a22ffc2d7ef1bf4315c3c8e6786a7eaeeeb02dd7799dbc7d2248b03dee19914965b434303a2db3661bd9730cc806461745fa8212432180ae8966c3bc6143efddc446b2a5dfce34b871aca084d60f6835cc5c0cdcbedc1d3deb64b307af55487b567baf9244520302dca969a0f9cfd7976355d171ad7ad134937a4d90a8f4b6d4671d6d64bbe31e373740679069dbd97c9550cc945e13163265427b8faffdaba8b317f2210442b007ef23acc0e566974fe0f97059c3f86e8988d90dad16625679bd063b0e7b5119418e79576feb69f793fa8c36a5c"}}, {0xd4, &(0x7f0000000340)=@string={0xd4, 0x3, "c955dd5d573046a1abef1ae8912adeb4a501870502455a7da95b3223501a3df0ce0c48c42cccca9d57911d6ca39d15cba6a9e46665093b396463a05da9fbb02367e213e200eafa40abfab1a6fb132a4a9f841d2f6e7e7b6e9234dd4e1f357c98b32ba26ee2f2599bd6f09254a6174c9719fdd1ecaadfcee53c974b84f3f3e853a6d3026bc27e06d9c211de9d4ae6d2569e8f7e9d239a37459e99fb5f435bc743924ce2e1bfd4ae75bd3027b515e8fda7ac80eaaebaa420542198f9daecbff3e3f2c0f44790d0cdc1e75fb74eb4c62a155b32"}}, {0xf9, &(0x7f0000001040)=@string={0xf9, 0x3, "caa30776d623d8b1576f9ee2096a80c9dc36d724914301e44b8f85162ae5acc99d410385eaa72405b893141e6a3e7475976f90fe2c1a703caa6e4fcc21e8e555f95620fb15a749a777f0a34345205d34590315c749d2b9c15420e367e9c01d6da83d86e43f7f583b3ff6ce50c52e9596c9c89f4d282250e0a7e949f439371532e8d4605be9b1f7b564a31cfc7c7c727199fe38ec742a96d9dda526d610adfb8335b4b7e766c815f36bb1f4de3ac76877d3c15fee341c5dfc7f607ca83629f26d1037ef70279bc99f79bf15fdace28d5016aaccabd3d0c84258b956deda7251eae34b61a5182d5e3a89e37b101a565fe398e246a2a72648"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x340a}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x407}}]}) 10.834602247s ago: executing program 1 (id=2795): r0 = syz_usb_connect(0x4, 0x1cc, &(0x7f0000000240)=ANY=[@ANYBLOB="120100002671c820b40b3f0a0deb000000010902ba01010000a0600904eb00076de6270009050b00100007c9b20725018102240f0725018208010009050e041831ff0f800905000210000d0e014421144d0d805ccbf243a7f3d10dc8c3c4b29431d45c42d1fac60e43437347671c794554a962182a3053e1bbf1794ccba43d95ed32b6a8099cdd939ccf411bfdf9f054a8072501800303000905010240000702098d065fc87783f7969d1a13d93438c2ef57bbcc7e8791e0111e61cac765530eabe893d9e9f4f6b6f97a546170404721f8f3b7a606c2d012dc85b9fec13a18f4bfa0d6d0713f6db7044e1884cdff6fc24b5ad2acaeb544cb813d283832fca77ecaea57b43c6c59dce4e3782de253c05e030440c7b8fae1c07ec3d7cdda802f6ac0ff490cf68af38329f2dd5c38f10725010207001009050e0800040606070725018309ff0307250180030e00090502001000010506440ee07f068d069d8fc86f7745ee76f259ee109fa1289fb9fb2c9d2b0b54e84757e181ae9a14ce55c82327ead2e7d3ea8cb1d0b219ae388f0a2f8613cb892eb2b797e6c92a05cb14fc1ff32590473f99a1135027800057e350dd07287365f8a05a48fd83b638bd68e0945d73a1b00905070000040a0309"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 10.673025445s ago: executing program 4 (id=2798): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket(0xf, 0x800, 0x6) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x6a, 0x3, 0x0, &(0x7f0000000180)) 10.549396607s ago: executing program 4 (id=2799): syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000002c0)=[@in6={0xa, 0x4e21, 0x5, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}, @in6={0xa, 0x4e21, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}], 0x38) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x36, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r4, &(0x7f0000004880)=[{{&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000380)=[@ip_retopts={{0x34, 0x0, 0x7, {[@timestamp_addr={0x44, 0x14, 0x6, 0x1, 0x0, [{@broadcast, 0x401}, {@multicast1}]}, @rr={0x7, 0xf, 0xc, [@multicast2, @local, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}], 0x38}}], 0x1, 0x4000080) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x24004011}, 0x48d0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) r5 = socket(0x10, 0x803, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffd}}}]}, 0x38}}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x5, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6fe2}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x4, 0x50, 0x4, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0xffffffff9673e35d]}}) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000940)="d8000000b6180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000080020203600e4109002429af5558690800ac00000000000000160012000a00feffffff035c3b61c1d67f6f94007134cf6efb8000a007a25ee4ce1b14b96f95a9d6d9307c9f8775730d16a4683f6fe24e25ccca9e00360db79824835d3a71d95667e006dcdf63951f185ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4f5d5e4edef3d93452a92954b43370e9703920723f9080000008af26c8b7b55f4d2a6823a45f28fcb1d00"/216, 0xd8}], 0x1}, 0x4000000) 10.267128893s ago: executing program 1 (id=2800): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000000)=""/24, 0xfd90}], 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f00000003c0)=[{0x0, 0x0, 0x0, 0x0, @tick=0xb, {0x0, 0xb8}, {0x4, 0x6}, @control={0x9, 0x0, 0xb}}, {0x0, 0x0, 0x0, 0x4, @time={0x10001, 0x3ff}, {0x6, 0x4}, {}, @result={0xd, 0x4}}], 0x38) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close(0xffffffffffffffff) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x10001, 0x6361, 0x5, 0xfffffffd, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000804) r6 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r6, 0xc4c85513, &(0x7f00000006c0)={{0x4, 0x0, 0x7f, 0x2, 'syz0\x00', 0x3}, 0x0, [0xffffffffffffffff, 0x800, 0xb, 0x8, 0x9, 0x1182, 0x3, 0x4, 0x2, 0x1, 0x707, 0x8, 0xe15, 0x7, 0xa, 0x3, 0x9, 0x7, 0x7, 0x8000000000000001, 0x8, 0x7, 0xfff, 0x19cc0000000, 0x8, 0x98, 0x80000001, 0x9, 0x2, 0x400, 0x2596, 0x4, 0x5, 0x1, 0xf4, 0x2, 0x4, 0x1, 0x100, 0x7f, 0xbd, 0x1, 0xb, 0x10001, 0xf2f, 0x999, 0x3, 0x8, 0x8, 0x403dbe15, 0xfcc7, 0x6, 0x1000, 0x6, 0x0, 0x8000000000000000, 0x1, 0x2, 0x2, 0x7, 0x5, 0x10, 0xffffffffffffffff, 0x7fffffffffffffff, 0x4, 0xe83, 0xd009, 0x30000, 0x9, 0xfffffffffffff815, 0x9, 0x9, 0x7, 0x7, 0xedc000000000, 0x0, 0x1, 0x5, 0x8a, 0x4, 0x8, 0x1000, 0x1, 0x2, 0x4, 0x5, 0x8827, 0x8, 0x11, 0x7f, 0x8, 0x200000000000000, 0x2eb, 0x7, 0x1ff, 0x8, 0x8, 0x9, 0x8, 0x3, 0x1, 0xe, 0xfffffffffffffffc, 0x7, 0x7, 0x7ffb, 0x0, 0x0, 0x9, 0x8, 0x5, 0x1, 0xb, 0x8000000000000000, 0x7, 0x9, 0xef6, 0x9, 0x10000, 0x6, 0x0, 0x8, 0x100000000000, 0x9, 0x3, 0xfffffffffffffff9, 0x38, 0xffff]}) 10.118581902s ago: executing program 3 (id=2801): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) gettid() socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000000)) read$dsp(r3, &(0x7f0000000300)=""/79, 0x4f) r4 = socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r4) syz_open_dev$media(&(0x7f00000006c0), 0x9, 0x40b02) pselect6(0x40, &(0x7f00000000c0)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0xd}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002500)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea080006000700000008000400", @ANYRES32=r5], 0x150}, 0x1, 0x0, 0x0, 0x2000c894}, 0x4040084) 9.952547265s ago: executing program 1 (id=2802): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f00000001c0)={0x0, 0x1, &(0x7f0000000180)=[0x0], &(0x7f0000000480), &(0x7f0000000440)=[r5], &(0x7f0000000040), 0x0, 0x8}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, &(0x7f0000002140)) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc2604110, &(0x7f0000000800)={0x3, [[0xf, 0x1, 0x7, 0x3ff, 0xed2, 0x9, 0xfffffffe, 0xfffffff8], [0x0, 0x1, 0x5fa9, 0x4e4, 0x4, 0x2, 0x10, 0x10000], [0x5, 0x3, 0x100, 0x8, 0x44a, 0x1000005, 0x4, 0x8]], '\x00', [{0x8, 0x4, 0x0, 0x1, 0x0, 0x1}, {0x100, 0x40, 0x0, 0x0, 0x1}, {0x4, 0xb, 0x0, 0x1}, {0xc0000, 0xa}, {0x21b4, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x1ff, 0x3, 0x0, 0x1}, {0xa1c4, 0x3e, 0x1, 0x1, 0x1, 0x1}, {0x225, 0xf, 0x0, 0x0, 0x1}, {0x2, 0x543, 0x0, 0x0, 0x0, 0x1}, {0x7, 0xe6, 0x1, 0x0, 0x1}, {0x81, 0x9, 0x1, 0x1, 0x1}, {0xff, 0x7f1, 0x1, 0x0, 0x1, 0x1}], '\x00', 0xf7b}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x5) recvmsg(r1, &(0x7f0000000300)={&(0x7f0000000040)=@hci, 0x71, &(0x7f0000000100)=[{&(0x7f0000000a80)=""/215, 0xfffffffffffffca9}], 0x1}, 0x2) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) 9.777640992s ago: executing program 4 (id=2803): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={{0x14, 0x10, 0x4, 0xfff4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x8c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x60, 0x3, 0x0, 0x1, [{0x5c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x50, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, {0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x110}}, 0x0) 9.349291769s ago: executing program 4 (id=2805): ioctl$FBIOGET_VSCREENINFO(0xffffffffffffffff, 0x4600, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x100, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r2, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10) r3 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r3, 0x40045701, &(0x7f0000000440)=0xffffffff) recvmmsg(r2, &(0x7f000000e280), 0x58a, 0x42, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, 0x0, 0x0) 8.890353771s ago: executing program 2 (id=2806): socket$inet6_sctp(0xa, 0x1, 0x84) socket$can_bcm(0x1d, 0x2, 0x2) syz_usb_connect(0x2, 0xf, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff00", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) 7.94772445s ago: executing program 3 (id=2808): ioctl$FBIOGET_VSCREENINFO(0xffffffffffffffff, 0x4600, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x100, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x10dc, &(0x7f0000000480)={[{0xd4, 0x4e00, "f51187abc948e012594a66c02dcc2d54fb58d5a32b791f04cc2d73ae08192f622706b7298dc9b89e379ee67bc1190c34e3abac3c54261280221eb7565cb02e1b9f326d5f4179c0ed8e474dd1fa573f9f7b42943a7ffd1f93a152a13662ed79b31b84cac7420f2856d78d62dfabd407e951778774c69f1cd23bfb1b2622ef5f649ba719564cf5a83222b1ccc86641ec456f8490b4f3cb4dcbae572085abcf7ec43748b05c62b36e8900a29685ed23dc8f450f246cebbc5e2aa59e71f4966b68b0f0d4cddb5f5160738ceb2d0c75c8cf4e8cd27072"}, {0x1000, 0x4e00, "25552dd4adf74db3ed040e4fb7af00586f9782b6e3299096a264288b77e2f11a9e95cf37cf6ce2730520b39caa3c5dbbfe8b792704da56580b2de4e757e61f8931dc920bfb867d08e835c29feb9e32ee21539b564e1f9bd9dc195a6f23f1756ed608accfe494e876c8f3cc930f77a4605b2497b7b0c6fd036c73ab385b81f4767c88c204ffb6b43c0e60912799d48ea6ac5ec27366bc348c21d935038813c890440a40663326664383dcc56133c44921a5339e5b64df8befe0f8456734817cbabbc98f8169d4988da1d10123211ad25f6781da7180259348609c2bd99f432657816dbe551a82b9ec61db3dc9a15eeb6cbe0bb7d2eeece66c196ad417a556ab6d5c3c22d4c155a6dae4626b4ff0e33f9ccd061ae06684975d7787d925cb354dc73434cd1e19a065ceb6d29de7fbe3403ae9edc247020f30d4da7e8426ff4792e6f91ecaf52e4302588a2dd925f579d001fe463204cb8b7f2e9faef2944d6ccf2074d176727d139514975ff6b0d9538362025416c01c7b17276c932c8970a314cb75d017cce2aaa00fd8628532e324c9d588d6d228c42c83e29009b967cac54eadaa798c36226fd563ef48dfec2d16dc812f7ca926e1f44072776688719e88ea5ba2c75155b1c190b90b7f2ab2c675fb3ca74a10dd52632cd82d1c14955ea117f2f209d47ca8e3120cfb7b21f6a1e1524eae59fb2135c656c1d6b352c53e68fd083ff907d3f910dc46d1b511ee6ef24b549f7eeeef9c2896922053e7fb03e3af8c677b5e3b6512541521aed08a812ee8bb5134d663a407c4415dfbe1c254e7a09e658e8c333b987b9885ca5252015f98f35a850af802a40cd1a616004a98e1e7f5562b1bdffb193e6c32adfda9444dc53fb7f6885a9c0eaa3878c0ea6d93ca6d21f8d28be52dffee1c472030d6c5ce5e1256eff81ba63903ac3dbc49dd1802aefbb21be2ceae42346b1852a8a406fdb36f0046cfdb55bd48b17d49b703dda384b28adb4b8dbaca6b096543fa97e942e84580397f021cafc4fc2db6b78633bbec78c4694e0f93079f3a38bf43ad6aec48c451b57c3a39dc6f34e6307eaa0969729759eebf2e479b09da9d9b1486898789a33bdd556bb28400bc3e161c466febac071d2fff57c334b6386422760915d643160e42edde60f95ab4b24d8870cea7856a29108af0e55ef4261c9bc483213f545eaa1d617a202205950359e1f8a8adccf4307c59cc4da87ff1331165f02ed77eb4fc710b82649376b6f40cd2c9de9215f9738515a1fb01dc600a16a8e651d305570fba198ef55ed4c89bcc47301d58b5573120e5265fa9918eda16e23f57e904ac41e520ad5a2d70d41a0ae7f611d61d274177b84deeebd2e01173f9915661058606a19c6808d1f1d89c91cc6b3afd0d5e16980561adbcbf9c5eb2e99babfd91754e9791133c16e93043f1260e73b899f23dddeb9fa90e405e7dc61cabc0e5eba1130214a123880d8041260db30e74e32c6b8d33062c423e0b3c68c9e3bb6a2753522e0c52bbef0de35478b8d4aa2dc9361fe2bf95c27305552fd443295120f633c32531bfb63c1fcad96f6002eb1f479358b1f05a8bfc68d74a144850eaf4026c731e6bf5f4e43b9f441b0d69d4dd64e5305aad7094b8a99865c49753f7c74e672e49e9b9a9bf423a5bebd9fccef1716ae59bed552670f75993ed1e498fb64c0fdd3b19e7cb6c7a38a5da607b213ede5ad85dc41bc7989aa38117b32b43d615d51ec9d1545b99234aa1fbe18c5bc483fd589287ca67f7ee39f8cd68923a9910644d0eb4ac9ab168fc59a790029e59f8439130663f5571820183ec962c0c26289a380cb8415df2c0bda835c9fa4f4598757d5f8fcf6b8f9173c33cbdf6f6f6b96365ea904fb6f13e6cc1f4effc9fa8e2ecbca13e9f595b2a46a2982622c1f2f11aeb9c1cf87231a7ec86ae7e4d93c4b84f218353795abf17bd65eef5ea8a75c28371ad1da3df8bb9a6ed675ab73b96fb209c72752f2aaa1c9fc1bb24234017f372281e390d69ee6c5be5ed3465fb7c327777b83ace179ee65ed6206efa3c22501c8846160d782c06fab374e6c6f65cab7c8b360766904b5dae4a0acb8e529ff2dacce3df29af3d4f8faf53e091bd59cf885a336bcc5538f92d6149e2325f601b93b772207c283bbf890540fe86ebeff04285323513552c3f43123ce7e7eba2063a28b1dec06dc6459c0b6ae2a8022a4e6911f159a72c2fd2d130a2c6205c54cc9f161ac798a15d672e0590a8f8f30454cffc6b4c3d0c768e9d1fab909af9301d31844eb47bb6438b6d38c8a799db5ae52ff7d73bc607b29025b2a35a3e337e66cb5236257701684058e372a2035e6da12d11a4b44ae51e96f50fb64b162263ea4e4ea8c5301e388e71187a90ce50094d1254e8b3fb816f449c3029168686f1b0f69ca977f00b3768bfcd37225a1a84b5a8cd78a1a10ae003500ffbc5d1baf9c91e9bf62cfc4acbeba2c957749f6cb7852335795473e158d5b45347a7d7590bc0fed143ec158c977255193b46b024d1cb012ea5c847ed2095537723898d3c38fecd7d9e1a0080cf64e41d73b70825cafdde97edcda5590869c6b4bf96267e17ff6c33e345b5404f7a73cd112e21e5e05225329de52f8f909660fc6e23e2910368a2deb017e7ee7572e845afad2ef3f274af61eb8e0aec38450e5acff5b3c003f51e3bb01998b8c76f395a7c9ea983ccf3e42be206900693dc0494a16898fa18d00718a1f36a3b248a58eafeb3eabe0450a6ef8d481f8b497e30093f9c51c1422339ae71e1262d295bca4bae76aa4b3e41d279f022d2b022f5ceaec321adcfdd072655eb1b812dc387f1b869b20067b6196591112556a7676bad5ded7bb5b65f2aae416e87be614eb4bba288aca2548b8338b60b1204b372f64975883582d275ed534845b24074f31a48c75eea80eae8b58a048505ab4bde7eaeefe8020aa718a4cac276167ce3a897181a9451537f4ea05a9f9faf9bed3a7ddbbdaf448e8201730997521a0d6b4f1a9ca0faf40ed28146eed413c46c132eb885242c9698d1fa2c9d6040abfbd031d550793c77f8de0e6d070f955845c88a99a0db209dfafe4f6b0afef27aa7ee6ec2e1943d995c9c4fe8cc7364de00e0cac1a9037a99ad1bdc35d5f4a408fe6217b7b7f9b1d977aca6711b11ea37e8d8be4e0e6ea5edaa28b10a94099e67243af07bd84150c7801a710b19cb0936019fc3b997a80380d4635104680e5641448e35d88327edbcccbf04717f96f56a092da6eae4e4b90f3294058120e12efc1e3c1c32c38097e25006881dbbcceae7bd20784429438d2fa479b406508130824f763680480664886ec22d3cd94317e9f8d4b95deb60c16caa5f404c729d8cb43c33608f9717035f69604d03a2af5f9a082d00a291bf2a883146d14fc48cef13443c7812d6f9dc34bc62cfd9c38a2ee6050439f889100f62f510dd7ba1ea554a999542fe66b2094282db50749da8e321093784cebe4fb81f2a6005f1c67d8a4bcd7553b20658b0a98c9f8f8b97c082aef437a7261186ef64997ba1c4adcc2a82f0af48f7a88a0c4f71761c9535760f2f6db716f41079aae8c199eb7823babf747125291ca3965cee3fd9b4f8f3f55675cd8e0d66e2c3c33f7e0ee33d20f0771b9732897035935b635a71d6d7fb100301ad4031ebe086a245b22d0eaf73a7e76b1480a869fd93f68d975a931a9861a78729b7e2e4de3681193fceecdb7d48cbd54b468974ff740c64c136e278037db09168ae29a9041f4d8532de4da14be7619f0ffb48486aefa9aa7319fb5b5349919a5f23bb2702bffbe6dcd407999c3aa1aacaae9c52121e6162e244b0381a409af038d3131ebc15f698c5834e5a0cf0c3f18c5951206fb944c6f1aca6f4c6d941f75efc2ed9d632ef497a87cc2decd86c7e7e260cf89f4dfde743a8e8a9d442246f4a7a48e8d2c927074dc1e2269428f0b61ddb7af8894d1307851082b8eb8799bf553ce6d31f1e2f0a0a1b0f89ed98fe55d8e545c45f939c3beb2480ff4e0a285ff3558197dfdb81068b0b7b6ae09a77283c9ebb0a2d304d225f2338277a7cdde90ad83a3f120114cbf1e95ffc28efa3ec165e90650bccf24dd9433f6b7172b2d402f1316d59b8833ff9c6b8025a327acecd84e1ec299c019d8cbbfb096d35cf1ec08740728cf71f4e2427204cdc84cce11196a3032e66476aa80910e1ddb3249a7f830b88b2d48a0cc2229122d6a7f5d6239862aa35bf7560f81387f0096c8bcb1f8dfbe3e09a42750dc3fc6a81b5ed8634d70e04d2b267abac49618fb71abe7183b71f9608aeb0f3f721238993298dbd058d79af9bdc0caae29e367fcf7749f9eea2aa3948416c3d678b02493576d26735a9eeed2cd0c7bca99aa7a6497046f38c7f0b564a4ff836b68de92dcb798d180f3c4d2a22eb2bf27ca7a1b0e0f0cae5e05392cb84d7190fbc4a9c5ce239f14f0e34f4ded56ff053a4a5e253f17e64717a23c57329ce0b705cbc81605be98e4a078b626701b51bddb0cf9eb3125e33270ffe6fc173cbe1b4cb9a6a6fb155a1e39f68f13e068285b6a9b841b8ad840bf599f37a8239af80863894e58e2aa8886fe008f80bfcbf384c42a49b94a086385d854d4267c98245a73e46b4d2d86b0b9ac768d565d38a45b58e091e4fb413504da9f0fe10c3ce994480b3e2fdc959c4881f200a31b46a119237a8593eca2e1ac59118ab36c49175d22e31f942709269d65240c31af28c085ee90e7fc823766e31636382c5201b19414376c7937fb5efc4199978aaa448363bde9e36bd70f0e9d793582420f44af379b35ece35d8d0a6e8c15a4b1c1997de9f203e0288e37cf9468bf50714fc0479fa6fb42fcfebf0d33d56bfe82506c50af695ddbcd06b8448819f8823424382bba7e92c397f4e8a8670c5ca089cf2c1ee40d703c2e4eb8e3eabbcd9a7043f1a4e76a008b469a7517021542959854e2cfd59c978ff5700dc7d8a61127652c37ffe3112fba6f5c71b5505e166396c03cb1fd1623a502208a78acc2107da615df2d869ddae55fbd480f461e44cf32c770a38424d9095bfb0edf3440c2ba8bc063e76d3b5c8ca2fe5bf043e5ef4c2e0f53af16de5b52103aefb5d88634e23a3b434011522e578017e11fca3097267547887c6c58ba4057fad3e27727c392f8159543b2e5c0228cae7fdaeee640d07bffc00f5d617e9de9dac22ca958a6b93945d86d4462a228837ffb6e42eef7ae333e4c3c02394165b783f31e360bd61153274fffbc0847f0b8749f89c58bdedb2452e6e75384e8add196f187066c358968d740bd0ab8b735fa41edddd4de0b1b77d732f6ef31c825ba6e80cc2ea45199c8254599d5a164bd85b408f268516c4797707df5caf00b1afb953fb4264045127ad38e57fea6ccda90177a98b29341346e1e4e2a981211e67027fdf768e545ece2ddcf79171d7331fbf68395dd44c0436a47b3e8bb978505d6bb61d1c8a8ba05b8c633be130b49a88f96fba9624f039b4f62df9ea901e40352d14ce5ea69307832a2212cb46796da2cfd872c74692866be3eb6be773d6b641f2f801c23f071043cc5171d32307112c4f3016f91dd54d85862066e5be55aaebabae6de84791713f034ffe0504995ba9da2e2ef6fdf9350cb97baa3bda5fba3d7b7832d030b1e20da79021e728971cbfb6ea150131c10e75b02453abf0ea8dfb432117236942e8c6b481ec2adda74b514696bc4918a92d3ea3475e503337d21b43df8910c60d3a06bcfac38645db3a30fd44d96b082f0dee1a6e262557ee2eb2958f"}]}) sendto$inet(r2, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10) r3 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r3, 0x40045701, &(0x7f0000000440)=0xffffffff) recvmmsg(r2, &(0x7f000000e280), 0x58a, 0x42, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, 0x0, 0x0) 7.910208004s ago: executing program 2 (id=2809): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000ac0)={0x0, 0x9, 0x1, "af"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="201500000000b4efe42f6e89b3ab44566a0f99ec"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r1, &(0x7f0000001d00)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3f}}, 0x7}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@hopopts={{0x30, 0x29, 0x36, {0x23, 0x2, '\x00', [@hao={0xc9, 0x10, @mcast2}]}}}, @hopopts={{0x18, 0x29, 0x36, {0x88}}}], 0x48}}], 0x1, 0x8044) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000000)={0x44, &(0x7f0000000640)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000001800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) io_setup(0x8, &(0x7f0000000380)) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000440)={0x14, &(0x7f00000005c0)={0x60, 0x5, 0xf6, {0xf6, 0x6, "5212aa3eca8e697511a4774b7d4efc7614a0f77e93af796cd8b48d5901fc46bb1c567514e3a0f2f4a0b627433300ef23521186c1897b35bcc385a1eb68308cd2df2b6b6a51dc0ab5c2c594d5101ace48bdd0e639e3dd4de97220357ab8685c63c90974b145b183ac568512aa5a76937b18854744738a8ed05628d97460ce68c327190251ddca540c91d77edc71599c522a56b489fdd08baa9b5d670077416062f9a8683b86ed8bc206a93736ce32fcc608794ec7cba9715f5ff365a0182a50fbcb1af535edb9b9dc6479c23708d38ecc626a54f1fca0d85785d1e504b55374071477a07f0b60e3ab4bb175e587be75abbd325a40"}}, &(0x7f0000000400)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b80)={0x44, &(0x7f00000006c0)={0x60, 0x7, 0xb1, "fb2a50ae4cd4312093405e46c0c5a245933dc8e7e2dd670303e4a4ce35809a324d92951eb8c45b392b6ede853302e8a4f3be6484ef5a407cb8b20c0052a59e00c948d54d83760a980f6f8c58cf31dfcc22d3a14c9a5560c99240d438e77be9fbfe37b02d9f0ed1a772a7d72e8525e19dd52227289505020fedb1252d9d4c8bef76f297ae9cf8d162e3ca7eb80390622fe70ce149f814ac8f88c7a74110d886abb2eac4fde2af94bd05aa26158a58ef61fe"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000780)={0x20, 0x80, 0x1c, {0x1ff, 0x4a, 0x200, 0x4, 0x127, 0x4, 0x5, 0x0, 0xe7c, 0x80, 0x7, 0xb}}, &(0x7f00000007c0)={0x20, 0x85, 0x4, 0xfffffffe}, &(0x7f0000000800)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000840)={0x20, 0x87, 0x2, 0x5}, &(0x7f0000000900)={0x20, 0x89, 0x2}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000f80), 0x200001) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000140)={0x40, 0x13}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f0000000180)={0x40, 0xd, 0xba, "64f9b8a33e79a1e12acf39f29163a46ce07e702dda0cdbb7a04790ba587b382e372d479276a703708b39a8bef545a63e9c4b0d1a441735468fed9fcd0b9de3f3eb56a9927fe3bb8b88a7c18854b2c2f8c11d498ac79bd063893ef04829e063535b0563893aef04d0b8ed8e62cc9a5c8d2cd6e7cdcd13403c5fe1de86b3430d6a806f82f0248cbf8bc2b22b57ed9a2d0301a1cf14a5523de8feab6cb79e4e5012b44cd6ca198ee2934d1ec1b3601305a461cff441d107796a3a2d"}, 0x0, 0x0}) 7.79112267s ago: executing program 1 (id=2810): syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = syz_io_uring_setup(0x8cf, &(0x7f00000000c0)={0x0, 0xd80e, 0x3010, 0x2}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000080)={0xa7d}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) 7.113093506s ago: executing program 5 (id=2811): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x7fe, @empty, 0x1}, {0xa, 0x4e20, 0x1ff, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x2}, r2, 0xb}}, 0x48) 7.07645686s ago: executing program 4 (id=2812): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da05000000000001090224"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x100000000, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001800010000f69fc018dbdf2502f413000000000100140000"], 0x1c}}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000071103a00000000009c050100000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) syz_usb_connect$cdc_ecm(0x2, 0x4e, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x1, 0x1, 0xac, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x40, {{0x6, 0x24, 0x6, 0x0, 0x0, 'X'}, {0x5, 0x24, 0x0, 0x9c4}, {0xd, 0x24, 0xf, 0x1, 0xffff, 0x3, 0x0, 0xb0}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x5, 0x9, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x2, 0x0, 0xd5}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0x9, 0x40, 0x6, 0x40, 0x1e}, 0x2d, &(0x7f00000007c0)=ANY=[@ANYBLOB="050f2d00030a100300000003ff00010a1003020c0005000c00143004ff0a631807000000000000007da7340cb76b9b690f1d2217968611f0a9eaa84ccc1f6f9e5bc2a273fe368608cb"], 0x6, [{0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="14396d37dd1b0f80ba0cc0a68b6bdc8d584066aa"]}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x2801}}, {0x6d, &(0x7f00000002c0)=@string={0x6d, 0x3, "e6047217ebb2fb1125d4b40268734c0488d2ee685c0b9775c1883f54c1fc034e05670f89a77a239bda64e02e14f6627379b53abfa86dcf77ba091a4db8d154cba131e15fd6f77245f0fd7618ce6b6c9c47fd0ac60942752d1ae3a7d1cfb6f67f748a9e7202d1c6197e3900"}}, {0xfe, &(0x7f0000000340)=@string={0xfe, 0x3, "a7a4298d7a3fdc9c0c48c9d2a67f0d3df860ca893278d5dd27fbfa7f27bb75007904e44abb45885fd192ed8331a2a9c9b118f6c46c95030d898ea57db17cac747694c61e0efd35da6dcb1ab79177ef849008d4c03f3c8a34afd02756405d7ba938172b7fe070044f0a23e9ddf8361ba42aa7289a887ac8ed8a080ae069f807d35607c1eda4e601167d9630406e8b49c5d3c99ff751a14b7d44dfe5d8aea6d2fe515fa72095dc644972c7ac50f8903b2d423af978c4765926ae558de529fd1a03e7c071acaf234af828ce55b41acac29b13e05c91cc996dbb30d6eab97a8b0a2ba8eb8ef23df961567227718c00cc4664311080d294fa09136a8aa5ca"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x180c}}, {0x7b, &(0x7f0000000840)=ANY=[@ANYBLOB="7b03dec35007a86b7928f9ee3bd03d13e7f8de24c13735726be071b937961c093faae5d1b60f23578f486c1694f0c264cccd3fa5cb97ed5d4a4d6d7b5bac58e4a8aae6faa8def72077c126089ec2cf73408f5deabfa846a66ca126f4a23e31be09667b96955ab4ccff1b6894ab8d0f6987243c2f29c43c547a1a4938e04606c7695362455a51b40495f8eff5365649855028fcd1e1e171e198bba6ab52de9c797ea47760694684c9355ffe78f919b4e6e5b2d50a947d18c22c7e20f5a0763b932a1418c97125c07bfa92ea614db0432aa3587e349c47dae74b3bf6e386f448f989ff8e8fcef757ea9f57985d48b2392ca32f16101c"]}]}) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x1781, 0x898, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xfa, 0x60, 0xc0, [{{0x9, 0x4, 0x0, 0x66, 0x2, 0x3, 0x1, 0x1, 0xc, {0x9, 0x21, 0xe, 0x4, 0x1, {0x22, 0x86f}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x6, 0x5, 0x5}}}}}]}}]}}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x52, [{0x0, &(0x7f0000000600)=@string={0x0, 0x3, "ea75ac472dcfc1d62c99057587f93cc1921bc24cb4306a0aef2f1166ebb45c24de079f455869a52fe8dd2f68cb312b3c0f4fdc9ba6b4914fc5b3a99987bf2c71a993e78e76901582704100956d78f64955f1e7f5cf1cadf5defe43cc613bc4aa6615550dbafbfb8d83861fef40b6a01045772385cca02f5ae869a07015f564f5cf7c3153c6f03b2df2611ecd4f8ed388c3f3ef4aa16e7bd8fb71be0d65d384f880f8716b558b18ba1e25da6f31448e711854510bbeb6c17e47a91f671b619de0aa3cb86dd8870df8a7762bd87bf89e366dbffab72d8a950f692439a5f61f31154cedb6abaca5b7c32c8b009f717635e85020dd824bac2da491"}}]}) syz_usb_connect(0x2, 0x5a, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x84) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000040)='cgroup.max.depth\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x5) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYRES16=r6, @ANYBLOB="01002cbd7000fddbdf254f00000008000300", @ANYRES32=r8, @ANYBLOB="2c007a1c000200b8d979d7ba89e481d42b19ee74"], 0x48}}, 0x4000000) preadv(0xffffffffffffffff, 0x0, 0x0, 0x5f, 0xfffffffc) close(0xffffffffffffffff) socket$rds(0x15, 0x5, 0x0) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0xffffffffffffffff, 0x0, 0x4004) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000e00)=ANY=[], 0x0) 6.968414179s ago: executing program 5 (id=2813): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, &(0x7f00000002c0)=ANY=[], 0x2) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0x0, @hyper}, 0x10) ioctl$sock_TIOCOUTQ(r3, 0x5411, &(0x7f00000004c0)) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f00000007c0)=ANY=[@ANYBLOB="0000000000000000010000000000000000000000000000e7ffffffffffffff00faffffffffffffff0000000000000000000000000000000000000000000000000600000040000000040000000000000004000000000000000300000000000000000200000000000000000000000000000000000000000000000000000000000006000000ff0300000200000000000000090000000000000046060000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000be3a264aa7dc0fa94ed00a47354dc4625db7ac09412272d41d3e57501a63607b5ba7e327a44b32d3bf5ac7e6ce2e32ba66b9a52bb28bfc84609ec5f4d2940633b7d92b7db66c638a17b8f476c32350f1deaded13adf8abadbbb276a52430d8d8431edbe38ed3034eaebebe4f218d65e51cf79552de244602a5d36c7197a7b0303ef8b5c7261b5777ae2b473b8b6f780a8f55825c89d8fcdb567377887b3510cc3c6de2d9eb22592f0c441659c15b1ba6"]) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0xffffffffffffffff) socket(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r6, &(0x7f0000000080)="37ea86a49ac289e5", 0x0}, 0x20) socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x54, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r5, 0x800, 0x55007}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_STARTUP_QUERY_INTVL={0xc, 0x23, 0xf}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x6}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) 4.657431116s ago: executing program 3 (id=2814): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x3) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000002cc0)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) timer_create(0x2, &(0x7f00000002c0)={0x0, 0x37, 0x1}, &(0x7f0000000340)=0x0) clock_gettime(0x0, &(0x7f0000000540)={0x0, 0x0}) timer_settime(r2, 0x1, &(0x7f0000000600)={{r3, r4+10000000}}, &(0x7f0000000640)) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000680), 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000840)={@ifindex, 0x5, 0x0, 0x72c, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r7 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={0xffffffffffffffff, 0x0, 0x25, 0x16, @void}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000880)={@fallback=r0, r5, 0x1c, 0x2000, 0x0, @value=r7, @void, @void, @void, r6}, 0x20) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x1, 0x5, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r8, 0xc000000, &(0x7f00000001c0)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r9, 0x847ba, 0x20000000, 0xe, 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, &(0x7f0000000000)='async\x00', 0x0, 0x0) recvmmsg(r1, &(0x7f0000002d00)=[{{0x0, 0x0, 0x0}, 0x95}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/180, 0xb4}, {&(0x7f0000000440)=""/245, 0xf5}, {&(0x7f0000000580)=""/84, 0x54}, {&(0x7f0000006080)=""/4097, 0x1001}, {&(0x7f0000000000)=""/211, 0xd3}], 0x5}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000002b00)=""/231, 0xe7}, {&(0x7f0000002f00)=""/4096, 0x1000}, {&(0x7f0000001ac0)=""/4120, 0x1018}, {&(0x7f0000000240)=""/68, 0x44}], 0x4}, 0xb0}, {{0x0, 0x0, 0x0}, 0x5}], 0x8, 0x20, 0x0) 4.191986154s ago: executing program 3 (id=2815): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/key-users\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000005d40)={0x2020}, 0x2020) pread64(r0, &(0x7f0000000000)=""/60, 0x3c, 0x7984e2f8) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) read(r0, &(0x7f0000002140)=""/211, 0xd3) 3.924325926s ago: executing program 3 (id=2816): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000040)=0x5) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f00000009c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x10, r1, &(0x7f00000001c0)="20e76a038fb62178f1ef3c191b9f15fe019090bb57ab0976470e9a302d2256670c6742ad4795054100f2cd845a9971c4c0a6e3771ea21d95bd13e513f62684a24776ac36c41ce82c", 0x48, 0xdc, 0x0, 0x2}]) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f00000000c0)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) creat(&(0x7f00000001c0)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x14002, 0x0, 0x0, 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000140)=@ipmr_delroute={0x34, 0x19, 0x1, 0x0, 0x0, {0x80, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, 0x5}, [@RTA_ENCAP={0x10, 0x9, 0x0, 0x1, @LWT_BPF_XMIT={0xc, 0x3, 0x0, 0x1, @LWT_BPF_PROG_FD={0x8}}}, @RTA_GATEWAY={0x8, 0x5, @broadcast}]}, 0x34}}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000040)={0x14, &(0x7f0000000340)={0x40, 0xc, 0xac, {0xac, 0xc, "cadc995a2750512febec027029d74cfbc10713a4a5528d65f444cfba9d18092b4770920e9f8f36a101676a929e455068a5e4860fc025aef48d84a4c3e9a74601a66894fcf371dbfcd60f5267702a06ee3a4c3bfa6593c99d862af3df0a41eec0133b2d32c36d9daf54ec9439abe6848000d615229e8b38aaf8a007afb23f6302d93e3aa2542fd81c50be678ef2bbf576358da2f5d52ae006763b092a1aacad2ce5e57f8aa5dbe7560b6d"}}, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000400)={0x40, 0x13, 0xc1, "6d955e9aa9c063b469d1044d1baee098e87f11c63a25c0edf6d795bbc0c74ecae8a7b8513651a0fc0023ba246c69a36fe96ed569ad6345ab19826c751a61386ca6f5643303f9bc67e5cc830f7dfcda06298fc16666502750ce93784403b687ba434daedefeac5a7a1028a1b331a627cd3c264ca4a568221bc37a1191a12d18ff86cb4fee9650adb00227e017b6c4787f15c5914a83d75bc864d8c48e37a0469865d581e04371dfaf40ba81926771034aa5fbbe6908c51ab56b7a0905fdf79078da"}, &(0x7f0000000140)={0x0, 0xa, 0x1, 0xf8}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0x3d}}) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000080)={0x50, 0x0, r5, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.850760682s ago: executing program 2 (id=2817): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x4000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r3, 0x0, r4}, 0x60) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r7, &(0x7f0000001500)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000014c0)={&(0x7f0000003e40)=ANY=[@ANYBLOB="5c2400001300100000000000fcdbdf2501ff03044e224e23040000000400000064db00000000010001000000010000000400000000000000", @ANYRES32=r3, @ANYBLOB="ffffffff0500000009000000e10f0000ef00010090e59323b60bb9328d3e406fb444f54e7fd704763b397eae1088c2e53927ae8e3f01cbebde51bdf3ecf3a34a9a86ab1a46e765fae1131cf80014c56b6b21ae2044bf5b079f0782630430fc3c2ea7e72ed6ac989ec59bbc79183dd6ebbbe0cdf18729ba44cca04eba4fc66b6b7e9d13aba13a1c705288bf038025b9903fd641a3a6009e3f04c66651fb723d8c23e35ea49afdee7238206223903a929cc15aba85c9cfa607218099480e1579f8da66fa5c5a3567a1e60cb975dcf416f9d4d231658c5008efa027c0a7a6f9534c83714dbebd4075aa540f4e62fe9edb7bbe4f0d91b0e18e9dd1b777ade302ad007b000100769dc62e5501961ff08b384bd2fba82f14ef54035215bbdf2aebc7026c65edfe9de67aeb6f6baaefcfc928229badd6ad21188a0fbf02ca78804bca30c859db68bf84dc5ebf23aaadcf97801afef10d20513eae5fe77473f5e60e988ffbd510a6e41743c9c629c7d074215f26065c4337c608ac446684480049000100445d239644851e10ff6fc401de732c08b6c87d4f3d3937d8449f5a3946853caf0210948a0a92fb2389fd5d7d279169e43fdc3457e97bb24cc49f1993720cfde9488838644a000000ad00010007f4fda44443ad4ae8c547087efb453f03ee84488b332be6a0f9dfc70fe95515032503ed5d3838918b242dbe20dd7f8cb1130c6a72fd6d700097abbb494d3b442b7d83c75a3973c2d9edf237d1731dbe91b77db625b5609f59435c112eab1400e252decd166a1069da62d1d136ea2240cfb7394268edb816572950851aa119dcdc1bef24a81bb52ecb262ec07ef6b48e8458a31305ec50ff2df5c48719fd608883df0a8df8e766f63a000000bb0001000611e3d6a41c54dc1a3c3d43e6c31595d0db14da81bcd4845eee8122d7db03ec63684b79fad823fcafe2491f4c54d144b420a4b1a6ebd047cfef91aa9a7d868e2d5aba563951131588ccf6af166fc6ddddf07f2deccbdbcfb1f2a9179ecea4a25f1572739bb8f0e4e8675918d0c7817c6af9932d5b8a2ed92c84dffda62e60e4c8529049e74c01d3357ffd5d4e20446eb91f4dd56724f7c73c1607b92b55915b50be2357eac2b794a82a7ad3fff0474f12d58a8b50e78a0004100100d2d6520d542ed5501ad52750de85b6e12098e8c01b4a758950f99e99a4f5fa08fcc8851c89164011cc64932bcc915584c21415a51abca4760fae1c65ee81f8169dd5dd8b734be276f2e5e603dcb4f33eb92ce987cf39067151f301fd33c64c02e88d8d151ca545a3db983d43e3cbe0e1fa86b1bcfae86677ebe5434eed91a906c1c7c72bc2b934ad7cfc762be7335a70c34556024fbae05c96954bdc91783b159bb7df0b7f4a8d733129fe66f678c8279e3e68a33d889f7b51806d33b27ead7a1466dcb6b07ed0dc5e9ac3643716da20302bbd62f0e4fa2e2628362b1ffbb0a912c05e012c2b4abfafad302c871487a37eed3b6345bbc79c2d70017c6e728352fb368752005ad317831370e1aa8710f36d28eb5533571c33895266b2750c43d7be9f2599d428b5e887bd6a9f3150b14356380db0990dde9a4a3f276c19bec827f8dfd3a75c9772c92c6f4d75a94b9327c2b2d6bfde5219f8e0024fc165ad862a28dc6db83f097c6e5f09095927844c67a4026a69310bcaedbe90c7086a128c5ed7af1535149efb6c633be57043b218c304224f4a0acc462c95e2f2b134b581dd697b4b67e6255efd98515cb1cc8b9141f2876cb172b08719d45efe2a3188bb2059cb4a48b588ede81850a32a8aa1d0efb683779f4e304f7d45ece5c2591bfc5b6225bbaca56ab2f5e1b157a7be59171c461e4b413cb00221ce121f70ef9e4e805918159a7e5f23d59eb25647204c50d6b8577f8c115968d586434bd477a180e62db55d465d40f4c1a82e3e5352f03ee57d3f68355c88e5b0d25a641c2c5944e6aa8fdae04efa81a6eb7c06d4b288cbd3f1f7a052dee852e7ecbdb96e47f2a831e8e85a536e20f5be8dd065fd14c02aeeb3a333cd07532d461c8ea7c3119d8803b492cc68fda3ae4f218c492f2a1ef480711d965252bc9399bf974e73ed552ff1b8150a1a80a0d3f23cc8b699e2adc396ec4339127be5cf6628f33b0a53021aa1ec97aff0b370e34e66d7478cb847a46065fda6e285f86bb8c8f94b2adb469cb8562d6e5de29c1de1274caeac8984ddb69010a1b823d151e55051749cfec1a8d1fda3b4e18c19427b5ce4add74ffb1d980dcd493e98e5559b9dc55095b0c489d97534a900f9457f09667757b2b02e52feb60a14f709c1770b9bc95e6911b5e023e0ac66916b87a8e1607c6c247a2d857031693e87107a82952e8ffaf41015ce879b8d2410545b56c46a3eb9f0f59af20304006b6dc350cb7ccf813e8de96af4820ae72c8634bac8398af44d47e8aa72b1b89d198ad39cd5fe0165e3813cdab8015e0c67d579bed55262e68f2e4694b2c76482417a68f54a1f85638b686fa28b15afe5233c623d4b7cec521c18770b41241d5bf6b9f90d97679acd7c4af62278b02b53bc37a98e637d4526d1fb3f105b3ab4c291aa4253e0d0f9eb51d0fcd48ea9fcbda584aad40607672dbbf0e865a8ce30fa542691143317da5a0fdf5f0a1b77645715fec686cd6dec41f0da3681b4405cedd3f73049c3c5f64b39b1cdad89b42372b7b961bbb758bcf3701dc329d227412beda2426da977f380ec5cc2c8aedf884604bde63350214885d71b4060eb86de1b19366abc31dc08b5133191758020b86146c9adb81173ab0ed5907d285071c1731c890f1a6a9b93ee107aa02c911c40927d68855443c17a073a950a08aea9f8ff5e46bdcba5c20f1c54d620efc69bafbed5af9b5eb4d7efea609f289a903fb9e3b22b909083680b94162db6000ef6b6e9c4f45da75cb9f4e3fda669eaa2eacdc1a50ef43d282214949abf506e02144fbfdd114b16451c98b084347ebf6a7bec36d02169793a2efba3380ef203079566dfeb0797756299ef21e6c726046b81740a3a9bf7323f9667376ccb21d33a0a6eca4bb5944e2aea12a4f8c235aa631ac4c52ada8bb3a107a9318f6edf6bfbcfcaf50d7abc84e8055ba1573c57e061bcadd1859ca23ccfeee6981a88e0ca3a61bb871c137be9c697536067c35fe374362acd594f8b24c4ac3c0a78e7465e4b301e27048711b7fbcb1800128aa7269dc3867e198de208ea725175fc4aaad88f49371d10b2a113900f01c80c4a7013f2cb9b1b2c99ff66da84592e78490a1c1c9b26e569e7e559c90d5c59dbfed828b1c693d074979132a65d1ed7653a8121eb01f634971fccca8f8b08a3c3e05403356796903a46079536ca7f2418f4d609d51a601073325eb5f6278117bbaf19342724f05c99e5152edcfd676b6cdde99fb496d43142e3295aaf84bd3932abdc7c0deecdff748d09751e24d66475f497c45460d76a49d4af91ba0935652178d4873a2bca1e1c9e8eef9bc2606b80b7477357c514c2d04c2370a9bb2fd7735109950a964e8e7f4c5d3eafbce38d113471e99898a9e286bb0b427d819fad273b1018858c5c0bca47f5bb2fee4b045cd5535606250a8a3c00c1322932f828913cab965f6e6551537a6fd2f099c514f99ec0f033ab2ce1e4d95110d985922ebef6715a8edd0f436f790150f45dfb6dd37c2b6a45f2581138faecd5f42165586d6f422fcbe401557b54eb728d9fa75d7ae4cf1a9ee5266b40d5a4bc6d26b5e0c4418e66498efd133b03c2e11e01bb974571b0282ade0eb551f68d71e7d1e16412d5c78c8981587a3f3720517cc41957f8821adf905daeaa11c0a44e91b7d55b98f3b4013f4197a78bb34eeac0b5ad6d74147bdb1ca00ab626b313f0888ae44732a7bbb2f4ccd04e5dc77e620611f29ca29425439f78619a44139b8729c260dc4f46dfd5035c5ed3bd126ead4a26b22fff07a70be84f82698586cbddc08b90a341b4b5b412b3f78f27de3c912010cb13b17107e5f71af68164cf64356a44f92cd8598134275e78863170fe16bd168f0a150454bd8aac0414cb8130fc1b0c5e0ef77ba3c82dcb70729e1b02d648459661a31748d278020111081c687c818e68b4a7ebf7c2e53a0052043f3b7f40c6542d2ace5eab02707467fa215d8cef7b5b97961d9a61eebeaf824ce32933cf06a9469e93f7b38e80b6ef990c01afdc8568dc374d86504626eee8f01855db1811dbed506efc891ba0520ad9ea69441142cd681d8e48a2000dfda49b3be2f0eef0f651241c477049c9fd123287212ee6c34a25477f1132326d78d6284d89b9ac0026d5d0e70b3335dbc7a7a86ca328b6808cd4a7f08fe136b36e9e08137666a021f6105b88270c792676c7dc4a4fe54c50e73e64ba06117c46a975cec10e14f24ed10a61494319cdd040ff413cb37b975dc4b746251dda4ae7b8ce5bc03c5feb6711bbe34bd1a9ee3756ad72604e2b09406e279e4eaea740de53558c78ef591547a2615267dc2a6d121be52c56501505d2f413239c28ec8811b3e3e0fb7252e9ebe82e13c187df5347cfe87c39b81e54345e16b6e1c2c3978fd63144857e8f4f84e3e2c0076724356c912ebe95d5c201cef29f2fdfd5451719b48d0e9ccc8746cdda12dacdb673810ec24f9b28adc9c2cf540827eba9d0f2a1433d4953d99ef3ff1a43a8625ea190e0178996cc9b1b71815cbec885e84b75cd82535bf65763de64ee00e823ccab82416994521b04fff1856928b8173b1cd94975d48f5bac55f73fed8ad389fea68adde0ed89694938d6522a2151401f46762ba4fd11b0e9fea2498de0bfed31052acc503e55269efdea7b0b526f98ffe45de5c77d8caef16f3bd4531f99a534a5c2365fb824f0ae599d0e737bbbd49c0389e5994d552a6c0e2c95dd0a187859b3998d257e6511f88e5e48f9e0a9b68ab5abc4ba6e037f0f0063ea96012efeb33bc599a1de4eac01001db7388bcdb7c94d5e35bf966ef914158856fb1c6d8d8ad7b58c80afaf6b28bb03a164702f752fa53230910f32c55b7dcf6b15f29c1e9e3751a891dd494b03b5245bdc52902eb2a4c87ec908a2eba8b42d4c6fac2dc50e04ebc7d75c3dc43a69a6abcd0b8e31c6ccb980e604d0340cf2efe7d68d45ff8785e5d75ca75bb089931841643409e4bc301303b4083b1223f638fc28fb085d7454213ed24c6ab4d8a07e2f1d34d04ecf67b8986b5852cb8d3e1fe18c66db97a5790ad3aca3c8db943ec02313b8daa0b7b0ec6bac2e7a3204a0a86e19d5c5feee69d4c9e4da8909a6036bf04d23303553a39a525c803ea171e3f57003dd2b7a6078ec01712ccf51aa1841d2123450dca6f41919ee2d563e061647c0198bf2a9e237607a1bebecbf0f19e87d691fb8967a12e8697061aa21be12a7ebcf7832b75583ed01180e48ebe3b0b22e81ccd35ee136c727dad562c8da523a073d9c59f853e7115aac879d78aea9821feb9f8b020b261ea055e6f8094c813780bda7d944a447db7ccf812d7efecec243f0fd79eed079272914a6fa344f7c9333850c9767864c112b8d4ad5d72d947894bbf180f1a8ea22a4912d42c118b6046c2f06589cfa52a9212dbd7456ca7ec48809447d16b37fc37fa73cfe74308b7dadade742d846418ecd593598c46bdbf3d2906b15e445649478c7f58a7307494df8d00c11613b7d6feb90b1a7dc9f5c5e01c372762b5ebd5db37ffddbc0c1e6ed94f1abd98581692a79d1131e0598a325bb3bd45f8fad6b1cf9c7701659cd3baec5878298124a149f0ee8d572a3af1c5aa1cb782fbc6c0048a7701b8d58ec479b4830afcb879aa7cf6905298263c8f80972920b532345b21dd0f01b81b28d37ff7e3c592c15d9c1b29f4f045220c54f229bf0ed1d08ead6776c8b024689fbce39d7368c1c18262122b8075df2feea73d76f85163b490b4ecada3430367d8b5ae0e741e8b78ff59404000000f27d2bbe62d278be371e69b3d28f26fdf28049b9669b164f44059b9956202703ed880849cde2e2b6cbfe085a4442d69448bbbaa3d71cce98c88a3967a267c431aa631485786b2da15ae0c9f315db44e27d351bbe3dea689f091ba569910a5747d96ffe8109004dcb4b90356ed4d7a84b4623a540123f9001d34ef8813501d35179bd5c392cfbe9b7b7ebb5e566fb8f2677e486a58d5d7ef7f38f355902bad33f6d38712d19ad7d818b727bb4c0be965c67887a10b822fe85b4365ba62c38bcddda91cb75b4699df5f0a728c12a2200f92610336c3bf21423a5728cd7d8907bd4ed2a39adfdbba40aebfe4fed49fd8d6925cd50247a150bdf0e8e301da87762d2a8e4270e7acc86cceac3b5133406e0f8d73ffe623e1f795102dc65442fa210537cf04f0bfd56998f3d147ec2c26ac622373c049b7c53ef791d524b1986d28dac6c76503338930d4f8970745b0b339507f3c21a19f2a871863e553273154399b83948b4e046472fe5b5bd9b68e9394655bc0afb7c2eb6e78fa492d2c43c2e0d400fb1fe9813a2aaa6e518b28df9fcf75ec48106aa32fd08fb19f26825d0f6ad36031640e5a651d0f422524d930c82b7afff2e1e5fc20b5957060ddba62e91d1b561002b9fcbf4f65e1461a2779ff4a9d236a8cc7a3b3beb36073abbc8cf12f7739dd62d8d0d066b43df1173d47e48ab082dd972d4f52d6b6f9185a51f564f270fcdeec559970d205f0254404eed9893e484351b278cb626b3e2c48468b3830b33199c8e20fe2f0d975aecb2ddb1bba457dc77be89e333e2b5a86336a17bc9c8b92022b0dc0b02692ac229a016f4ba02c32af8d1311b797bc5de7f0425550c0287841e807ceb6a66a9a4a70805023b418b3982011a7b5d9673eb5156f188103c33ddc453c95e106db38eaced170612c355fcca55d6b4e13b72301f8055f5be2ea1c2d9067f15609e62dce2e67e0014d82a6c1fd57dd00ef0da10c7bbde9d64ca911ffeaf285f0fd7a5e7e100010018d807403ede5bf6caac0de3d7797346239093e2f97625f3a321bc2021c45f396f57247cbbeb8bfe5ed2156b758e528819419f078c8273aef7e10c3a65ddedab8f9848fe7e7c9592d4965dfa6d86aa766d7550abd0902aab175a0b85af8ab37d32434c09c9121252b209e6c48b6d2c9091821624bb44873dceb4f751809f0833ed8670462af116e177b8f346488e578caaa851064bfea24666889393382c3605d9c68281bf9c65bb69850aec38a7138fbd7c888eff7015edd4886a14195b4f327470e260d01c4d8a8a06d9c673e994be2fcc4cfd8d6ac230c4e3a57a8c00000004100100f2f92786e6ddb80f55fbc199cc127220ff1cc500f4a697ab30a517e4b9869b1b7adede479f7b37ba00b8de8a17edc9d7a054e18902dce35f9bdcd470d10ba4973e14f67e210c968ae2f01871953d869709230cbc8021b120a877f8460188475ffec998dccab505bdb268f7afa30d8fc3e8c97373f4a63638d599612f7dad1641cae60b7c60b35216d355c282271a0871da16d07e5632c47cba42d41935bd6bf5ea1ae9b0f7cf545917a8cfc61801db4ccade381276e4ccf84134e1213b10e0c47993022455282a0cfb46bb38691e7655a37feea9fc165638e79df44c6b6c343b11723253cb9537bf0b8fe32308539620bf6bd285774cb4a6f0bb2dec57e9279d7e1807e5880f43e8cbd0988c124941e459dd638e308b85c014583703250694743a7b795b73e0f8ee9db9b65418974beee4d8ee4bfb2d2824d207cba1e013b71eae55361cfc32fb63b5909b031193e4ab16537595e1fdef7c09e205f19c025c5b15da32fc9691e86dfe45dcc2d72186f7875ed96f81b2f1826d303fd5c77b15d002c625693da1b4190f4f0ca8520d41f83b410cff1f8270723898b4fcf17e3e852cc6a2cfdd29472ff249955c32765c72816d8d98a8d9dc8ebff4957b55b049dacb4674cae70c42c665c8de588eb0608b940abeae3cb034b0bc86f9396aad6b7f1fb691415c05fc1ac355ca85deed8259f656f970227f8d893faa9816118fc3dd4bb182b3fd2f40faef7e12ba96ff3a2ee87cba4d4c10a3d620f7069d66d9cbc2a4f6421ff7b59571f9bc6bc7c0a18e2373ab91662ffc4a0c07f808e9c8887aabbf012678d60107ef98bb9b89d1ac60b5ac181767e0dfd776ef3f1a60257570d6a43eda5c72990c4578cb7cd2030f225c78dada26a32e3d1912162a9548723c01d566a679ebb96cf13a4bbb57c29153b524e350274620004ff6e4bfdeb3f6a47f0d32bf2d0bb50d526350094a39771648a8398223f08e49efa6ea8f97e47ad65a3c1949584dad978ff7b7a43889e47431a33eb968711d441760c7f75b05a5f22b72a0861f618ec607067e082153731e4696ef34e7732082b75d976eff4249e26d74e007f13f76d8a4310f71b118eddc8ebb83c3f897c928822fd19f4dca76c4b4c2eaa11076771d9f1ddc306fbcdc2e6e4193a03e354ded7d0fee08d733f5dca095a6ff5cfc67bc559ceb1c113c5fa8391791869dc58aa8f7aac5a8f272f94adeceb4fea07624c7a34687cb2caa6759c9b408cc0ae7f85a209dafcea1d898835cd8f1364e079b1ddad2c86a422d946120dac4b2a1a614de3ef805ed9c6a7ab0010a5aff4c5a4183b6df91e7d17298a1bad282c7a12afb3216356841a64c96d32c22da3619b4d9fb483583ad67b86b725eb91589cb0a3e2f04bf368c6cb49eb577f8c9a8f609253754676c6f4a69479d2d6d7f9fa6a1d201ff9fbb7afa9f92f94b0c38bf1110bb4f7500f2f3a1759fbb64da0279afcb1c049899c78ac66261c7a7d42f4daa05d9908d4a0e2a2efd2b0258be8099ddc1aa27da2517159b1d285c4e25d3d4fc443267b1d2d973e6c4b54fd3f68f1621db8af1fc0035022ea1ff3cf4ea994584cd06859875bc803ef2ad28325a89014ab119fbe89a4d2531067529fec0f628c3c07d6954dd09778f4267bbf7086958664a51a725d3dbb132caa73f2021003d89a3ae0376fa948fbf48cb2f5d1a22c1df2b32b772f6faf20d46e26e46f9addf3a3a3740aae1b23a44b56ff34b07fc01d948f1f20e5e6018f6d9f46c48c45f8f758576306a507b8d4efe0854d95a48f1ee160a752e38274b22410dc6ab5f2dacab5cae24644fa906b372b6daa1848e5caf9f5aabf6608f89d81b4cfaf77d245ac65c62abfb4f3e0013abd7926be68d97bec849f1f054426a2fd3ef5774f8459ffa6c88b22e582e38690f3b6ef23e59bb481cc7e9c44841d9b62fa722c3b3fd815697b42f220b71e71a1b7d8ef777ae91dd4df589b46915094ab5b662ea1dfc9a78c2ceb818c5cbbce10e35e46b9160355d11aefa7942e5e0aa841f07509d07c654ce07a74410f0eded9173e157b2a89e03134ca6ad3ca28702b992aafe1118c23704f3d5fefac1279c74a0ac234ec5b7c6339558dd5ab05312dc39cbcb3d3e4a087465ccc4d7c8a2468a3b15460d7701358963b529703e17f8c8ae0a5e3459954b309ac154c01ff8bdbbe3c8992e27ced7a68ec55acc914f534a45e3fc7bbaa710889ba2e1790df642438eaab30d07ef64058c676a32dbaab4b2604e8b348e84a1e4009e595dc48dd377711dc5f397ec41cc6d8752e9d328d8fb08877a2bfd6acb046b3ce9b73ce24f55eb0cfdc62cac4c729c4cc8e995384a7be2246227c55997b7dd83d4c393430776b70f216ab6d95b23eaa9de2fdb66da0a6a83093e655c7a8f785fcd53b6cca460d3f2fee0b429a1dfbf03a77a121e8eedce67ccf0f72c6b0a99e41c6abce17ab0e1c5058813637351ffdc704b1ff32d129d9f6c1a768977439de935e6d13f967a9830d43595a495591c8b9f9f88fb6deeca5c37474b00a5e48cdab0bdfffd5fc4f80c2481f539c07de70db74fb22d3f9f2929c1460d62090ee639a70c07d605c23d90eaf97c94f0027aa900419203d036b0d66e129c7c75db36f6b7e5bf2aa8bd063aa9d3257d9bac592ed680a8e7cee03e1c7df2a04348f0f1d1d6fcef879a8ed5a90c0887ac0926af619d794115fe9b50e38a2121f309af1d979c06e9a9e3210e4d0bf0bf8422e0a8ced8162dc317f7ce2c07660ab145e3d618010c67447516785dc163f9ae7842793da80f2c6cfc4c8297a6fc610bc1550ee20e19622d390b7cc5df7b82d47a61934e4e317307973112cbe301228c25420a17a13b08010162f70830cc4fd49a253e162c1bc67cc3b581e8cedcfbea739c00619b8f8c768de1cf210edfe54e14f18a3a17524502b7f26ef61d3c432d3eb453e60879764fa1e04c4d7886fed3959e67c49357601ab23e8d08ce2843840855cf3f80c9e4d88d0c4cf7e3e613d206d8916066f6fdb8f257c7656e026871ad366eaeeef67865a2b1a8d74aa5c078e9d7b54c9e674b42d1e071d224c6b09834a5c890daaa7083598c4503f1911185f9951688c977b19e5b4470998299746068227e022b9ca3003b881493209f534b7eb36a2802d53440407d9df289becdc5b2e47f62f4e5f27cc2e7597f5ed2a9ad7e5da2d7cba451aca91b30deeda4d4198c57e56711e2757b7e4f4034369adb7daf0febe8477ca1e20b6ce501479629ca6413850c6ae3e76bdc97a87fc883059dc9329fa8dbaead1b645b499c11060c5158add6a6a4d434bfb398b8737f319fb77f3d90c331286ca3613f7fb867ef10751733889cab24e16edf09c451c75768833e2ee6b8b793b3411e66f45d7cea63ebe6633c29ef954325fda123b804ccda691e5808ca87d0115c58a53e51040e715ccba05aa09bae4ec8d26dad41ba0963b4168e0e86612f8cce6e89a1595c627e196da8170f0dc2515582d38372e079a59185c1e29c2c70844124f15ccfce1526a9fb116ad7eb62451cdc36faf11712cbe3a17fc6b25d9cf43eddb54d35ceb7693bceac28f6fa3425bd7e3ea68c724d7b479a414c21618528edf4afc116f884caa6644044a10cdd502d1c9750e3b85f2f4e7c2a8ec6f3d714adc23ddce727e021281793db86b3ecfb25d818dccbf0c6639b75a1bdc5fa895531fe3a296e065948af85b6c3aa9b5649b5b771e15aad15343d3e3a4d4075de857cfe6b80523397787663237dfbaa42cdcb946369ab4febe181272a917ade427c4b9e73f0c598501953f01c2c9e69ee94a5b4b9bff08f92173f850f2563f66aedcf92b6453b4d0601469a2961145ff390f2c46b4194b123c7ed1cd619c5467b703f4cfb3826238950f0374639cc73f1bc22a970342eaf40e84a70aca99e7cb3f320c64cb9547d5d16bd74b204c0487325beb68f54a97a3f51ecd5430c90197937515a223ee11586e19ce7ee8ccad4ccae2ac329ef0193967753653106f7868b4045120e1312cb11de8d2125d70d2395afe05113ea850357bf0eccecad67de98530c084d935b1a30fa9a36501f6dd4e6719daea01c35daeb5a8f46ae8128be2162b3989fddbef25595fdc043d717721487612bac87e5ae7c338a7d7074d6a881e872a0c9221c43085f60b2c7e210b86e05ae740b17520418098042009244d1f18a3f0a4bb0533cfef556a252e80388d7d8ccd957080d92b58a3f7481e218a71334ae59b8c8be7f140ead5159ff085b89a16ee16fb33df2fef26e483f10c09c854e15c8e7c1393d209db3ebcb4d444dcb7cc58e748d735ee0122c4b833866f0d441934758e8b00bf858be94ed531a536aceb924de941f5bba18675dc98ac93b590dd31c20f8be17ba407364cf09f159cba71d7b0dff2b2597f4800ce7d835a918d48c969f49b83d6d938dbaf5e2a79c0456d14aaeda05a8967895db827180f2fcd4654c6fb615b9a592bed08b508e050e4e7f4ae883951d21a311274f0acaef87c2499f0793aec6d0a44b1e58f628c2a4a6c18a7c9413e3a6a3d402708cdc990ea004e89e791dab4dc88e3705ab2d9a1aa642b1eca55d68703b3390f0925de20d54d73859a93ba40b2ced62f27c8d5a75dec911c26318a9619536d7e2d3de4ad7d53fe2d2354c8e0b51e38a74dd7aae312a02cf87d851cc546022c2112f44ae3b9a0f7cd4afda795f27ad56ac97975980c705ff88ed99d4d3e57595adb29996c3aa1ab45d04b7a8abaa50ad9695febaf87cb743504ea8ffff05b11f0e6e85a54dec6e6934617d883b54693211a820a8ced68b1ceb49c3f78e5968d1c786fc21d355b0f48990ef8c8a325f83684d464ca027978e3c704aac30f8f7f0d682d6194654618d5efb4ea7fcaec536ff5c2e609e68145d898d970685df7137cbbfd5c016b0af0f1ed8af44dd41d92421dd61c30aab4ea404d3540905dc0e3db82d694ffdce3fe18eab98b3fe6dfc7767080572696f8084c03e58b7d796a95dd7c8250e43e77e9234dfa62008c248feb9f38c4d5085494af9243964988b93e41db8ae6b3871344d80da144fc1ab0274ab14b71c8708746684e14290049e9c2e39c53faa8e2e21bec8466caee28036ce95b60e2337328c8a679bf7b69a1af38fbe573283080e449f058a8bc99cb3f17c6d52bc5022137be2f7a8bf5e9b68a0ec6a7798f5ea621de4049c54bc504ded5524e2d967ef8c7a8e88a8ebaaa5f190290d31889f5a7343b787fb8704eca45dc7f9c7dca2c163cf6e8c8920e69b7cbbac0e340546352bfeb4a741ca04991399671a735cd916e8fb5de9238045bc731c5c96a2d05e9770f8be5b1a8df99cc4ad998d4633789d7c19276424c8b9570f944b8232f78c34b30e88186e05285c23b40254ff8ac9b50572fb2747c34dc4dcc4b98b968c9aed556ee7c417cf872d27c2998f4a53c9127a2221f3de43848af53bf30608f6c5705f41cd10c0854dbcf2018eabc620b489583fe321e0efce44195819a27301e6f877145ebfb32902087ea5686d380563ad0addcb775657e029bf7602acb201f8eb318f4f92d2221e8548bf4c8402d118bcf061a6d19e7028a2c5e29b08bd789d110a40d79340519754f59e27bf0beb811b12b794062ffa870a9dc36c367e6d298f30cd04d00a125c3a05aecc552fdcd41cc047e9fd6a39585d01e461ed16942f2fc7dc85eed9b00a781cf684a9dcef71852fff342ea5c6bef294b4831c63607accff097823b3cbc5681c4693a8b09296f449119715af748a07ce5a7fe36650d856d0d5639b08eb74c3c701f8908d17120c2ec0526c42c20e82f918c18e9b62c2201ca43ed4e2575da68ca5198b2c33211663ce88005f9713"], 0x245c}, 0x1, 0x0, 0x0, 0x40040}, 0x20004004) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x43d, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {0xe}, {}, {0x7}}}, 0x24}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b707000000ff00004870000000000000400000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e345c65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340bdc8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d3682a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f7477137f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd56eee5798041358a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cca6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480efd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047acd083d3cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed1823cb7dde8212a8531bd9000000006a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce993c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436362dd1a08ce873e07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a1cc4df1112105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5cc98d992f3de7d1cdfb24384b9f10f615c87c441dc970ec896a5af6bf69b50a244bc138a1cae9868c3079bafe69769000000000000000000e99b63029d219cd3545a8426b56554a9f265d3557eefb3602894507c256cb8ee9ebadfecb6afeb84ba757bfa8d00a5af0dd6aa1e8144ef8ef04410d52204c335408941b8eccc5c734cc6a05247142ed647f89bcb5c043acfb382b9cc918bc3cdc368983157851cdf678800aa7eb2a6cbc12c7ae23bc88b8f10223ab2a093429f3f6965bc1e6a55e6b4cbbbfcb781143c56d84360a476155f9d2865a60b541b90a27e61b31d459e576b7cb61e67e686b5199518078db3c36b8986bfb067d491d7a4affc3ae8cb63b6a5ec2803782db2ea14c9e5e00ddd9bca8409b807a86381f632122f36a6be0b2746e58290a5b77daadae5206b09559d32b8c3b74bafda94afb66f1055525bc3d3abccc3d8ad7b99527fae1e8fa91712914d9eacc9463588c6da1f69f7"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) getsockopt$IP_VS_SO_GET_DESTS(r8, 0x0, 0x484, &(0x7f0000001380)=""/143, &(0x7f0000001440)=0x8f) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000001340)=r10, 0x4) sendmsg$inet(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="25b096f681cd731c3f3a9badc4e3cf5edeae1f3b5082d7ab3a97c053df68744e7c7e24d0b59997bab4bccff8363b275de3510b0ebe4275d8d2f153395668e3d608e358fc2294263c03f8dc4f8bf194e4fde4600a2dec2f483a914e2fde0cbc344a2b9fc18dd198966045a6d4d4eb8571e8bb69e6724e37fcbaa6e4c64050b47256b9bb17f5c0aa5101e015ecdcb62fec46fc0205512535", 0x97}, {&(0x7f0000000280)="d3a88bea5916e313729a3989393caca70c74cd74e62e524bdd37be131ad827f911027e70ccf679d8e7c0cd3333095f83d6d473db345ded2ac8acaa87503de74c82431758e8e11e3ecb7bce02d6cd65f4eb88cc49ceb9e39f7117eb0f62323dc9b80dea447b0c96a383f14281bb87b09de0a6153ceeaae2b50a2b0f0f41810f379f9c3a1f3938461829d716a4bda86ab11b41f754bc15d71b", 0xfed0}], 0x2}, 0x0) 3.341848101s ago: executing program 1 (id=2818): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc8902, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe825, 0x3400, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x4004, @fd=r0, 0x0, 0x0, 0x0, 0x19}) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) io_uring_register$IORING_REGISTER_RING_FDS(r4, 0x14, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000000600)={0xd1f1, 0x0, &(0x7f0000000540)=[{&(0x7f0000000000)=""/209, 0xd1}, {&(0x7f0000000240)=""/255, 0xff}, {&(0x7f0000000340)=""/139, 0x8b}, {&(0x7f0000000400)=""/182, 0xb6}, {&(0x7f0000000100)=""/21, 0x15}, {&(0x7f0000000140)=""/26, 0x1a}, {&(0x7f00000004c0)=""/57, 0x39}, {&(0x7f0000000500)=""/17, 0x11}], &(0x7f00000005c0)=[0x7], 0x8}, 0x20) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.207044905s ago: executing program 4 (id=2819): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000ac0)={0x0, 0x9, 0x1, "af"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="201500000000b4efe42f6e89b3ab44566a0f99ec"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r1, &(0x7f0000001d00)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3f}}, 0x7}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@hopopts={{0x30, 0x29, 0x36, {0x23, 0x2, '\x00', [@hao={0xc9, 0x10, @mcast2}]}}}, @hopopts={{0x18, 0x29, 0x36, {0x88}}}], 0x48}}], 0x1, 0x8044) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000000)={0x44, &(0x7f0000000640)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000001800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) io_setup(0x8, &(0x7f0000000380)) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000440)={0x14, &(0x7f00000005c0)={0x60, 0x5, 0xf6, {0xf6, 0x6, "5212aa3eca8e697511a4774b7d4efc7614a0f77e93af796cd8b48d5901fc46bb1c567514e3a0f2f4a0b627433300ef23521186c1897b35bcc385a1eb68308cd2df2b6b6a51dc0ab5c2c594d5101ace48bdd0e639e3dd4de97220357ab8685c63c90974b145b183ac568512aa5a76937b18854744738a8ed05628d97460ce68c327190251ddca540c91d77edc71599c522a56b489fdd08baa9b5d670077416062f9a8683b86ed8bc206a93736ce32fcc608794ec7cba9715f5ff365a0182a50fbcb1af535edb9b9dc6479c23708d38ecc626a54f1fca0d85785d1e504b55374071477a07f0b60e3ab4bb175e587be75abbd325a40"}}, &(0x7f0000000400)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b80)={0x44, &(0x7f00000006c0)={0x60, 0x7, 0xb1, "fb2a50ae4cd4312093405e46c0c5a245933dc8e7e2dd670303e4a4ce35809a324d92951eb8c45b392b6ede853302e8a4f3be6484ef5a407cb8b20c0052a59e00c948d54d83760a980f6f8c58cf31dfcc22d3a14c9a5560c99240d438e77be9fbfe37b02d9f0ed1a772a7d72e8525e19dd52227289505020fedb1252d9d4c8bef76f297ae9cf8d162e3ca7eb80390622fe70ce149f814ac8f88c7a74110d886abb2eac4fde2af94bd05aa26158a58ef61fe"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000780)={0x20, 0x80, 0x1c, {0x1ff, 0x4a, 0x200, 0x4, 0x127, 0x4, 0x5, 0x0, 0xe7c, 0x80, 0x7, 0xb}}, &(0x7f00000007c0)={0x20, 0x85, 0x4, 0xfffffffe}, &(0x7f0000000800)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000840)={0x20, 0x87, 0x2, 0x5}, &(0x7f0000000900)={0x20, 0x89, 0x2}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000f80), 0x200001) syz_usb_control_io$printer(r0, &(0x7f0000000a80)={0x14, &(0x7f0000000c00)={0x40, 0xc, 0x80, {0x80, 0x23, "23b7381acc7b80f333c6d1f02fd27a8943c2c653701baca289fd20f5e590a01163f45caab9ae57e639a6f170991e1e9b96cc746a8abe68e860e8c1b08c90b12ae5caedfee8bbbace781a8253fc665b29842855207473aea8d3094f7517dd00de28cab18e4f34cf950d4624f57be1f163c65c6a5f6e018a1f5dc2f8cbe765"}}, &(0x7f0000000940)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3464}}}, &(0x7f0000000f40)={0x34, &(0x7f0000000cc0)={0x40, 0x30, 0x9c, "1fcbd66b5a51df04f8eb3771e665aef03558a937b03e76f3ad7d0b121272c53d786a6033d8b52d3c513235652f21109a3cfa51b812901ee3c8a897f8a910be2c077e8dd51e77622592cf08dea860f9e7e3a745512a1ca35edc7496b277f05864d65df382ce746a740daf6e5c49439b331a25840311a48f14d0e0647f5bf84b4593dd744384879c09006f1c897f3a2e398101fb029acf590f58f4e882"}, &(0x7f0000000b00)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000e00)={0x20, 0x0, 0x85, {0x83, "1d0d41b88055b66900e1072c75c65446d3d3974a656077e8c0da201aa7040174da68f796c87c47c390efaa34a7e8060859c12f7b15048a37e785059ea8e191a8abd9670f39ced3fed0d4df1f09817c2fe12c7cc745dd8a82d6ed5e53e5f3fd4f2addba762918df83fae219864608c4be1d985073ed18083df4b5e89d0838d5fb741101"}}, &(0x7f0000000ec0)={0x20, 0x1, 0x1, 0x4}, &(0x7f0000000f00)={0x20, 0x0, 0x1, 0xfd}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000140)={0x40, 0x13}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f0000000180)={0x40, 0xd, 0xba, "64f9b8a33e79a1e12acf39f29163a46ce07e702dda0cdbb7a04790ba587b382e372d479276a703708b39a8bef545a63e9c4b0d1a441735468fed9fcd0b9de3f3eb56a9927fe3bb8b88a7c18854b2c2f8c11d498ac79bd063893ef04829e063535b0563893aef04d0b8ed8e62cc9a5c8d2cd6e7cdcd13403c5fe1de86b3430d6a806f82f0248cbf8bc2b22b57ed9a2d0301a1cf14a5523de8feab6cb79e4e5012b44cd6ca198ee2934d1ec1b3601305a461cff441d107796a3a2d"}, 0x0, 0x0}) 3.05320485s ago: executing program 5 (id=2820): socket$inet6_sctp(0xa, 0x1, 0x84) socket$can_bcm(0x1d, 0x2, 0x2) syz_usb_connect(0x2, 0xf, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff0000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) 2.855092142s ago: executing program 2 (id=2821): r0 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x5, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0x1, 0x0, 0x101c, 0x4, 0x0, 0x0, 0x5, 0x4}}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x80002, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x143101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) r4 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000005340)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0x4}, {0x7, 0x1}, {0xc, 0xfff3}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x22, 0x4, 0xa, 0x0, 0x0, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x0, 0xc, 0x8, 0xd, 0x0, 0x4, 0x6}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x44) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0x4) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0x3) ioctl$UI_DEV_CREATE(r3, 0x5501) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) preadv(r5, &(0x7f0000000500)=[{&(0x7f0000000000)=""/31, 0x1f}, {&(0x7f00000002c0)=""/187, 0xbb}, {0x0}, {&(0x7f0000000380)=""/159, 0x9f}, {&(0x7f0000000240)}, {&(0x7f0000000440)=""/138, 0x8a}], 0x6, 0x3, 0x75) ioctl$UI_DEV_DESTROY(r3, 0x5502) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x48000, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) write$cgroup_subtree(r2, &(0x7f0000000180)={[{0x2d, 'cpuacct'}, {0x2d, 'cpu'}]}, 0xe) ioctl$TCFLSH(r6, 0x80047437, 0x10004000000006) 2.433650371s ago: executing program 1 (id=2822): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000400), 0x4400, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000000)=@generic={0x8}) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fe00}], 0x1, 0x0, 0x0, 0x2b) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e1310a10f0031d58b776050203010902240001000000000904310002ff0107ff09"], 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8afb5086d04b3082a6d000000040902120001000000000904"], 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x500, &(0x7f00000000c0)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f0000000504c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00010805080c00bdad01409bbc7a46e39a8285dcdf12176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}], 0x1}, 0x0) 2.175660426s ago: executing program 5 (id=2823): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f00000001c0)={0x0, 0x1, &(0x7f0000000180)=[0x0], &(0x7f0000000480), &(0x7f0000000440)=[r5], &(0x7f0000000040), 0x0, 0x8}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, &(0x7f0000002140)) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc2604110, &(0x7f0000000800)={0x3, [[0xf, 0x1, 0x7, 0x3ff, 0xed2, 0x9, 0xfffffffe, 0xfffffff8], [0x0, 0x1, 0x5fa9, 0x4e4, 0x4, 0x2, 0x10, 0x10000], [0x5, 0x3, 0x100, 0x8, 0x44a, 0x1000005, 0x4, 0x8]], '\x00', [{0x8, 0x4, 0x0, 0x1, 0x0, 0x1}, {0x100, 0x40, 0x0, 0x0, 0x1}, {0x4, 0xb, 0x0, 0x1}, {0xc0000, 0xa}, {0x21b4, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x1ff, 0x3, 0x0, 0x1}, {0xa1c4, 0x3e, 0x1, 0x1, 0x1, 0x1}, {0x225, 0xf, 0x0, 0x0, 0x1}, {0x2, 0x543, 0x0, 0x0, 0x0, 0x1}, {0x7, 0xe6, 0x1, 0x0, 0x1}, {0x81, 0x9, 0x1, 0x1, 0x1}, {0xff, 0x7f1, 0x1, 0x0, 0x1, 0x1}], '\x00', 0xf7b}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x5) recvmsg(r1, &(0x7f0000000300)={&(0x7f0000000040)=@hci, 0x71, &(0x7f0000000100)=[{&(0x7f0000000a80)=""/215, 0xfffffffffffffca9}], 0x1}, 0x2) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) 673.863504ms ago: executing program 2 (id=2824): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$isdn(0x22, 0x2, 0x11) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) r3 = open(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1e3042, 0x9c) (async) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000002c0)='./file1\x00') (async) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f0000000180)={0x1, 0x8, 0x6, &(0x7f00000001c0)={0x8, "c6c1f7b51030c4b7c54bf28facb1ed3ee2dfe17a04bc517b5452b3b94bce47509d"}}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0, 0x3f}], 0x1, 0x0, 0x0, 0x0) (async) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000000)=0x40, 0x4) (async) recvmmsg(r5, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x400005aa, 0x0) (async) syz_emit_ethernet(0x7e, &(0x7f0000000200)={@multicast, @local, @val={@val={0x88a8, 0x3, 0x0, 0x4}, {0x8100, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f700", 0x40, 0x2c, 0x0, @private2, @mcast2, {[@hopopts], @echo_request={0x80, 0x0, 0x0, 0xff, 0x8, "87736fdbcd219ffd16cf19f00184cc7a6497624a0e330413935fcd0f1c1ca3689844db1b763cb2818f259c0bc3b345ad"}}}}}}, 0x0) (async) personality(0xeaffffffffffffff) r6 = socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000680)={0x2, 0x0, @ioapic={0x0, 0x9, 0x1, 0x0, 0x0, [{0x9, 0x4, 0x41, '\x00', 0x18}, {0x4, 0x2, 0x4, '\x00', 0x2}, {0x9, 0x8, 0x9, '\x00', 0x7f}, {0x30, 0x3, 0x4, '\x00', 0xc}, {0x6, 0x8, 0x7, '\x00', 0xd4}, {0x8, 0x4, 0x89, '\x00', 0x4}, {0x2, 0x7, 0x2, '\x00', 0x1}, {0x7, 0x0, 0x3, '\x00', 0xa}, {0x80, 0x3, 0x98, '\x00', 0xa0}, {0x0, 0x3, 0xe, '\x00', 0x3}, {0xbf, 0x8, 0x9}, {0x2, 0xcd, 0x2, '\x00', 0x3}, {0x2, 0xe4, 0xb5}, {0x6, 0xb, 0x8, '\x00', 0x2}, {0x4, 0x38, 0x8, '\x00', 0x7f}, {0x0, 0x0, 0x43, '\x00', 0x7}, {0xa, 0x46, 0x4, '\x00', 0xc}, {0xc5, 0x8, 0x7, '\x00', 0x7}, {0x2, 0x8, 0x40}, {0x1, 0x4, 0x1, '\x00', 0x9f}, {0x3, 0x2, 0x2, '\x00', 0x8}, {0xf4, 0x3, 0xb1, '\x00', 0xaf}, {0x5d, 0x7c, 0x3, '\x00', 0xfe}, {0xe, 0x5, 0x3, '\x00', 0x7}]}}) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$sock_inet_tcp_SIOCOUTQNSD(r6, 0x894b, &(0x7f0000000040)) 301.907105ms ago: executing program 5 (id=2825): openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x3c, 0x3c, 0x107, 0x159a, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x15}]}, @typed={0x8, 0x5, 0x0, 0x0, @u32=0xd}, @nested={0x8, 0x8, 0x0, 0x1, [@nested={0x4, 0x48}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 65.574691ms ago: executing program 2 (id=2826): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x5, 0x20, 0x1, 0x7}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) epoll_create(0x4000100) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14) openat$rfkill(0xffffffffffffff9c, 0x0, 0x800, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000380)={r3, 0x4}, &(0x7f0000000400)=0x8) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x200000, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, 0x0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r7) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x1c, r8, 0x331, 0x0, 0x0, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) r10 = openat$tun(0xffffffffffffff9c, 0x0, 0xc0800, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000007c0)={'macsec0\x00', 0x10}) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r5, 0xc0984124, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r6}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x3, 0x1000000000000, &(0x7f0000000340)="cbe601"}) syz_clone(0x142000, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 5 (id=2827): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f00000001c0)={0x0, 0x1, &(0x7f0000000180)=[r5], &(0x7f0000000480), &(0x7f0000000440), &(0x7f0000000040), 0x0, 0x8}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, &(0x7f0000002140)) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc2604110, &(0x7f0000000800)={0x3, [[0xf, 0x1, 0x7, 0x3ff, 0xed2, 0x9, 0xfffffffe, 0xfffffff8], [0x0, 0x1, 0x5fa9, 0x4e4, 0x4, 0x2, 0x10, 0x10000], [0x5, 0x3, 0x100, 0x8, 0x44a, 0x1000005, 0x4, 0x8]], '\x00', [{0x8, 0x4, 0x0, 0x1, 0x0, 0x1}, {0x100, 0x40, 0x0, 0x0, 0x1}, {0x4, 0xb, 0x0, 0x1}, {0xc0000, 0xa}, {0x21b4, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x1ff, 0x3, 0x0, 0x1}, {0xa1c4, 0x3e, 0x1, 0x1, 0x1, 0x1}, {0x225, 0xf, 0x0, 0x0, 0x1}, {0x2, 0x543, 0x0, 0x0, 0x0, 0x1}, {0x7, 0xe6, 0x1, 0x0, 0x1}, {0x81, 0x9, 0x1, 0x1, 0x1}, {0xff, 0x7f1, 0x1, 0x0, 0x1, 0x1}], '\x00', 0xf7b}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x5) recvmsg(r1, &(0x7f0000000300)={&(0x7f0000000040)=@hci, 0x71, &(0x7f0000000100)=[{&(0x7f0000000a80)=""/215, 0xfffffffffffffca9}], 0x1}, 0x2) ioctl$VFAT_IOCTL_READDIR_SHORT(0xffffffffffffffff, 0x82307202, &(0x7f00000005c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) kernel console output (not intermixed with test programs): 94.480958][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 894.618747][T14877] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 894.690959][ T5953] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 894.855684][T10354] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 894.944084][T14877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 895.052971][T14877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 895.131266][T14877] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 895.161958][T10354] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 895.179108][T10354] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 895.216943][T10354] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 895.267685][T10354] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 895.292431][T10354] usb 6-1: Manufacturer: syz [ 895.317784][T10354] usb 6-1: config 0 descriptor?? [ 895.592420][T10354] rc_core: IR keymap rc-hauppauge not found [ 895.598502][T10354] Registered IR keymap rc-empty [ 895.604850][T10354] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 895.713553][T10354] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input137 [ 895.862001][ T44] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 896.078539][ T44] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001004. ret = -EPROTO [ 896.101439][ T44] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 896.207079][ T44] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 896.240281][ T44] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 896.291711][ T5854] usbhid 5-1:0.0: can't add hid device: -71 [ 896.298304][ T5854] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 896.319723][ T44] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 896.343089][ T5854] usb 5-1: USB disconnect, device number 27 [ 896.446242][ T44] usb 3-1: USB disconnect, device number 4 [ 896.643889][T14889] FAULT_INJECTION: forcing a failure. [ 896.643889][T14889] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 896.657941][T14889] CPU: 0 UID: 0 PID: 14889 Comm: syz.4.2582 Not tainted syzkaller #0 PREEMPT(full) [ 896.657969][T14889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 896.657983][T14889] Call Trace: [ 896.657991][T14889] [ 896.658001][T14889] dump_stack_lvl+0x189/0x250 [ 896.658033][T14889] ? __pfx____ratelimit+0x10/0x10 [ 896.658061][T14889] ? __pfx_dump_stack_lvl+0x10/0x10 [ 896.658087][T14889] ? __pfx__printk+0x10/0x10 [ 896.658117][T14889] ? __might_fault+0xb0/0x130 [ 896.658159][T14889] should_fail_ex+0x414/0x560 [ 896.658197][T14889] _copy_from_user+0x2d/0xb0 [ 896.658227][T14889] memdup_user+0x5e/0xd0 [ 896.658252][T14889] strndup_user+0x68/0xd0 [ 896.658276][T14889] __se_sys_request_key+0x12b/0x340 [ 896.658305][T14889] ? ksys_write+0x22a/0x250 [ 896.658333][T14889] ? __pfx___se_sys_request_key+0x10/0x10 [ 896.658370][T14889] ? do_syscall_64+0xbe/0x3b0 [ 896.658399][T14889] do_syscall_64+0xfa/0x3b0 [ 896.658424][T14889] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.658445][T14889] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 896.658466][T14889] ? clear_bhb_loop+0x60/0xb0 [ 896.658492][T14889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.658514][T14889] RIP: 0033:0x7f324498eec9 [ 896.658534][T14889] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 896.658553][T14889] RSP: 002b:00007f3242bb4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 896.658575][T14889] RAX: ffffffffffffffda RBX: 00007f3244be6180 RCX: 00007f324498eec9 [ 896.658591][T14889] RDX: 0000200000001240 RSI: 0000200000001200 RDI: 00002000000011c0 [ 896.658607][T14889] RBP: 00007f3242bb4090 R08: 0000000000000000 R09: 0000000000000000 [ 896.658620][T14889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.658633][T14889] R13: 00007f3244be6218 R14: 00007f3244be6180 R15: 00007f3244d0fa28 [ 896.658666][T14889] [ 897.014669][ T5925] usb 4-1: USB disconnect, device number 119 [ 897.121829][T14883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 897.153057][T14883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 897.245839][ T5925] usb 6-1: USB disconnect, device number 106 [ 897.432700][T12399] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 897.602392][T12399] usb 3-1: Using ep0 maxpacket: 32 [ 897.613730][T12399] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 897.632594][T12399] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 897.662594][T12399] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 897.684160][ T5952] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 897.704691][T12399] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 897.723870][T12399] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 897.749214][T12399] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 897.773116][T12399] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 897.787022][T12399] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.799794][T12399] usb 3-1: config 0 descriptor?? [ 897.878584][ T5952] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 897.942045][ T5952] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 897.961899][ T5952] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 897.973511][ T5952] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.986478][T14895] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 898.003976][ T5952] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 898.030843][T12399] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 898.183154][T12399] usb 3-1: USB disconnect, device number 5 [ 898.209591][T14895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 898.220753][T14895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 898.269364][T12399] usblp0: removed [ 898.288753][T14908] tipc: Started in network mode [ 898.295282][T14908] tipc: Node identity dea7aedc36e9, cluster identity 4711 [ 898.317930][T14908] tipc: Enabled bearer , priority 0 [ 898.332580][T14908] syzkaller0: entered promiscuous mode [ 898.402505][T14908] syzkaller0: entered allmulticast mode [ 898.453258][T14895] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 898.508859][T14907] tipc: Resetting bearer [ 898.574805][ T44] usb 2-1: USB disconnect, device number 18 [ 898.652750][T12399] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 898.825298][T14907] tipc: Disabling bearer [ 898.862835][T12399] usb 3-1: Using ep0 maxpacket: 32 [ 898.872054][T12399] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 898.886746][T12399] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 898.917885][T12399] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 898.998430][T12399] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 899.046493][T12399] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 899.073573][T12399] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 899.113449][T12399] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 899.150715][T12399] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.173858][T12399] usb 3-1: config 0 descriptor?? [ 899.298540][T14919] vivid-000: disconnect [ 899.320358][T14921] netlink: 'syz.4.2592': attribute type 16 has an invalid length. [ 899.336045][T14921] netlink: 'syz.4.2592': attribute type 17 has an invalid length. [ 899.372245][T14922] IPv6: NLM_F_REPLACE set, but no existing node found! [ 899.422067][T14921] team_slave_0: left promiscuous mode [ 899.428894][T14921] team_slave_1: left promiscuous mode [ 899.499767][T14921] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 899.515858][T14921] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 899.556742][T12399] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 899.642864][T13727] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 899.664042][T13727] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 899.679097][T13727] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 899.697407][T13727] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 899.775986][ T5854] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 899.810927][ C0] usblp0: nonzero read bulk status received: -71 [ 899.818958][T14893] usblp0: error -71 reading from printer [ 899.827616][ C0] usblp0: nonzero read bulk status received: -71 [ 899.864850][T12399] usb 3-1: USB disconnect, device number 6 [ 899.914954][T12399] usblp0: removed [ 899.942470][ T5854] usb 6-1: Using ep0 maxpacket: 16 [ 899.954710][ T5854] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 900.012223][ T5854] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 900.201992][ T5854] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 900.212017][ T5854] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.230796][ T5854] usb 6-1: Product: syz [ 900.426605][ T5854] usb 6-1: Manufacturer: syz [ 900.431288][ T5854] usb 6-1: SerialNumber: syz [ 900.448560][ T5854] usb 6-1: config 0 descriptor?? [ 900.480102][ T5854] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 900.533198][ T5854] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 900.845432][T14935] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2595'. [ 901.582476][T10354] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 901.642455][ T5854] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 901.659986][ T5854] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 901.686068][ T5854] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 901.695776][ T5854] em28xx 6-1:0.0: No AC97 audio processor [ 901.772560][T12399] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 901.999540][T10354] usb 3-1: unable to get BOS descriptor or descriptor too short [ 902.014137][T10354] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 902.030820][T10354] usb 3-1: can't read configurations, error -71 [ 902.172449][T12399] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 902.222499][T12399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.251054][T12399] usb 4-1: Product: syz [ 902.261201][T12399] usb 4-1: Manufacturer: syz [ 902.280125][T12399] usb 4-1: SerialNumber: syz [ 902.301752][T12399] usb 4-1: config 0 descriptor?? [ 902.382376][T12399] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 902.419114][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 902.419134][ T30] audit: type=1326 audit(1758671861.137:2417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14945 comm="syz.1.2599" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x0 [ 902.477420][ T5952] usb 6-1: USB disconnect, device number 107 [ 902.485167][ T5952] em28xx 6-1:0.0: Disconnecting em28xx [ 902.498130][T14918] vivid-000: reconnect [ 902.506706][ T5952] em28xx 6-1:0.0: Freeing device [ 902.534132][ T44] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 902.692558][ T44] usb 5-1: Using ep0 maxpacket: 32 [ 902.701936][ T44] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 902.712432][ T44] usb 5-1: config 0 has no interface number 0 [ 902.718592][ T44] usb 5-1: config 0 interface 89 has no altsetting 0 [ 902.732561][ T44] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 902.755606][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.768423][ T44] usb 5-1: Product: syz [ 902.775302][ T44] usb 5-1: Manufacturer: syz [ 902.776995][T14952] tipc: Enabled bearer , priority 0 [ 902.779961][ T44] usb 5-1: SerialNumber: syz [ 902.794338][T14952] syzkaller0: entered promiscuous mode [ 902.795020][ T44] usb 5-1: config 0 descriptor?? [ 902.800001][T14952] syzkaller0: entered allmulticast mode [ 902.846894][ T44] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 902.876744][ T44] em28xx 5-1:0.89: Video interface 89 found: bulk [ 902.938655][T14950] tipc: Resetting bearer [ 903.017472][T14950] tipc: Disabling bearer [ 903.455355][ T44] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 903.873140][T10354] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 904.042679][T10354] usb 2-1: Using ep0 maxpacket: 16 [ 904.058462][T10354] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 904.189009][T12399] gspca_sunplus: reg_r err -71 [ 904.197021][T12399] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 904.228694][T12399] usb 4-1: USB disconnect, device number 120 [ 904.245602][T10354] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 904.258521][T10354] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.277719][T10354] usb 2-1: Product: syz [ 904.281997][T10354] usb 2-1: Manufacturer: syz [ 904.286772][T10354] usb 2-1: SerialNumber: syz [ 904.312802][T10354] usb 2-1: config 0 descriptor?? [ 904.334471][T14967] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 904.352818][T10354] mcba_usb 2-1:0.0: Can't find endpoints [ 904.634720][ T44] em28xx 5-1:0.89: AC97 command still being executed: not handled properly! [ 904.696488][T14967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.707697][T14967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 904.816188][T14944] fuse: Bad value for 'user_id' [ 904.821325][T14944] fuse: Bad value for 'user_id' [ 904.845593][ T44] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 904.855101][ T44] em28xx 5-1:0.89: board has no eeprom [ 904.959647][ T44] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 904.975279][ T44] em28xx 5-1:0.89: analog set to bulk mode. [ 904.986591][T10354] em28xx 5-1:0.89: Registering V4L2 extension [ 905.000198][ T44] usb 5-1: USB disconnect, device number 28 [ 905.080398][ T44] em28xx 5-1:0.89: Disconnecting em28xx [ 905.293311][T10354] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 905.300594][T10354] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 905.312428][T10354] em28xx 5-1:0.89: No AC97 audio processor [ 905.325498][T10354] usb 5-1: Decoder not found [ 905.331415][T10354] em28xx 5-1:0.89: failed to create media graph [ 905.341414][T10354] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 905.351964][T10354] em28xx 5-1:0.89: Registering snapshot button... [ 905.370675][T10354] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input138 [ 905.391357][T10354] em28xx 5-1:0.89: Remote control support is not available for this card. [ 905.434669][ T44] em28xx 5-1:0.89: Closing input extension [ 905.441893][ T44] em28xx 5-1:0.89: Deregistering snapshot button [ 905.501135][ T44] em28xx 5-1:0.89: Freeing device [ 906.512774][T12399] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 906.675970][T12399] usb 5-1: Using ep0 maxpacket: 8 [ 906.686222][T12399] usb 5-1: unable to get BOS descriptor or descriptor too short [ 906.696048][T12399] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 906.717545][T12399] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 906.770662][T12399] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 906.792468][ T5952] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 906.832098][T12399] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1 [ 906.885547][T12399] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 906.952487][T12399] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 906.967269][ T5952] usb 6-1: config 0 has no interfaces? [ 906.973460][ T5952] usb 6-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.00 [ 906.999055][ T44] usb 2-1: USB disconnect, device number 19 [ 907.026040][ T5952] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.141740][T12399] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 907.162847][ T5952] usb 6-1: config 0 descriptor?? [ 907.182420][T12399] usb 5-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 907.202471][T12399] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.231219][T12399] usb 5-1: Product: syz [ 907.239304][T12399] usb 5-1: Manufacturer: syz [ 907.280293][T12399] usb 5-1: SerialNumber: syz [ 907.304451][T12399] usb 5-1: config 0 descriptor?? [ 907.331467][T14987] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 907.344388][T12399] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 907.387252][T14993] netlink: 'syz.5.2611': attribute type 3 has an invalid length. [ 907.395236][T14993] netlink: 'syz.5.2611': attribute type 3 has an invalid length. [ 907.411521][T14993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 907.429506][T14993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 907.442806][ T44] usb 6-1: USB disconnect, device number 108 [ 907.550400][T12399] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 907.610308][T12399] usb 5-1: USB disconnect, device number 29 [ 907.707141][ T7098] udevd[7098]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 907.892561][ T44] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 908.042514][ T44] usb 6-1: Using ep0 maxpacket: 8 [ 908.053629][ T44] usb 6-1: config index 0 descriptor too short (expected 72, got 36) [ 908.063670][ T44] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 908.079071][ T44] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice= 1.08 [ 908.082975][ T5952] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 908.088548][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.106200][ T44] usb 6-1: Product: syz [ 908.112430][ T44] usb 6-1: Manufacturer: syz [ 908.117200][ T44] usb 6-1: SerialNumber: syz [ 908.248475][T15008] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2617'. [ 908.267128][ T5952] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 908.282116][ T5952] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.306462][ T5952] usb 2-1: Product: syz [ 908.318878][ T5952] usb 2-1: Manufacturer: syz [ 908.327747][ T5952] usb 2-1: SerialNumber: syz [ 908.332484][T10354] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 908.532405][T10354] usb 4-1: Using ep0 maxpacket: 8 [ 908.540558][T10354] usb 4-1: unable to get BOS descriptor or descriptor too short [ 908.550423][T10354] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 908.600069][ T5952] usb 2-1: config 0 descriptor?? [ 908.634934][ T5952] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 908.645181][T10354] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 908.735544][T10354] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 908.849820][T10354] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1 [ 908.946107][T10354] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 908.973979][T10354] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 909.030093][T10354] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 909.048427][T10354] usb 4-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 909.059130][T10354] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.079217][T10354] usb 4-1: Product: syz [ 909.083785][T10354] usb 4-1: Manufacturer: syz [ 909.088747][T10354] usb 4-1: SerialNumber: syz [ 909.125471][T10354] usb 4-1: config 0 descriptor?? [ 909.145318][T15006] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 909.162007][T10354] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 909.397468][T10354] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 909.664144][T10354] usb 4-1: USB disconnect, device number 121 [ 909.780347][ T6093] udevd[6093]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 910.303589][ T5952] gspca_sunplus: reg_r err -71 [ 910.308496][ T5952] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 910.345256][ T5952] usb 2-1: USB disconnect, device number 20 [ 910.621933][ T44] usb 6-1: USB disconnect, device number 109 [ 911.186170][ T44] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 911.380323][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 911.418129][ T44] usb 4-1: config 2 has an invalid interface number: 1 but max is 0 [ 911.466223][ T44] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 911.538596][ T44] usb 4-1: config 2 has 2 interfaces, different from the descriptor's value: 1 [ 911.566387][ T44] usb 4-1: New USB device found, idVendor=22b8, idProduct=2d97, bcdDevice=51.64 [ 911.601397][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.650404][ T44] usb 4-1: Product: syz [ 911.679733][ T44] usb 4-1: Manufacturer: syz [ 911.725535][ T5953] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 911.745731][ T44] usb 4-1: SerialNumber: syz [ 912.379643][ T44] cdc_acm 4-1:2.1: probe with driver cdc_acm failed with error -22 [ 912.460437][ T5953] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 912.498373][ T44] cdc_acm 4-1:2.0: probe with driver cdc_acm failed with error -22 [ 912.519714][ T5953] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 912.577659][ T5953] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 912.602412][ T44] usb 4-1: USB disconnect, device number 122 [ 912.617403][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.625634][ T5854] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 912.835366][ T5854] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 912.847363][ T5854] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.866305][ T5854] usb 3-1: Product: syz [ 912.891305][T15048] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 912.921111][ T5854] usb 3-1: Manufacturer: syz [ 912.940966][ T5854] usb 3-1: SerialNumber: syz [ 912.995989][ T5953] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 913.292518][T15048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.372843][T15048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.588213][T15048] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 915.234841][ T5854] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPROTO [ 915.282841][ T5854] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 915.324135][ T5952] usb 5-1: USB disconnect, device number 30 [ 915.342679][ T5854] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 915.432252][ T5854] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 915.497752][ T5854] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 915.672502][ T5854] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 915.830564][ T5854] usb 3-1: USB disconnect, device number 9 [ 916.072586][ T5952] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 916.253890][ T5952] usb 5-1: config 0 has too many interfaces: 202, using maximum allowed: 32 [ 916.265917][ T5952] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.293048][ T5952] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 202 [ 916.427143][T15082] pim6reg: entered allmulticast mode [ 916.502987][ T5952] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 916.516589][ T5952] usb 5-1: New USB device strings: Mfr=33, Product=2, SerialNumber=3 [ 916.588222][ T5952] usb 5-1: Product: syz [ 916.707153][ T5952] usb 5-1: Manufacturer: syz [ 916.717088][ T5952] usb 5-1: SerialNumber: syz [ 916.783421][ T5952] usb 5-1: config 0 descriptor?? [ 916.804949][T15078] pim6reg: left allmulticast mode [ 916.872516][ T5952] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 917.713335][ T5952] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 917.768661][ T5952] usb 5-1: USB disconnect, device number 31 [ 917.973024][ T6094] udevd[6094]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 918.439987][T15106] tipc: Enabling of bearer rejected, failed to enable media [ 918.697757][T15115] bridge1: port 1(macvlan3) entered blocking state [ 918.712517][T15115] bridge1: port 1(macvlan3) entered disabled state [ 918.728800][T15115] macvlan3: entered allmulticast mode [ 918.738726][T15115] macvlan3: entered promiscuous mode [ 918.872687][T12399] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 919.056748][T12399] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 919.066003][ T5952] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 919.091777][T12399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.121118][T12399] usb 4-1: Product: syz [ 919.202973][ T5925] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 919.242477][T12399] usb 4-1: Manufacturer: syz [ 919.252614][T12399] usb 4-1: SerialNumber: syz [ 919.289663][ T5952] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 919.329434][ T5952] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 919.354971][ T5952] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 919.368647][ T5952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.381468][ T5925] usb 2-1: Using ep0 maxpacket: 16 [ 919.417565][ T5925] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 919.445284][T15116] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 919.452794][ T5925] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 919.469202][ T5952] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 919.516951][ T5925] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 919.532916][T15124] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2647'. [ 919.609514][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.716077][ T5925] usb 2-1: Product: syz [ 919.720381][ T5925] usb 2-1: Manufacturer: syz [ 919.777187][ T5925] usb 2-1: SerialNumber: syz [ 920.232965][T15116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 920.250380][T15116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 920.319318][T15116] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 920.349432][ T5925] usb 2-1: 0:2 : does not exist [ 920.369918][ T5925] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 920.423589][ T5925] usb 2-1: USB disconnect, device number 21 [ 921.164806][ T6053] udevd[6053]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 921.325759][T12399] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPROTO [ 921.468007][T12399] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 921.558242][T12399] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 921.703720][T12399] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 921.744953][T12399] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 921.872916][ T5925] usb 3-1: USB disconnect, device number 10 [ 921.962094][T12399] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 922.031715][T12399] usb 4-1: USB disconnect, device number 123 [ 922.292627][ T5854] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 922.316008][T15150] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2654'. [ 922.332543][ T5953] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 922.382403][T15151] usb usb8: usbfs: process 15151 (syz.3.2654) did not claim interface 0 before use [ 922.397526][ T30] audit: type=1400 audit(1758671881.097:2418): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=15145 comm="syz.3.2654" [ 922.456991][ T5854] usb 2-1: Using ep0 maxpacket: 16 [ 922.465575][ T5854] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 922.509328][ T5854] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 922.523411][ T5925] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 922.532562][ T5953] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 922.576949][ T5953] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 922.609423][ T5854] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.633535][ T5953] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 922.645672][ T5854] usb 2-1: Product: syz [ 922.651349][ T5854] usb 2-1: Manufacturer: syz [ 922.661799][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 922.813877][ T5854] usb 2-1: SerialNumber: syz [ 922.842556][ T5925] usb 3-1: Using ep0 maxpacket: 16 [ 922.844594][ T5953] usb 6-1: SerialNumber: syz [ 922.889982][ T5925] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 922.920566][ T5925] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 922.936653][ T5854] usb 2-1: config 0 descriptor?? [ 922.981058][ T5925] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 923.008641][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.225335][T15142] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 923.234692][ T5925] usb 3-1: Product: syz [ 923.238940][ T5925] usb 3-1: Manufacturer: syz [ 923.292458][ T5925] usb 3-1: SerialNumber: syz [ 923.298942][ T5854] mcba_usb 2-1:0.0: Can't find endpoints [ 923.459004][T15144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 923.481498][ T5925] usb 3-1: config 0 descriptor?? [ 923.567289][T15144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 923.587795][ T5925] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 923.606769][T15144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 923.661228][ T5925] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 923.676123][T15144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 923.684190][T15142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 923.696212][T15142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 924.018373][ T5953] usb 6-1: skipping empty audio interface (v1) [ 924.154044][ T5953] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 924.240230][ T5953] usb 6-1: USB disconnect, device number 110 [ 924.277214][ T5925] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 924.284773][ T5925] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 924.320747][ T5925] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 924.341232][T15149] FAULT_INJECTION: forcing a failure. [ 924.341232][T15149] name failslab, interval 1, probability 0, space 0, times 0 [ 924.346007][ T6053] udevd[6053]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 924.370015][ T5925] em28xx 3-1:0.0: No AC97 audio processor [ 924.417553][T15149] CPU: 0 UID: 0 PID: 15149 Comm: syz.2.2655 Not tainted syzkaller #0 PREEMPT(full) [ 924.417576][T15149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 924.417586][T15149] Call Trace: [ 924.417593][T15149] [ 924.417601][T15149] dump_stack_lvl+0x189/0x250 [ 924.417624][T15149] ? __pfx____ratelimit+0x10/0x10 [ 924.417640][T15149] ? __pfx_dump_stack_lvl+0x10/0x10 [ 924.417658][T15149] ? __pfx__printk+0x10/0x10 [ 924.417680][T15149] ? __lock_acquire+0xab9/0xd20 [ 924.417709][T15149] should_fail_ex+0x414/0x560 [ 924.417736][T15149] should_failslab+0xa8/0x100 [ 924.417760][T15149] kmem_cache_alloc_noprof+0x73/0x3c0 [ 924.417780][T15149] ? skb_clone+0x212/0x3a0 [ 924.417803][T15149] skb_clone+0x212/0x3a0 [ 924.417825][T15149] __netlink_deliver_tap+0x404/0x850 [ 924.417851][T15149] ? netlink_deliver_tap+0x2e/0x1b0 [ 924.417868][T15149] netlink_deliver_tap+0x19c/0x1b0 [ 924.417885][T15149] netlink_unicast+0x7fa/0x9e0 [ 924.417917][T15149] ? __pfx_netlink_unicast+0x10/0x10 [ 924.417942][T15149] ? netlink_sendmsg+0x642/0xb30 [ 924.417957][T15149] ? skb_put+0x11b/0x210 [ 924.417977][T15149] netlink_sendmsg+0x805/0xb30 [ 924.418001][T15149] ? __pfx_netlink_sendmsg+0x10/0x10 [ 924.418020][T15149] ? aa_sock_msg_perm+0xf1/0x1d0 [ 924.418037][T15149] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 924.418053][T15149] ? __pfx_netlink_sendmsg+0x10/0x10 [ 924.418070][T15149] __sock_sendmsg+0x21c/0x270 [ 924.418095][T15149] ____sys_sendmsg+0x505/0x830 [ 924.418118][T15149] ? __pfx_____sys_sendmsg+0x10/0x10 [ 924.418144][T15149] ? import_iovec+0x74/0xa0 [ 924.418176][T15149] ___sys_sendmsg+0x21f/0x2a0 [ 924.418197][T15149] ? __pfx____sys_sendmsg+0x10/0x10 [ 924.418243][T15149] ? __fget_files+0x2a/0x420 [ 924.418256][T15149] ? __fget_files+0x3a0/0x420 [ 924.418277][T15149] __x64_sys_sendmsg+0x19b/0x260 [ 924.418298][T15149] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 924.418325][T15149] ? __pfx_ksys_write+0x10/0x10 [ 924.418344][T15149] ? rcu_is_watching+0x15/0xb0 [ 924.418363][T15149] ? do_syscall_64+0xbe/0x3b0 [ 924.418383][T15149] do_syscall_64+0xfa/0x3b0 [ 924.418398][T15149] ? lockdep_hardirqs_on+0x9c/0x150 [ 924.418413][T15149] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.418428][T15149] ? clear_bhb_loop+0x60/0xb0 [ 924.418446][T15149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.418461][T15149] RIP: 0033:0x7f287158eec9 [ 924.418475][T15149] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 924.418489][T15149] RSP: 002b:00007f287240b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 924.418509][T15149] RAX: ffffffffffffffda RBX: 00007f28717e6090 RCX: 00007f287158eec9 [ 924.418521][T15149] RDX: 0000000020000000 RSI: 0000200000006040 RDI: 000000000000000a [ 924.418531][T15149] RBP: 00007f287240b090 R08: 0000000000000000 R09: 0000000000000000 [ 924.418541][T15149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 924.418550][T15149] R13: 00007f28717e6128 R14: 00007f28717e6090 R15: 00007f287190fa28 [ 924.418574][T15149] [ 924.721212][ C0] vkms_vblank_simulate: vblank timer overrun [ 926.454212][ T5925] usb 2-1: USB disconnect, device number 22 [ 926.701320][ T5925] usb 3-1: USB disconnect, device number 11 [ 926.746509][ T5925] em28xx 3-1:0.0: Disconnecting em28xx [ 926.768835][ T5925] em28xx 3-1:0.0: Freeing device [ 926.830114][T15180] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2663'. [ 926.949523][T15183] netlink: 292 bytes leftover after parsing attributes in process `syz.4.2662'. [ 927.136489][T15187] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2665'. [ 927.160490][ T30] audit: type=1326 audit(1758671885.877:2419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15186 comm="syz.5.2664" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x0 [ 928.792666][ T5925] usb 4-1: new full-speed USB device number 124 using dummy_hcd [ 928.922865][T12399] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 929.172977][ T5925] usb 4-1: unable to get BOS descriptor set [ 929.192553][ T5925] usb 4-1: not running at top speed; connect to a high speed hub [ 929.213833][T12399] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 929.322914][ T5925] usb 4-1: config 1 interface 0 has no altsetting 0 [ 929.333805][T12399] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.354693][ T5925] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 929.372415][T12399] usb 5-1: Product: syz [ 929.386398][ T5925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.399467][T12399] usb 5-1: Manufacturer: syz [ 929.426100][T12399] usb 5-1: SerialNumber: syz [ 929.440960][T12399] usb 5-1: config 0 descriptor?? [ 929.451644][ T5925] usb 4-1: Product: syz [ 929.468316][ T5925] usb 4-1: Manufacturer: syz [ 929.499908][T12399] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 929.513061][ T5925] usb 4-1: SerialNumber: syz [ 929.842662][ T5953] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 930.005000][ T5953] usb 3-1: config 2 interface 0 has no altsetting 0 [ 930.020027][ T5953] usb 3-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 930.032560][T15222] netlink: 'syz.1.2675': attribute type 1 has an invalid length. [ 930.048438][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.077466][ T5953] usb 3-1: Product: syz [ 930.097227][ T5953] usb 3-1: Manufacturer: syz [ 930.118658][ T5953] usb 3-1: SerialNumber: syz [ 930.336555][T15224] gretap0: entered allmulticast mode [ 930.400414][T15224] bond2: (slave gretap0): making interface the new active one [ 930.415549][T15224] bond2: (slave gretap0): Enslaving as an active interface with an up link [ 930.652128][ T5953] usb 3-1: USB disconnect, device number 12 [ 931.366883][ T5953] usb 5-1: USB disconnect, device number 32 [ 931.623102][ T5925] usb 4-1: USB disconnect, device number 124 [ 932.536389][T15247] netlink: 'syz.3.2680': attribute type 21 has an invalid length. [ 932.616780][T15247] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2680'. [ 932.620446][T15249] netlink: 'syz.3.2680': attribute type 21 has an invalid length. [ 932.641968][T15250] FAULT_INJECTION: forcing a failure. [ 932.641968][T15250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 932.658902][T15250] CPU: 0 UID: 0 PID: 15250 Comm: syz.4.2682 Not tainted syzkaller #0 PREEMPT(full) [ 932.658923][T15250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 932.658933][T15250] Call Trace: [ 932.658940][T15250] [ 932.658947][T15250] dump_stack_lvl+0x189/0x250 [ 932.658970][T15250] ? __pfx____ratelimit+0x10/0x10 [ 932.658987][T15250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 932.659004][T15250] ? __pfx__printk+0x10/0x10 [ 932.659025][T15250] ? __might_fault+0xb0/0x130 [ 932.659054][T15250] should_fail_ex+0x414/0x560 [ 932.659081][T15250] _copy_from_user+0x2d/0xb0 [ 932.659110][T15250] restore_altstack+0x9d/0x4b0 [ 932.659136][T15250] ? freezing_slow_path+0x10d/0x150 [ 932.659156][T15250] ? __pfx_restore_altstack+0x10/0x10 [ 932.659179][T15250] ? _raw_spin_unlock_irq+0x23/0x50 [ 932.659202][T15250] ? lockdep_hardirqs_on+0x9c/0x150 [ 932.659220][T15250] __ia32_sys_rt_sigreturn+0x1ac/0x7b0 [ 932.659247][T15250] ? lockdep_hardirqs_on+0x9c/0x150 [ 932.659262][T15250] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 932.659284][T15250] ? _raw_spin_unlock_irq+0x2e/0x50 [ 932.659306][T15250] ? signal_setup_done+0x230/0x310 [ 932.659324][T15250] ? __lock_acquire+0xab9/0xd20 [ 932.659367][T15250] ? __task_pid_nr_ns+0x28/0x470 [ 932.659390][T15250] ? do_syscall_64+0xbe/0x3b0 [ 932.659409][T15250] do_syscall_64+0xfa/0x3b0 [ 932.659425][T15250] ? lockdep_hardirqs_on+0x9c/0x150 [ 932.659440][T15250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.659455][T15250] ? clear_bhb_loop+0x60/0xb0 [ 932.659474][T15250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.659489][T15250] RIP: 0033:0x7f324492af79 [ 932.659502][T15250] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 932.659516][T15250] RSP: 002b:00007f3242bf5a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 932.659531][T15250] RAX: ffffffffffffffda RBX: 00007f3244be5fa0 RCX: 00007f324492af79 [ 932.659542][T15250] RDX: 00007f3242bf5a80 RSI: 00007f3242bf5bb0 RDI: 0000000000000021 [ 932.659553][T15250] RBP: 00007f3242bf6090 R08: 0000000000000004 R09: 0000000000000001 [ 932.659562][T15250] R10: 00000000fffffffe R11: 0000000000000202 R12: 0000000000000001 [ 932.659572][T15250] R13: 00007f3244be6038 R14: 00007f3244be5fa0 R15: 00007f3244d0fa28 [ 932.659594][T15250] [ 933.105325][T15249] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2680'. [ 933.198945][ T30] audit: type=1326 audit(1758671891.917:2420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.235648][ T30] audit: type=1326 audit(1758671891.947:2421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.259841][ T30] audit: type=1326 audit(1758671891.947:2422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.321032][ T30] audit: type=1326 audit(1758671891.947:2423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.386059][ T30] audit: type=1326 audit(1758671891.947:2424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.409509][ T30] audit: type=1326 audit(1758671891.947:2425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.439123][ T30] audit: type=1326 audit(1758671891.947:2426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.502383][ T30] audit: type=1326 audit(1758671891.947:2427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.524860][ C0] vkms_vblank_simulate: vblank timer overrun [ 933.538589][ T30] audit: type=1326 audit(1758671891.947:2428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 933.572698][ T30] audit: type=1326 audit(1758671892.087:2429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15252 comm="syz.5.2683" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f753bb8ef03 code=0x7ffc0000 [ 933.595747][ T5925] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 933.617811][T12399] usb 6-1: new full-speed USB device number 111 using dummy_hcd [ 933.759701][ T5925] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 933.769276][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.786679][T12399] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 933.802428][T12399] usb 6-1: config 0 has no interface number 0 [ 933.809340][ T5925] usb 2-1: Product: syz [ 933.820854][T12399] usb 6-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 933.830400][T12399] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.842337][ T5925] usb 2-1: Manufacturer: syz [ 933.846978][ T5925] usb 2-1: SerialNumber: syz [ 933.857843][T12399] usb 6-1: Product: syz [ 933.863666][T12399] usb 6-1: Manufacturer: syz [ 933.868298][T12399] usb 6-1: SerialNumber: syz [ 933.877792][ T5925] usb 2-1: config 0 descriptor?? [ 933.885902][ T5925] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 933.906015][T12399] usb 6-1: config 0 descriptor?? [ 933.912648][ T5952] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 933.929694][T12399] hub 6-1:0.132: bad descriptor, ignoring hub [ 933.943535][T12399] hub 6-1:0.132: probe with driver hub failed with error -5 [ 933.958937][T12399] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.132/input/input139 [ 934.208816][T15253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.217730][ T5952] usb 4-1: config 0 has no interfaces? [ 934.247911][T15253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.289965][T15252] delete_channel: no stack [ 934.309586][ T5952] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 934.320502][ T5952] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.360576][ T5952] usb 4-1: Product: syz [ 934.371226][ T5952] usb 4-1: Manufacturer: syz [ 934.435546][ T5952] usb 4-1: SerialNumber: syz [ 934.527637][ T5952] usb 4-1: config 0 descriptor?? [ 935.366725][T15260] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2685'. [ 936.123301][ T5953] usb 2-1: USB disconnect, device number 23 [ 937.413267][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 937.422400][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 937.841760][ T5953] usb 4-1: USB disconnect, device number 125 [ 937.892578][ T6055] usb 6-1: reset full-speed USB device number 111 using dummy_hcd [ 937.929211][ T6055] usb 6-1: device reset changed ep0 maxpacket size! [ 937.987707][T12399] usb 6-1: USB disconnect, device number 111 [ 938.038951][T15301] netlink: 292 bytes leftover after parsing attributes in process `syz.1.2693'. [ 938.523523][ T5925] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 938.586325][T12399] usb 6-1: new full-speed USB device number 112 using dummy_hcd [ 938.722769][ T5925] usb 3-1: Using ep0 maxpacket: 32 [ 938.724077][ T5925] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 938.724099][ T5925] usb 3-1: config 0 has no interface number 0 [ 938.724129][ T5925] usb 3-1: config 0 interface 12 has no altsetting 0 [ 938.725827][ T5925] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 938.725847][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 938.725862][ T5925] usb 3-1: Product: syz [ 938.725874][ T5925] usb 3-1: Manufacturer: syz [ 938.725886][ T5925] usb 3-1: SerialNumber: syz [ 938.731696][ T5925] usb 3-1: config 0 descriptor?? [ 938.801066][T12399] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 938.801094][T12399] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 938.801123][T12399] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 938.801158][T12399] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.803562][T12399] usb 6-1: config 0 descriptor?? [ 938.945406][T15304] syz_tun: entered allmulticast mode [ 939.165729][T15303] syz_tun: left allmulticast mode [ 939.177264][ T5925] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 939.177322][ T5925] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 939.177336][ T5925] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 939.177396][ T5925] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 939.192750][ T5925] usb 3-1: USB disconnect, device number 13 [ 939.309690][ T30] kauditd_printk_skb: 66 callbacks suppressed [ 939.309714][ T30] audit: type=1326 audit(1758671898.017:2496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15289 comm="syz.5.2694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 939.339057][ C0] vkms_vblank_simulate: vblank timer overrun [ 939.422408][ T30] audit: type=1326 audit(1758671898.017:2497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15289 comm="syz.5.2694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 939.619722][ T30] audit: type=1326 audit(1758671898.017:2498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15289 comm="syz.5.2694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f753bb8eec9 code=0x7ffc0000 [ 939.642299][ C0] vkms_vblank_simulate: vblank timer overrun [ 939.800352][ T30] audit: type=1326 audit(1758671898.467:2499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 939.822871][ C0] vkms_vblank_simulate: vblank timer overrun [ 939.980433][ T30] audit: type=1326 audit(1758671898.467:2500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 940.017077][ T5952] usb 4-1: new full-speed USB device number 126 using dummy_hcd [ 940.047997][T15314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2700'. [ 940.064734][ T30] audit: type=1326 audit(1758671898.467:2501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 940.089191][ C0] vkms_vblank_simulate: vblank timer overrun [ 940.095569][T15314] netlink: 312 bytes leftover after parsing attributes in process `syz.2.2700'. [ 940.130132][T15314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2700'. [ 940.140401][ T30] audit: type=1326 audit(1758671898.467:2502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 940.165078][ T30] audit: type=1326 audit(1758671898.467:2503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 940.225506][ T5952] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 940.245158][ T5952] usb 4-1: config 0 has no interface number 0 [ 940.295182][ T5952] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 940.305969][ T5952] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.317777][ T30] audit: type=1326 audit(1758671898.467:2504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 940.340265][ C0] vkms_vblank_simulate: vblank timer overrun [ 940.375476][ T5952] usb 4-1: Product: syz [ 940.381948][ T5952] usb 4-1: Manufacturer: syz [ 940.386972][ T5952] usb 4-1: SerialNumber: syz [ 940.411382][ T5952] usb 4-1: config 0 descriptor?? [ 940.421692][ T30] audit: type=1326 audit(1758671898.467:2505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15309 comm="syz.3.2698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbfe398ef03 code=0x7ffc0000 [ 940.457593][ T5952] hub 4-1:0.132: bad descriptor, ignoring hub [ 940.464660][ T5952] hub 4-1:0.132: probe with driver hub failed with error -5 [ 940.499862][ T5952] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input140 [ 940.777812][T15310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.890113][T15310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.943998][T15309] delete_channel: no stack [ 941.088081][T12399] usbhid 6-1:0.0: can't add hid device: -71 [ 941.112073][T12399] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 941.152661][T12399] usb 6-1: USB disconnect, device number 112 [ 941.692410][T12399] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 941.854555][T12399] usb 2-1: Using ep0 maxpacket: 32 [ 941.863434][T12399] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 941.890414][T12399] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 941.907739][T12399] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.916204][T12399] usb 2-1: Product: syz [ 941.920547][T12399] usb 2-1: Manufacturer: syz [ 941.928452][T12399] usb 2-1: SerialNumber: syz [ 942.128879][T12399] usb 2-1: config 0 descriptor?? [ 942.173592][T15328] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 942.202974][ T5925] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 942.210826][ C0] raw-gadget.1 gadget.2: ignoring, device is not running [ 942.258059][T12399] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input141 [ 942.342630][ T5925] usb 3-1: device descriptor read/64, error -32 [ 942.593238][ T5925] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 942.773657][T15341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 942.793660][T15341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 942.812886][ T5925] usb 3-1: Using ep0 maxpacket: 32 [ 942.867980][ T5925] usb 3-1: unable to get BOS descriptor or descriptor too short [ 942.903740][ T5925] usb 3-1: config 128 has an invalid interface number: 127 but max is 3 [ 942.912521][ T5925] usb 3-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 942.994423][T15343] binder: 15342:15343 unknown command 0 [ 942.994438][ T5925] usb 3-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 943.036454][T15343] binder: 15342:15343 ioctl c0306201 200000000080 returned -22 [ 943.040334][ T5925] usb 3-1: config 128 has no interface number 0 [ 943.054356][ T5925] usb 3-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 170, changing to 11 [ 943.072439][ T5925] usb 3-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 42744, setting to 1024 [ 943.084670][ T5925] usb 3-1: config 128 interface 127 has no altsetting 0 [ 943.097923][ T5925] usb 3-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 943.107384][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.117617][ T5925] usb 3-1: Product: syz [ 943.123003][ T5925] usb 3-1: Manufacturer: syz [ 943.128386][ T5925] usb 3-1: SerialNumber: syz [ 943.138634][T15336] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 943.243428][T15343] binder: BINDER_SET_CONTEXT_MGR already set [ 943.249630][T15343] binder: 15342:15343 ioctl 4018620d 2000000000c0 returned -16 [ 943.261882][T15343] binder: BINDER_SET_CONTEXT_MGR already set [ 943.275038][T15343] binder: 15342:15343 ioctl 4018620d 200000000040 returned -16 [ 943.291847][T15343] binder: 15342:15343 ioctl c0306201 2000000003c0 returned -14 [ 943.352157][T15336] netlink: 'syz.2.2705': attribute type 1 has an invalid length. [ 943.523841][ T5925] usb 3-1: USB disconnect, device number 15 [ 943.670539][ T6094] udevd[6094]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 944.327236][ T30] kauditd_printk_skb: 100 callbacks suppressed [ 944.327258][ T30] audit: type=1326 audit(1758671902.987:2606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15348 comm="syz.2.2709" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f287158eec9 code=0x7ffc0000 [ 944.363845][ T5952] usb 4-1: USB disconnect, device number 126 [ 944.528457][ T5953] usb 2-1: USB disconnect, device number 24 [ 944.528556][ C0] usbtouchscreen 2-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 944.774520][T15356] netlink: 'syz.2.2710': attribute type 21 has an invalid length. [ 944.782706][T15356] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2710'. [ 945.418506][ T5953] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 945.694096][ T30] audit: type=1326 audit(1758671904.297:2607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 945.732473][ T5953] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 945.752859][ T30] audit: type=1326 audit(1758671904.297:2608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 945.754373][ T5953] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.854347][ T30] audit: type=1326 audit(1758671904.297:2609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 945.922243][ T30] audit: type=1326 audit(1758671904.447:2610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 945.955066][ T30] audit: type=1326 audit(1758671904.447:2611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 945.978164][ T5952] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 946.136301][ T5953] usb 6-1: Product: syz [ 946.154670][ T5952] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 946.172323][ T5953] usb 6-1: Manufacturer: syz [ 946.177071][ T5953] usb 6-1: SerialNumber: syz [ 946.177727][ T5952] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 946.217240][ T5952] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 946.239980][ T5953] usb 6-1: config 0 descriptor?? [ 946.248957][ T5952] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.320245][ T5952] usb 2-1: config 0 descriptor?? [ 946.325413][ T5953] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 946.646825][ T30] audit: type=1326 audit(1758671905.327:2612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 946.683661][ T30] audit: type=1326 audit(1758671905.327:2613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 946.707947][ T30] audit: type=1326 audit(1758671905.327:2614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2413d8eec9 code=0x7ffc0000 [ 946.753274][ T30] audit: type=1326 audit(1758671905.337:2615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15359 comm="syz.1.2712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2413d90de7 code=0x7ffc0000 [ 947.732396][ T5925] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 947.890594][ T5953] gspca_sunplus: reg_r err -110 [ 947.896062][ T5953] sunplus 6-1:0.0: probe with driver sunplus failed with error -110 [ 948.082412][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 948.102460][ T5925] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 948.112038][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.136507][ T5925] usb 5-1: Product: syz [ 948.144780][ T5925] usb 5-1: Manufacturer: syz [ 948.154107][ T5925] usb 5-1: SerialNumber: syz [ 948.182105][ T5925] r8152-cfgselector 5-1: Unknown version 0x0000 [ 948.188676][ T5925] r8152-cfgselector 5-1: config 0 descriptor?? [ 949.418466][ T5952] usbhid 2-1:0.0: can't add hid device: -71 [ 949.427853][ T5952] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 949.536049][ T5952] usb 2-1: USB disconnect, device number 25 [ 949.605516][T15387] FAULT_INJECTION: forcing a failure. [ 949.605516][T15387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 949.689676][T15387] CPU: 0 UID: 0 PID: 15387 Comm: syz.1.2717 Not tainted syzkaller #0 PREEMPT(full) [ 949.689707][T15387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 949.689720][T15387] Call Trace: [ 949.689729][T15387] [ 949.689739][T15387] dump_stack_lvl+0x189/0x250 [ 949.689767][T15387] ? __pfx____ratelimit+0x10/0x10 [ 949.689790][T15387] ? __pfx_dump_stack_lvl+0x10/0x10 [ 949.689813][T15387] ? __pfx__printk+0x10/0x10 [ 949.689855][T15387] should_fail_ex+0x414/0x560 [ 949.689890][T15387] _copy_to_user+0x31/0xb0 [ 949.689919][T15387] copy_to_sockptr+0x5e/0xa0 [ 949.689941][T15387] do_ip_getsockopt+0x1044/0x1b60 [ 949.689972][T15387] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 949.689991][T15387] ? aa_label_sk_perm+0x4cd/0x630 [ 949.690026][T15387] ? __lock_acquire+0xab9/0xd20 [ 949.690058][T15387] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 949.690119][T15387] ? __lock_acquire+0xab9/0xd20 [ 949.690162][T15387] ip_getsockopt+0xbb/0x220 [ 949.690191][T15387] ? __pfx_ip_getsockopt+0x10/0x10 [ 949.690216][T15387] ? sctp_getsockopt+0x9b/0xb60 [ 949.690238][T15387] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 949.690261][T15387] do_sock_getsockopt+0x36f/0x450 [ 949.690289][T15387] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 949.690315][T15387] ? write_ibpb+0x30/0x40 [ 949.690336][T15387] ? __fget_files+0x3a0/0x420 [ 949.690355][T15387] ? __fget_files+0x2a/0x420 [ 949.690382][T15387] __x64_sys_getsockopt+0x1a5/0x250 [ 949.690407][T15387] ? write_ibpb+0x30/0x40 [ 949.690430][T15387] ? write_ibpb+0x30/0x40 [ 949.690456][T15387] do_syscall_64+0xfa/0x3b0 [ 949.690478][T15387] ? lockdep_hardirqs_on+0x9c/0x150 [ 949.690500][T15387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.690521][T15387] ? clear_bhb_loop+0x60/0xb0 [ 949.690547][T15387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.690567][T15387] RIP: 0033:0x7f2413d8eec9 [ 949.690587][T15387] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 949.690605][T15387] RSP: 002b:00007f2414b4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 949.690627][T15387] RAX: ffffffffffffffda RBX: 00007f2413fe5fa0 RCX: 00007f2413d8eec9 [ 949.690643][T15387] RDX: 000000000000000a RSI: 0000000000000000 RDI: 0000000000000003 [ 949.690655][T15387] RBP: 00007f2414b4f090 R08: 0000200000000300 R09: 0000000000000000 [ 949.690682][T15387] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 949.690695][T15387] R13: 00007f2413fe6038 R14: 00007f2413fe5fa0 R15: 00007f241410fa28 [ 949.690728][T15387] [ 949.941881][ C0] vkms_vblank_simulate: vblank timer overrun [ 950.374478][ T5953] usb 6-1: USB disconnect, device number 113 [ 950.542638][ T5952] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 950.586156][ T5854] r8152-cfgselector 5-1: USB disconnect, device number 33 [ 950.724886][T15405] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2722'. [ 950.734203][ T5952] usb 2-1: Using ep0 maxpacket: 32 [ 950.744410][ T5952] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 950.756672][ T5952] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 950.783134][ T5952] usb 2-1: Product: syz [ 950.821742][T15405] syz_tun: left allmulticast mode [ 950.844953][ T5953] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 950.892616][ T5952] usb 2-1: Manufacturer: syz [ 950.897270][ T5952] usb 2-1: SerialNumber: syz [ 950.912134][T15405] syz_tun: left promiscuous mode [ 950.924825][T15405] bridge0: port 1(syz_tun) entered disabled state [ 950.993308][ T5952] usb 2-1: config 0 descriptor?? [ 951.003995][ T5952] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 951.069680][T12399] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 951.095559][ T5953] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 951.102398][T12399] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 951.104867][ T5953] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 951.128745][ T5953] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 951.175167][ T5953] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 951.183760][ T5953] usb 6-1: Manufacturer: syz [ 951.189149][T12399] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 951.199103][ T5953] usb 6-1: config 0 descriptor?? [ 951.442836][T12399] hid-generic 0000:0004:0000.0033: hidraw0: HID v0.00 Device [syz0] on syz0 [ 951.482408][ T5953] rc_core: IR keymap rc-hauppauge not found [ 951.488465][ T5953] Registered IR keymap rc-empty [ 951.565428][ T5953] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 951.656689][T15412] fido_id[15412]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 951.695495][ T5953] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input142 [ 951.973019][T10354] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 952.162471][T10354] usb 5-1: Using ep0 maxpacket: 16 [ 952.178425][T10354] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 952.189045][T10354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 952.242901][T10354] usb 5-1: Product: syz [ 952.259073][T10354] usb 5-1: Manufacturer: syz [ 952.272760][T10354] usb 5-1: SerialNumber: syz [ 952.314913][T10354] r8152-cfgselector 5-1: Unknown version 0x0000 [ 952.321283][T10354] r8152-cfgselector 5-1: config 0 descriptor?? [ 952.432153][T15403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 952.449987][T15403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 952.518186][ T5925] usb 6-1: USB disconnect, device number 114 [ 952.782414][T10354] r8152-cfgselector 5-1: USB disconnect, device number 34 [ 953.062610][ T5925] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 953.212664][ T5925] usb 3-1: device descriptor read/64, error -71 [ 953.451717][T15395] team0: entered promiscuous mode [ 953.462789][T15395] team_slave_0: entered promiscuous mode [ 953.471172][T15395] team_slave_1: entered promiscuous mode [ 953.480676][T15395] geneve0: entered promiscuous mode [ 953.483153][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 953.483204][ T30] audit: type=1800 audit(1758671912.197:2644): pid=15433 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2730" name="file1" dev="tmpfs" ino=2697 res=0 errno=0 [ 953.488037][T15395] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 953.500541][ T5925] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 953.537457][T12399] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 953.692839][ T2027] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 953.704136][ T5925] usb 3-1: device descriptor read/64, error -71 [ 953.712384][T12399] usb 4-1: Using ep0 maxpacket: 32 [ 953.719619][T12399] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 953.733559][T12399] usb 4-1: config 0 has no interface number 0 [ 953.745693][T12399] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 953.755201][T12399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.764819][T12399] usb 4-1: Product: syz [ 953.769895][T12399] usb 4-1: Manufacturer: syz [ 953.774928][T12399] usb 4-1: SerialNumber: syz [ 953.786206][T12399] usb 4-1: config 0 descriptor?? [ 953.805532][T12399] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 953.815144][ T5925] usb usb3-port1: attempt power cycle [ 953.848410][ T2027] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 953.857933][ T2027] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.870920][ T2027] usb 6-1: Product: syz [ 953.881542][ T2027] usb 6-1: Manufacturer: syz [ 953.891393][ T2027] usb 6-1: SerialNumber: syz [ 953.910800][ T2027] usb 6-1: config 0 descriptor?? [ 953.931612][ T2027] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 953.958199][ T5952] gspca_stk1135: reg_w 0x351 err -71 [ 953.964862][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 953.971256][ T5952] gspca_stk1135: Sensor write failed [ 953.976767][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 953.990019][ T5952] gspca_stk1135: Sensor write failed [ 954.000333][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.026364][ T5952] gspca_stk1135: Sensor read failed [ 954.038378][T12399] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 954.047824][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.058592][ T5952] gspca_stk1135: Sensor read failed [ 954.063986][ T5952] gspca_stk1135: Detected sensor type unknown (0x0) [ 954.071221][T12399] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 954.080769][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.133998][ T5952] gspca_stk1135: Sensor read failed [ 954.159576][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.166252][ T5925] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 954.179419][ T5952] gspca_stk1135: Sensor read failed [ 954.190589][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.201241][ T5952] gspca_stk1135: Sensor write failed [ 954.209327][ T5925] usb 3-1: device descriptor read/8, error -71 [ 954.224119][ T5952] gspca_stk1135: serial bus timeout: status=0x00 [ 954.230572][ T5952] gspca_stk1135: Sensor write failed [ 954.270403][ T5952] stk1135 2-1:0.0: probe with driver stk1135 failed with error -71 [ 954.297841][ T5952] usb 2-1: USB disconnect, device number 26 [ 954.492572][ T5925] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 954.523137][ T5925] usb 3-1: device descriptor read/8, error -71 [ 954.632913][ T5925] usb usb3-port1: unable to enumerate USB device [ 955.742215][ T5953] usb 6-1: USB disconnect, device number 115 [ 955.774489][T10354] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 956.091098][T10354] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 956.100484][T10354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 956.109236][T10354] usb 5-1: Product: syz [ 956.122800][T10354] usb 5-1: Manufacturer: syz [ 956.135425][T10354] usb 5-1: SerialNumber: syz [ 956.185789][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 956.195224][ T2027] usb 4-1: USB disconnect, device number 127 [ 956.201106][T10354] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 956.213929][ T2027] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 956.246417][ T5953] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 956.281449][ T2027] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 956.430256][ T2027] quatech2 4-1:0.51: device disconnected [ 956.561910][ T5925] usb 5-1: USB disconnect, device number 35 [ 956.793197][T15457] FAULT_INJECTION: forcing a failure. [ 956.793197][T15457] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 956.837186][T15457] CPU: 0 UID: 0 PID: 15457 Comm: syz.3.2736 Not tainted syzkaller #0 PREEMPT(full) [ 956.837216][T15457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 956.837230][T15457] Call Trace: [ 956.837239][T15457] [ 956.837248][T15457] dump_stack_lvl+0x189/0x250 [ 956.837278][T15457] ? __pfx____ratelimit+0x10/0x10 [ 956.837301][T15457] ? __pfx_dump_stack_lvl+0x10/0x10 [ 956.837326][T15457] ? __pfx__printk+0x10/0x10 [ 956.837368][T15457] should_fail_ex+0x414/0x560 [ 956.837403][T15457] _copy_to_user+0x31/0xb0 [ 956.837434][T15457] video_usercopy+0xeb2/0x14f0 [ 956.837470][T15457] ? __pfx___video_do_ioctl+0x10/0x10 [ 956.837494][T15457] ? __pfx_video_usercopy+0x10/0x10 [ 956.837531][T15457] ? __fget_files+0x2a/0x420 [ 956.837554][T15457] ? __fget_files+0x2a/0x420 [ 956.837571][T15457] ? __fget_files+0x3a0/0x420 [ 956.837592][T15457] v4l2_ioctl+0x18d/0x1e0 [ 956.837617][T15457] ? __pfx_v4l2_ioctl+0x10/0x10 [ 956.837640][T15457] __se_sys_ioctl+0xfc/0x170 [ 956.837668][T15457] do_syscall_64+0xfa/0x3b0 [ 956.837691][T15457] ? lockdep_hardirqs_on+0x9c/0x150 [ 956.837712][T15457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.837732][T15457] ? clear_bhb_loop+0x60/0xb0 [ 956.837759][T15457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.837779][T15457] RIP: 0033:0x7fbfe398eec9 [ 956.837798][T15457] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 956.837817][T15457] RSP: 002b:00007fbfe1bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 956.837839][T15457] RAX: ffffffffffffffda RBX: 00007fbfe3be5fa0 RCX: 00007fbfe398eec9 [ 956.837855][T15457] RDX: 0000200000000000 RSI: 00000000c008561b RDI: 0000000000000003 [ 956.837869][T15457] RBP: 00007fbfe1bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 956.837883][T15457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 956.837896][T15457] R13: 00007fbfe3be6038 R14: 00007fbfe3be5fa0 R15: 00007fbfe3d0fa28 [ 956.837929][T15457] [ 957.312538][ T5953] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 957.562380][T10354] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 957.592382][ T5854] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 957.793211][ T5953] ath9k_htc: Failed to initialize the device [ 957.946825][ T5925] usb 5-1: ath9k_htc: USB layer deinitialized [ 958.000351][T10354] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 958.016653][T10354] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 958.037146][ T5854] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 958.070278][T10354] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.078718][ T5854] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.096110][ T5854] usb 2-1: Product: syz [ 958.105229][ T5854] usb 2-1: Manufacturer: syz [ 958.111372][ T5854] usb 2-1: SerialNumber: syz [ 958.326272][T10354] usb 4-1: config 0 descriptor?? [ 958.340557][ T5854] usb 2-1: config 0 descriptor?? [ 958.369087][T10354] pwc: Askey VC010 type 2 USB webcam detected. [ 958.378025][ T5854] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 958.824969][T10354] pwc: recv_control_msg error -32 req 02 val 2b00 [ 958.832750][T10354] pwc: recv_control_msg error -32 req 02 val 2700 [ 958.851340][T10354] pwc: recv_control_msg error -32 req 02 val 2c00 [ 959.022470][ T5925] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 959.109303][T15461] netlink: 'syz.3.2738': attribute type 1 has an invalid length. [ 959.200731][T15478] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 959.211871][ T5925] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 959.223369][ T5925] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 959.236212][T15461] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2738'. [ 959.242207][T15478] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 959.245311][ T5925] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 959.245341][ T5925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.274683][T15470] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 959.300979][ T5925] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 959.332468][ T44] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 959.350764][T15483] FAULT_INJECTION: forcing a failure. [ 959.350764][T15483] name failslab, interval 1, probability 0, space 0, times 0 [ 959.365978][T15483] CPU: 0 UID: 0 PID: 15483 Comm: syz.2.2744 Not tainted syzkaller #0 PREEMPT(full) [ 959.366009][T15483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 959.366024][T15483] Call Trace: [ 959.366034][T15483] [ 959.366045][T15483] dump_stack_lvl+0x189/0x250 [ 959.366076][T15483] ? __pfx____ratelimit+0x10/0x10 [ 959.366099][T15483] ? __pfx_dump_stack_lvl+0x10/0x10 [ 959.366129][T15483] ? __pfx__printk+0x10/0x10 [ 959.366164][T15483] ? __pfx___might_resched+0x10/0x10 [ 959.366185][T15483] ? fs_reclaim_acquire+0x7d/0x100 [ 959.366210][T15483] should_fail_ex+0x414/0x560 [ 959.366248][T15483] should_failslab+0xa8/0x100 [ 959.366283][T15483] __kmalloc_noprof+0xcb/0x4f0 [ 959.366311][T15483] ? kfree+0x4d/0x440 [ 959.366336][T15483] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 959.366365][T15483] tomoyo_realpath_from_path+0xe3/0x5d0 [ 959.366400][T15483] ? tomoyo_domain+0xd9/0x130 [ 959.366435][T15483] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 959.366508][T15483] tomoyo_path_number_perm+0x1e8/0x5a0 [ 959.366543][T15483] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 959.366593][T15483] ? __lock_acquire+0xab9/0xd20 [ 959.366647][T15483] ? __fget_files+0x2a/0x420 [ 959.366668][T15483] ? __fget_files+0x2a/0x420 [ 959.366685][T15483] ? __fget_files+0x3a0/0x420 [ 959.366701][T15483] ? __fget_files+0x2a/0x420 [ 959.366725][T15483] security_file_ioctl+0xcb/0x2d0 [ 959.366756][T15483] __se_sys_ioctl+0x47/0x170 [ 959.366783][T15483] do_syscall_64+0xfa/0x3b0 [ 959.366802][T15483] ? lockdep_hardirqs_on+0x9c/0x150 [ 959.366819][T15483] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 959.366836][T15483] ? clear_bhb_loop+0x60/0xb0 [ 959.366858][T15483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 959.366878][T15483] RIP: 0033:0x7f287158eec9 [ 959.366896][T15483] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 959.366911][T15483] RSP: 002b:00007f28723ea038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 959.366929][T15483] RAX: ffffffffffffffda RBX: 00007f28717e6180 RCX: 00007f287158eec9 [ 959.366943][T15483] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 959.366953][T15483] RBP: 00007f28723ea090 R08: 0000000000000000 R09: 0000000000000000 [ 959.366963][T15483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 959.366973][T15483] R13: 00007f28717e6218 R14: 00007f28717e6180 R15: 00007f287190fa28 [ 959.367000][T15483] [ 959.367263][T15483] ERROR: Out of memory at tomoyo_realpath_from_path. [ 959.500643][T15470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.669943][ T44] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 959.692914][T15470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.703867][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.711583][T15483] input: syz0 as /devices/virtual/input/input143 [ 959.739186][ T44] usb 6-1: Product: syz [ 959.770394][ T44] usb 6-1: Manufacturer: syz [ 959.788067][ T44] usb 6-1: SerialNumber: syz [ 959.809051][T10354] pwc: recv_control_msg error -71 req 04 val 1300 [ 959.818679][ T5854] gspca_sunplus: reg_r err -71 [ 959.831149][ T44] usb 6-1: config 0 descriptor?? [ 959.836795][ T5854] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 959.855820][T10354] pwc: recv_control_msg error -71 req 04 val 1400 [ 959.867904][T15470] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 959.881873][T10354] pwc: recv_control_msg error -71 req 02 val 2000 [ 959.894798][ T44] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 959.901338][ T5854] usb 2-1: USB disconnect, device number 27 [ 959.913253][ T5925] usb 5-1: USB disconnect, device number 36 [ 959.923731][T10354] pwc: recv_control_msg error -71 req 02 val 2100 [ 959.975535][T10354] pwc: recv_control_msg error -71 req 04 val 1500 [ 960.010895][T10354] pwc: recv_control_msg error -71 req 02 val 2500 [ 960.018279][T10354] pwc: recv_control_msg error -71 req 02 val 2400 [ 960.026502][T10354] pwc: recv_control_msg error -71 req 02 val 2600 [ 960.039933][T10354] pwc: recv_control_msg error -71 req 02 val 2900 [ 960.051120][T10354] pwc: recv_control_msg error -71 req 02 val 2800 [ 960.059870][T10354] pwc: recv_control_msg error -71 req 04 val 1100 [ 960.078821][T10354] pwc: recv_control_msg error -71 req 04 val 1200 [ 960.097580][T10354] pwc: Registered as video103. [ 960.117657][T10354] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input144 [ 960.159855][T10354] usb 4-1: USB disconnect, device number 2 [ 960.822788][ T5925] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 960.977222][T10354] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 960.996085][ T5925] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 961.010762][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.019727][ T5925] usb 2-1: Product: syz [ 961.076558][ T5925] usb 2-1: Manufacturer: syz [ 961.089811][ T5925] usb 2-1: SerialNumber: syz [ 961.107162][ T5925] usb 2-1: config 0 descriptor?? [ 961.126122][ T5925] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 961.246805][ T2027] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 961.264723][T10354] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 961.273473][T10354] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 961.293387][T10354] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 961.308369][T10354] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 961.316531][T10354] usb 4-1: Manufacturer: syz [ 961.338811][T10354] usb 4-1: config 0 descriptor?? [ 961.417604][ T2027] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 132, changing to 11 [ 961.432565][ T2027] usb 3-1: config 0 interface 0 has no altsetting 0 [ 961.452178][ T2027] usb 3-1: New USB device found, idVendor=12ba, idProduct=0100, bcdDevice= 0.00 [ 961.475120][ T2027] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 961.491629][ T2027] usb 3-1: config 0 descriptor?? [ 961.532451][T10354] rc_core: IR keymap rc-hauppauge not found [ 961.538523][T10354] Registered IR keymap rc-empty [ 961.551651][T10354] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 961.588528][T10354] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input145 [ 961.946332][ T44] usb 6-1: USB disconnect, device number 116 [ 961.982133][ T2027] sony 0003:12BA:0100.0034: unbalanced collection at end of report description [ 962.023876][ T2027] sony 0003:12BA:0100.0034: parse failed [ 962.029749][ T2027] sony 0003:12BA:0100.0034: probe with driver sony failed with error -22 [ 962.187295][ T2027] usb 3-1: USB disconnect, device number 20 [ 962.825695][ T2027] usb 4-1: USB disconnect, device number 3 [ 962.902490][ T44] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 963.351982][ T2027] usb 2-1: USB disconnect, device number 28 [ 963.352365][ T44] usb 6-1: Using ep0 maxpacket: 32 [ 963.462209][ T44] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 963.479715][ T44] usb 6-1: config 0 has no interface number 0 [ 963.515128][ T44] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=2c.d8 [ 963.595039][ T44] usb 6-1: New USB device strings: Mfr=193, Product=2, SerialNumber=3 [ 963.619869][ T44] usb 6-1: Product: syz [ 963.656862][ T44] usb 6-1: Manufacturer: syz [ 963.661768][ T44] usb 6-1: SerialNumber: syz [ 963.672565][ T44] usb 6-1: config 0 descriptor?? [ 963.696709][ T44] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 963.708389][ T44] usb 6-1: selecting invalid altsetting 1 [ 963.718589][ T44] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 963.764629][ T44] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 963.925106][ T44] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 963.934453][ T44] usb 6-1: media controller created [ 963.951648][T15516] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 963.980961][T15516] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 964.033460][ T44] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 964.115430][ T30] audit: type=1326 audit(1758671922.837:2645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15519 comm="syz.1.2754" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2413d8eec9 code=0x0 [ 964.183888][T15518] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2753'. [ 964.218657][ T44] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 964.239084][ T44] zl10353_read_register: readreg error (reg=127, ret==-71) [ 964.265326][T15518] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2753'. [ 964.279367][ T44] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 964.644930][ T44] usb 6-1: USB disconnect, device number 117 [ 965.192394][ T44] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 965.326101][ T2027] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 965.382369][T10354] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 965.392464][ T5925] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 965.405513][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 965.419949][ T44] usb 4-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 965.441019][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.477179][ T44] usb 4-1: config 0 descriptor?? [ 965.536284][ T2027] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 965.545076][ T2027] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 965.564549][ T5925] usb 2-1: config 2 interface 0 has no altsetting 0 [ 965.573241][T10354] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 965.575540][ T5925] usb 2-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 965.594865][ T2027] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 965.605573][T10354] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 965.619468][ T2027] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 965.630937][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.646949][ T2027] usb 5-1: Manufacturer: syz [ 965.655485][ T5925] usb 2-1: Product: syz [ 965.655486][T10354] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 965.655513][T10354] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.660444][ T5925] usb 2-1: Manufacturer: syz [ 965.660472][ T5925] usb 2-1: SerialNumber: syz [ 965.691435][ T2027] usb 5-1: config 0 descriptor?? [ 966.219846][ T5925] usb 2-1: USB disconnect, device number 29 [ 966.342399][ T2027] rc_core: IR keymap rc-hauppauge not found [ 966.348376][ T2027] Registered IR keymap rc-empty [ 966.433897][ T2027] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 966.452935][T15543] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 966.485222][ T2027] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input146 [ 966.522657][T10354] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 966.744455][T15543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 966.759089][T15543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 967.472643][ T2027] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 967.654354][ T2027] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 967.665558][ T2027] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 967.694914][ T2027] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 967.710154][ T2027] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 967.844062][ T2027] usb 2-1: Manufacturer: syz [ 967.892935][ T2027] usb 2-1: config 0 descriptor?? [ 968.235669][ T5925] usb 5-1: USB disconnect, device number 37 [ 968.258986][ T2027] rc_core: IR keymap rc-hauppauge not found [ 968.335054][ T2027] Registered IR keymap rc-empty [ 968.469743][ T2027] rc rc1: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1 [ 968.598852][ T2027] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1/input147 [ 969.168519][T15568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2765'. [ 969.173188][ T44] usbhid 4-1:0.0: can't add hid device: -71 [ 969.253440][ T44] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 969.312370][ T44] usb 4-1: USB disconnect, device number 4 [ 969.466272][T10354] usb 6-1: USB disconnect, device number 118 [ 969.686513][ T30] audit: type=1326 audit(1758671928.287:2646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 969.779608][ T5854] usb 2-1: USB disconnect, device number 30 [ 969.802796][ T30] audit: type=1326 audit(1758671928.287:2647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 969.851558][ T30] audit: type=1326 audit(1758671928.287:2648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 970.030247][ T30] audit: type=1326 audit(1758671928.677:2649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 970.054199][T15012] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 970.078470][ T30] audit: type=1326 audit(1758671928.677:2650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 970.122554][ T44] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 970.206717][T10354] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 970.239203][T15012] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 970.250718][T15012] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 970.297186][T15012] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 970.317040][ T44] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 970.340469][ T44] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 970.465760][T15012] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.489668][ T44] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 970.519494][T10354] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 970.552892][ T44] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.565847][T10354] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.577057][T15012] usb 4-1: config 0 descriptor?? [ 970.589447][T10354] usb 6-1: Product: syz [ 970.628108][ T44] usb 3-1: config 0 descriptor?? [ 970.633423][T10354] usb 6-1: Manufacturer: syz [ 970.646276][ T44] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 970.673515][T10354] usb 6-1: SerialNumber: syz [ 970.689252][T15592] netlink: 'syz.1.2770': attribute type 29 has an invalid length. [ 970.830505][ T30] audit: type=1326 audit(1758671929.547:2651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 971.168455][ T30] audit: type=1326 audit(1758671929.577:2652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 971.192314][ T30] audit: type=1326 audit(1758671929.577:2653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 971.231250][ T30] audit: type=1326 audit(1758671929.577:2654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe3990de7 code=0x7ffc0000 [ 971.232109][T15595] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2771'. [ 971.287368][ T30] audit: type=1326 audit(1758671929.577:2655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15574 comm="syz.3.2767" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fbfe3990d5c code=0x7ffc0000 [ 972.382611][T10354] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPIPE [ 972.494640][T10354] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 972.538333][T10354] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 972.577149][T10354] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 972.607580][T10354] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 972.635594][T10354] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 972.676561][T10354] usb 6-1: USB disconnect, device number 119 [ 972.970428][ T5925] usb 3-1: USB disconnect, device number 21 [ 973.559352][T15012] usbhid 4-1:0.0: can't add hid device: -71 [ 973.577438][T15012] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 973.639901][T15012] usb 4-1: USB disconnect, device number 5 [ 974.262699][ T44] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 974.333356][T15012] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 974.436786][ T44] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 974.445628][ T44] usb 3-1: config 0 has no interface number 0 [ 974.459861][ T44] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 974.488171][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.550988][T15012] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 974.573931][ T44] usb 3-1: Product: syz [ 974.599557][T15012] usb 4-1: config 0 has no interface number 0 [ 974.607759][ T44] usb 3-1: Manufacturer: syz [ 974.634224][ T44] usb 3-1: SerialNumber: syz [ 974.644379][T15012] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 974.661677][T15012] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.671064][ T44] usb 3-1: config 0 descriptor?? [ 974.860420][ T30] kauditd_printk_skb: 119 callbacks suppressed [ 974.860440][ T30] audit: type=1326 audit(1758671933.577:2775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f287158eacb code=0x7ffc0000 [ 974.906896][ T44] hub 3-1:0.132: bad descriptor, ignoring hub [ 974.926222][T15012] usb 4-1: Product: syz [ 974.930448][T15012] usb 4-1: Manufacturer: syz [ 974.935241][ T44] hub 3-1:0.132: probe with driver hub failed with error -5 [ 974.976931][T15012] usb 4-1: SerialNumber: syz [ 974.990081][ T44] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input148 [ 975.019020][T15012] usb 4-1: config 0 descriptor?? [ 975.019611][ T30] audit: type=1326 audit(1758671933.577:2776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f287158eacb code=0x7ffc0000 [ 975.063843][T15012] hub 4-1:0.132: bad descriptor, ignoring hub [ 975.071218][T15012] hub 4-1:0.132: probe with driver hub failed with error -5 [ 975.126116][T15012] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input149 [ 975.157019][T15606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 975.177365][ T30] audit: type=1326 audit(1758671933.577:2777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f287158eacb code=0x7ffc0000 [ 975.200313][T15606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 975.287520][T15612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 975.296353][T15612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 975.317756][ T30] audit: type=1326 audit(1758671933.647:2778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f28715c1785 code=0x7ffc0000 [ 975.322023][T15602] delete_channel: no stack [ 975.343143][T15611] delete_channel: no stack [ 975.422721][ T30] audit: type=1326 audit(1758671933.777:2779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15611 comm="syz.3.2776" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbfe398eacb code=0x7ffc0000 [ 975.463394][ T30] audit: type=1326 audit(1758671933.777:2780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15611 comm="syz.3.2776" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbfe398eacb code=0x7ffc0000 [ 975.705344][ T30] audit: type=1326 audit(1758671933.787:2781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15611 comm="syz.3.2776" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbfe398eacb code=0x7ffc0000 [ 975.769158][ T30] audit: type=1326 audit(1758671933.797:2782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15611 comm="syz.3.2776" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbfe39c1785 code=0x7ffc0000 [ 975.803291][ T30] audit: type=1326 audit(1758671933.857:2783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f287158eec9 code=0x7ffc0000 [ 975.846381][ T30] audit: type=1326 audit(1758671933.857:2784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.2.2775" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f287158eec9 code=0x7ffc0000 [ 975.871489][T15619] FAULT_INJECTION: forcing a failure. [ 975.871489][T15619] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 975.891049][T15619] CPU: 0 UID: 0 PID: 15619 Comm: syz.5.2778 Not tainted syzkaller #0 PREEMPT(full) [ 975.891078][T15619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 975.891092][T15619] Call Trace: [ 975.891101][T15619] [ 975.891111][T15619] dump_stack_lvl+0x189/0x250 [ 975.891148][T15619] ? __pfx____ratelimit+0x10/0x10 [ 975.891169][T15619] ? __pfx_dump_stack_lvl+0x10/0x10 [ 975.891193][T15619] ? __pfx__printk+0x10/0x10 [ 975.891226][T15619] should_fail_ex+0x414/0x560 [ 975.891253][T15619] _copy_to_user+0x31/0xb0 [ 975.891274][T15619] simple_read_from_buffer+0xe1/0x170 [ 975.891301][T15619] proc_fail_nth_read+0x1b3/0x220 [ 975.891321][T15619] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 975.891341][T15619] ? rw_verify_area+0x2a6/0x4d0 [ 975.891359][T15619] ? __lock_acquire+0xab9/0xd20 [ 975.891380][T15619] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 975.891398][T15619] vfs_read+0x200/0xa30 [ 975.891417][T15619] ? fdget_pos+0x247/0x320 [ 975.891433][T15619] ? __pfx___mutex_lock+0x10/0x10 [ 975.891451][T15619] ? __pfx_vfs_read+0x10/0x10 [ 975.891472][T15619] ? __fget_files+0x2a/0x420 [ 975.891488][T15619] ? __fget_files+0x3a0/0x420 [ 975.891501][T15619] ? __fget_files+0x2a/0x420 [ 975.891521][T15619] ksys_read+0x145/0x250 [ 975.891543][T15619] ? __pfx_ksys_read+0x10/0x10 [ 975.891561][T15619] ? rcu_is_watching+0x15/0xb0 [ 975.891581][T15619] ? do_syscall_64+0xbe/0x3b0 [ 975.891600][T15619] do_syscall_64+0xfa/0x3b0 [ 975.891616][T15619] ? lockdep_hardirqs_on+0x9c/0x150 [ 975.891631][T15619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.891646][T15619] ? clear_bhb_loop+0x60/0xb0 [ 975.891664][T15619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.891679][T15619] RIP: 0033:0x7f753bb8d8dc [ 975.891693][T15619] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 975.891706][T15619] RSP: 002b:00007f753cab0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 975.891722][T15619] RAX: ffffffffffffffda RBX: 00007f753bde5fa0 RCX: 00007f753bb8d8dc [ 975.891733][T15619] RDX: 000000000000000f RSI: 00007f753cab00a0 RDI: 0000000000000006 [ 975.891743][T15619] RBP: 00007f753cab0090 R08: 0000000000000000 R09: 0000000000000000 [ 975.891753][T15619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 975.891762][T15619] R13: 00007f753bde6038 R14: 00007f753bde5fa0 R15: 00007f753bf0fa28 [ 975.891786][T15619] [ 976.350672][T15012] usb 4-1: USB disconnect, device number 6 [ 976.593257][T15628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2781'. [ 976.626243][T15628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2781'. [ 976.702420][T10354] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 976.712453][ T5925] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 976.767388][T15636] FAULT_INJECTION: forcing a failure. [ 976.767388][T15636] name failslab, interval 1, probability 0, space 0, times 0 [ 976.843904][T15636] CPU: 0 UID: 0 PID: 15636 Comm: syz.3.2784 Not tainted syzkaller #0 PREEMPT(full) [ 976.843935][T15636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 976.843947][T15636] Call Trace: [ 976.843956][T15636] [ 976.843966][T15636] dump_stack_lvl+0x189/0x250 [ 976.844003][T15636] ? __pfx____ratelimit+0x10/0x10 [ 976.844026][T15636] ? __pfx_dump_stack_lvl+0x10/0x10 [ 976.844051][T15636] ? __pfx__printk+0x10/0x10 [ 976.844093][T15636] ? __pfx___might_resched+0x10/0x10 [ 976.844113][T15636] ? fs_reclaim_acquire+0x7d/0x100 [ 976.844139][T15636] should_fail_ex+0x414/0x560 [ 976.844176][T15636] should_failslab+0xa8/0x100 [ 976.844208][T15636] __kmalloc_noprof+0xcb/0x4f0 [ 976.844234][T15636] ? kfree+0x4d/0x440 [ 976.844257][T15636] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 976.844286][T15636] tomoyo_realpath_from_path+0xe3/0x5d0 [ 976.844310][T15636] ? tomoyo_domain+0xd9/0x130 [ 976.844343][T15636] tomoyo_path_perm+0x213/0x4b0 [ 976.844372][T15636] ? leave_rcu+0xef/0x160 [ 976.844391][T15636] ? tomoyo_path_perm+0x1e3/0x4b0 [ 976.844421][T15636] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 976.844492][T15636] ? __pfx_current_check_access_path+0x10/0x10 [ 976.844512][T15636] ? __d_lookup+0x66/0x780 [ 976.844539][T15636] ? __d_lookup+0x66/0x780 [ 976.844560][T15636] ? __d_lookup+0x6df/0x780 [ 976.844587][T15636] tomoyo_path_unlink+0xa2/0xe0 [ 976.844612][T15636] ? __pfx_tomoyo_path_unlink+0x10/0x10 [ 976.844662][T15636] ? d_lookup+0x80/0xa0 [ 976.844688][T15636] security_path_unlink+0x167/0x360 [ 976.844716][T15636] do_unlinkat+0x2c1/0x560 [ 976.844751][T15636] ? __pfx_do_unlinkat+0x10/0x10 [ 976.844787][T15636] ? getname_flags+0x1e5/0x540 [ 976.844813][T15636] __x64_sys_unlink+0x47/0x50 [ 976.844840][T15636] do_syscall_64+0xfa/0x3b0 [ 976.844861][T15636] ? lockdep_hardirqs_on+0x9c/0x150 [ 976.844882][T15636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.844903][T15636] ? clear_bhb_loop+0x60/0xb0 [ 976.844929][T15636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.844949][T15636] RIP: 0033:0x7fbfe398eec9 [ 976.844967][T15636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 976.844985][T15636] RSP: 002b:00007fbfe1bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 976.845007][T15636] RAX: ffffffffffffffda RBX: 00007fbfe3be5fa0 RCX: 00007fbfe398eec9 [ 976.845022][T15636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000003c0 [ 976.845035][T15636] RBP: 00007fbfe1bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 976.845049][T15636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 976.845060][T15636] R13: 00007fbfe3be6038 R14: 00007fbfe3be5fa0 R15: 00007fbfe3d0fa28 [ 976.845100][T15636] [ 976.845110][T15636] ERROR: Out of memory at tomoyo_realpath_from_path. [ 976.862969][T10354] usb 2-1: Using ep0 maxpacket: 16 [ 977.022882][ T5925] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 977.141692][ T5925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 977.160220][ T5925] usb 6-1: Product: syz [ 977.169204][ T5925] usb 6-1: Manufacturer: syz [ 977.173402][T15638] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2784'. [ 977.175755][ T5925] usb 6-1: SerialNumber: syz [ 977.223424][ T5925] usb 6-1: config 0 descriptor?? [ 977.257466][ T5925] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 978.067980][T10354] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 978.100248][T10354] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 978.112378][T10354] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.129163][T10354] usb 2-1: Product: syz [ 978.139308][T10354] usb 2-1: Manufacturer: syz [ 978.156773][T10354] usb 2-1: SerialNumber: syz [ 978.188143][T10354] usb 2-1: config 0 descriptor?? [ 978.210574][T15623] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 978.220743][T10354] mcba_usb 2-1:0.0: Can't find endpoints [ 978.465129][T15623] netlink: 'syz.1.2779': attribute type 5 has an invalid length. [ 978.574838][T15623] bridge0: port 1(macsec0) entered blocking state [ 978.581520][T15623] bridge0: port 1(macsec0) entered disabled state [ 978.588751][T15623] macsec0: entered allmulticast mode [ 978.616506][T15623] macsec0: entered promiscuous mode [ 978.760604][T15647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 978.772877][T15647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.960911][ T5925] gspca_sunplus: reg_r err -71 [ 978.966269][ T5925] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 979.060930][ T5925] usb 6-1: USB disconnect, device number 120 [ 979.572402][T10354] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 979.694748][ T44] usb 3-1: USB disconnect, device number 22 [ 979.732382][T10354] usb 5-1: Using ep0 maxpacket: 32 [ 979.755791][T10354] usb 5-1: config 1 interface 0 altsetting 175 bulk endpoint 0x1 has invalid maxpacket 1024 [ 979.789622][T10354] usb 5-1: config 1 interface 0 altsetting 175 bulk endpoint 0x82 has invalid maxpacket 64 [ 979.837090][T10354] usb 5-1: config 1 interface 0 has no altsetting 0 [ 979.877331][T10354] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 979.892414][T10354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.914234][ T5925] usb 2-1: USB disconnect, device number 31 [ 979.916856][T10354] usb 5-1: Product: syz [ 979.960625][T10354] usb 5-1: Manufacturer: syz [ 979.969039][T10354] usb 5-1: SerialNumber: syz [ 979.979270][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 979.979290][ T30] audit: type=1326 audit(1758671938.697:2826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.008351][ C0] vkms_vblank_simulate: vblank timer overrun [ 980.023779][T15655] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 980.025749][ T30] audit: type=1326 audit(1758671938.697:2827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.060787][T15655] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 980.071226][ T30] audit: type=1326 audit(1758671938.697:2828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.093734][ C0] vkms_vblank_simulate: vblank timer overrun [ 980.101801][ T30] audit: type=1326 audit(1758671938.697:2829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.124733][ T30] audit: type=1326 audit(1758671938.697:2830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.148007][T15668] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2793'. [ 980.157028][ T30] audit: type=1326 audit(1758671938.697:2831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.185111][ T30] audit: type=1326 audit(1758671938.697:2832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.208970][ T30] audit: type=1326 audit(1758671938.697:2833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fbfe398eec9 code=0x7ffc0000 [ 980.231886][ T30] audit: type=1326 audit(1758671938.727:2834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbfe398ef03 code=0x7ffc0000 [ 980.254691][ T30] audit: type=1326 audit(1758671938.727:2835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15665 comm="syz.3.2792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbfe398ef03 code=0x7ffc0000 [ 980.277013][ C0] vkms_vblank_simulate: vblank timer overrun [ 980.310081][T10354] usb 5-1: USB disconnect, device number 38 [ 980.317478][T15012] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 980.490491][T15012] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 980.498836][T15012] usb 4-1: config 0 has no interface number 0 [ 980.509541][T15012] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 980.519205][T15012] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.535083][T15012] usb 4-1: Product: syz [ 980.539417][T15012] usb 4-1: Manufacturer: syz [ 980.548288][T15012] usb 4-1: SerialNumber: syz [ 980.560603][T15012] usb 4-1: config 0 descriptor?? [ 980.569063][T15012] hub 4-1:0.132: bad descriptor, ignoring hub [ 980.575337][T15012] hub 4-1:0.132: probe with driver hub failed with error -5 [ 980.586109][T15012] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input150 [ 980.772405][ T5925] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 980.801029][T15666] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 980.820802][T15666] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 980.830946][T15665] delete_channel: no stack [ 980.924659][ T5925] usb 6-1: config 2 interface 0 has no altsetting 0 [ 980.941382][ T5925] usb 6-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 980.951232][ T5925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.961053][ T5925] usb 6-1: Product: syz [ 980.965691][ T5925] usb 6-1: Manufacturer: syz [ 980.970331][ T5925] usb 6-1: SerialNumber: syz [ 980.974467][ T44] usb 4-1: USB disconnect, device number 7 [ 981.056342][T15682] loop2: detected capacity change from 0 to 7 [ 981.067363][T15682] Dev loop2: unable to read RDB block 7 [ 981.074727][T15682] loop2: unable to read partition table [ 981.080619][T15682] loop2: partition table beyond EOD, truncated [ 981.088704][T15682] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 981.227947][ T5925] usb 6-1: USB disconnect, device number 121 [ 981.234268][ T5952] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 981.355047][T15684] tipc: Enabled bearer , priority 0 [ 981.363317][T15684] syzkaller0: entered promiscuous mode [ 981.369579][T15684] syzkaller0: entered allmulticast mode [ 981.383184][T15684] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 981.392519][ T5952] usb 3-1: Using ep0 maxpacket: 32 [ 981.401401][T15683] tipc: Resetting bearer [ 981.404597][ T5952] usb 3-1: config 8 has an invalid interface number: 134 but max is 0 [ 981.421374][ T5952] usb 3-1: config 8 has no interface number 0 [ 981.428132][ T5952] usb 3-1: config 8 interface 134 has no altsetting 0 [ 981.448540][ T5952] usb 3-1: New USB device found, idVendor=04a5, idProduct=3035, bcdDevice= 4.15 [ 981.458201][ T5952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.480658][T15683] tipc: Disabling bearer [ 981.482540][ T5952] usb 3-1: Product: syz [ 981.492673][ T5952] usb 3-1: Manufacturer: syz [ 981.497902][ T5952] usb 3-1: SerialNumber: syz [ 981.736334][ T5952] gspca_main: benq-2.14.0 probing 04a5:3035 [ 982.039863][ T5952] usb 3-1: USB disconnect, device number 23 [ 982.176728][T15700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2804'. [ 982.218226][T15702] netlink: 292 bytes leftover after parsing attributes in process `syz.3.2801'. [ 982.933140][T15709] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2806'. [ 984.034330][ T5952] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 984.047927][ T5925] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 984.249637][ T5925] usb 2-1: Using ep0 maxpacket: 8 [ 984.257675][ T5925] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 984.272784][ T5925] usb 2-1: config 0 has no interface number 0 [ 984.280033][ T5952] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 984.293857][ T5925] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 984.305403][ T5952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.319782][ T5952] usb 3-1: Product: syz [ 984.324264][ T5925] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 984.342531][ T5952] usb 3-1: Manufacturer: syz [ 984.347556][ T5952] usb 3-1: SerialNumber: syz [ 984.355767][ T5925] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 984.387324][ T5952] usb 3-1: config 0 descriptor?? [ 984.396822][ T5925] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 984.427409][ T5952] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 984.466031][ T5925] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 984.476180][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.489476][ T5925] usb 2-1: config 0 descriptor?? [ 984.518776][ T5925] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 984.897636][ T5925] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 985.043437][ T2027] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 985.072458][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 985.093566][ T5925] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 985.114205][ T5925] usb 5-1: config 0 has no interfaces? [ 985.137134][ T5925] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 985.160274][ T5952] gspca_sunplus: reg_r err -110 [ 985.175388][ T5952] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 985.184171][ T5925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.244553][ T5925] usb 5-1: config 0 descriptor?? [ 985.262143][ T2027] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 985.310976][ T2027] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 985.353290][ T2027] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 985.381736][ T2027] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.823652][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 985.846634][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 985.985069][T15731] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 985.998789][ T2027] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 986.130287][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 986.143642][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 986.376592][T15737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 986.391257][T15737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 986.478165][T15737] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 987.481963][ T44] usb 2-1: USB disconnect, device number 32 [ 987.482057][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 987.494886][ T44] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 987.659930][T15012] usb 3-1: USB disconnect, device number 24 [ 988.041483][T15747] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2817'. [ 988.142726][ T2027] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 988.359607][ T44] usb 5-1: USB disconnect, device number 39 [ 988.386124][ T2027] usb 4-1: Using ep0 maxpacket: 32 [ 988.427205][ T2027] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 988.460885][ T2027] usb 4-1: config 0 has no interface number 0 [ 988.464723][T15012] usb 6-1: USB disconnect, device number 122 [ 988.499258][ T2027] usb 4-1: config 0 interface 89 has no altsetting 0 [ 988.527754][ T2027] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 988.557897][ T2027] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.619062][ T2027] usb 4-1: Product: syz [ 988.628711][T15756] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2820'. [ 988.638649][ T2027] usb 4-1: Manufacturer: syz [ 988.660721][ T2027] usb 4-1: SerialNumber: syz [ 988.694608][ T2027] usb 4-1: config 0 descriptor?? [ 988.752699][ T44] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 988.754378][ T2027] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 988.806363][ T2027] em28xx 4-1:0.89: Video interface 89 found: bulk [ 988.873980][T15759] input: syz1 as /devices/virtual/input/input151 [ 988.920365][ T44] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 988.997636][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.058087][ T44] usb 5-1: Product: syz [ 989.062946][ T44] usb 5-1: Manufacturer: syz [ 989.067672][ T44] usb 5-1: SerialNumber: syz [ 989.113700][ T44] usb 5-1: config 0 descriptor?? [ 989.203865][ T44] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 989.406015][ T2027] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 989.819537][T15012] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 990.312504][T15012] usb 2-1: Using ep0 maxpacket: 16 [ 990.371610][T15012] usb 2-1: config 0 has an invalid interface number: 49 but max is 0 [ 990.383806][T15012] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 990.414201][T15012] usb 2-1: config 0 has no interface number 0 [ 990.427754][T15012] usb 2-1: config 0 interface 49 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 990.453353][T15012] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 990.462895][T15012] usb 2-1: New USB device strings: Mfr=5, Product=2, SerialNumber=3 [ 990.702370][T15012] usb 2-1: Product: syz [ 990.706789][T15012] usb 2-1: Manufacturer: syz [ 990.712089][T15012] usb 2-1: SerialNumber: syz [ 990.823215][T15012] usb 2-1: config 0 descriptor?? [ 990.972584][ T2027] em28xx 4-1:0.89: AC97 command still being executed: not handled properly! [ 991.069473][T15762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 991.083102][T15762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 991.161722][ T2027] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 991.181008][ T2027] em28xx 4-1:0.89: board has no eeprom [ 991.188971][T15772] em28xx 4-1:0.89: writing to i2c device at 0x0 failed (error=-5) [ 991.201005][T15012] qmi_wwan 2-1:0.49: skipping garbage [ 991.218985][T15012] qmi_wwan 2-1:0.49: probe with driver qmi_wwan failed with error -22 [ 991.265005][T15012] usb 2-1: USB disconnect, device number 33 [ 991.275941][ T2027] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 991.299143][ T2027] em28xx 4-1:0.89: analog set to bulk mode. [ 991.308948][T15772] delete_channel: no stack [ 991.320605][ T5925] em28xx 4-1:0.89: Registering V4L2 extension [ 991.344403][ T2027] usb 4-1: USB disconnect, device number 8 [ 991.364900][T15776] : entered promiscuous mode [ 991.383150][ T2027] em28xx 4-1:0.89: Disconnecting em28xx [ 991.448081][ T5925] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 991.478096][ T5925] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 991.508527][ T5925] em28xx 4-1:0.89: No AC97 audio processor [ 991.529548][ T5952] usb 5-1: USB disconnect, device number 40 [ 991.562786][ T5925] usb 4-1: Decoder not found [ 991.567479][ T5925] em28xx 4-1:0.89: failed to create media graph [ 991.600645][ T5925] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 991.610504][T15778] ================================================================== [ 991.618780][T15778] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 991.626190][T15778] Read of size 8 at addr ffff88801174c740 by task v4l_id/15778 [ 991.633849][T15778] [ 991.636207][T15778] CPU: 0 UID: 0 PID: 15778 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 991.636237][T15778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 991.636252][T15778] Call Trace: [ 991.636261][T15778] [ 991.636270][T15778] dump_stack_lvl+0x189/0x250 [ 991.636306][T15778] ? rcu_is_watching+0x15/0xb0 [ 991.636328][T15778] ? __kasan_check_byte+0x12/0x40 [ 991.636359][T15778] ? __pfx_dump_stack_lvl+0x10/0x10 [ 991.636382][T15778] ? rcu_is_watching+0x15/0xb0 [ 991.636402][T15778] ? lock_release+0x4b/0x3e0 [ 991.636435][T15778] ? __virt_addr_valid+0x1c8/0x5c0 [ 991.636470][T15778] ? __virt_addr_valid+0x4a5/0x5c0 [ 991.636498][T15778] print_report+0xca/0x240 [ 991.636519][T15778] ? v4l2_fh_open+0xc7/0x430 [ 991.636539][T15778] kasan_report+0x118/0x150 [ 991.636577][T15778] ? v4l2_fh_open+0xc7/0x430 [ 991.636602][T15778] v4l2_fh_open+0xc7/0x430 [ 991.636626][T15778] em28xx_v4l2_open+0x157/0x9a0 [ 991.636665][T15778] v4l2_open+0x20f/0x360 [ 991.636690][T15778] chrdev_open+0x4c9/0x5e0 [ 991.636710][T15778] ? __pfx_chrdev_open+0x10/0x10 [ 991.636730][T15778] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 991.636766][T15778] ? __pfx_chrdev_open+0x10/0x10 [ 991.636784][T15778] do_dentry_open+0x950/0x13f0 [ 991.636812][T15778] vfs_open+0x3b/0x340 [ 991.636830][T15778] ? path_openat+0x2ecd/0x3830 [ 991.636856][T15778] path_openat+0x2ee5/0x3830 [ 991.636879][T15778] ? arch_stack_walk+0xfc/0x150 [ 991.636913][T15778] ? stack_depot_save_flags+0x40/0x860 [ 991.636952][T15778] ? __pfx_path_openat+0x10/0x10 [ 991.636975][T15778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.637005][T15778] do_filp_open+0x1fa/0x410 [ 991.637029][T15778] ? __lock_acquire+0xab9/0xd20 [ 991.637059][T15778] ? __pfx_do_filp_open+0x10/0x10 [ 991.637095][T15778] ? _raw_spin_unlock+0x28/0x50 [ 991.637125][T15778] ? alloc_fd+0x64c/0x6c0 [ 991.637160][T15778] do_sys_openat2+0x121/0x1c0 [ 991.637184][T15778] ? __pfx_do_sys_openat2+0x10/0x10 [ 991.637207][T15778] ? exc_page_fault+0x76/0xf0 [ 991.637229][T15778] ? do_user_addr_fault+0xc8a/0x1390 [ 991.637263][T15778] __x64_sys_openat+0x138/0x170 [ 991.637288][T15778] do_syscall_64+0xfa/0x3b0 [ 991.637319][T15778] ? lockdep_hardirqs_on+0x9c/0x150 [ 991.637340][T15778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.637360][T15778] ? clear_bhb_loop+0x60/0xb0 [ 991.637382][T15778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.637403][T15778] RIP: 0033:0x7f2b118a7407 [ 991.637422][T15778] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 991.637439][T15778] RSP: 002b:00007ffe81639040 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 991.637460][T15778] RAX: ffffffffffffffda RBX: 00007f2b1207a880 RCX: 00007f2b118a7407 [ 991.637475][T15778] RDX: 0000000000000000 RSI: 00007ffe81639f1d RDI: ffffffffffffff9c [ 991.637488][T15778] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 991.637500][T15778] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 991.637513][T15778] R13: 00007ffe81639290 R14: 00007f2b121e1000 R15: 0000562ab8fdc4d8 [ 991.637535][T15778] [ 991.637542][T15778] [ 991.948379][T15778] Allocated by task 5925: [ 991.952710][T15778] kasan_save_track+0x3e/0x80 [ 991.957403][T15778] __kasan_kmalloc+0x93/0xb0 [ 991.962003][T15778] __kmalloc_cache_noprof+0x230/0x3d0 [ 991.967384][T15778] em28xx_v4l2_init+0x10b/0x2e70 [ 991.972549][T15778] em28xx_init_extension+0x120/0x1c0 [ 991.977940][T15778] process_scheduled_works+0xae1/0x17b0 [ 991.983665][T15778] worker_thread+0x8a0/0xda0 [ 991.988283][T15778] kthread+0x70e/0x8a0 [ 991.992365][T15778] ret_from_fork+0x439/0x7d0 [ 991.997046][T15778] ret_from_fork_asm+0x1a/0x30 [ 992.001823][T15778] [ 992.004170][T15778] Freed by task 5925: [ 992.008151][T15778] kasan_save_track+0x3e/0x80 [ 992.012858][T15778] kasan_save_free_info+0x46/0x50 [ 992.017887][T15778] __kasan_slab_free+0x5b/0x80 [ 992.022668][T15778] kfree+0x18e/0x440 [ 992.026678][T15778] em28xx_v4l2_init+0x1683/0x2e70 [ 992.031718][T15778] em28xx_init_extension+0x120/0x1c0 [ 992.037036][T15778] process_scheduled_works+0xae1/0x17b0 [ 992.043371][T15778] worker_thread+0x8a0/0xda0 [ 992.047964][T15778] kthread+0x70e/0x8a0 [ 992.052038][T15778] ret_from_fork+0x439/0x7d0 [ 992.056633][T15778] ret_from_fork_asm+0x1a/0x30 [ 992.061413][T15778] [ 992.063740][T15778] The buggy address belongs to the object at ffff88801174c000 [ 992.063740][T15778] which belongs to the cache kmalloc-8k of size 8192 [ 992.077811][T15778] The buggy address is located 1856 bytes inside of [ 992.077811][T15778] freed 8192-byte region [ffff88801174c000, ffff88801174e000) [ 992.091797][T15778] [ 992.094131][T15778] The buggy address belongs to the physical page: [ 992.100559][T15778] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11748 [ 992.109333][T15778] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 992.117839][T15778] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 992.125749][T15778] page_type: f5(slab) [ 992.129751][T15778] raw: 00fff00000000040 ffff88801a442280 ffffea0000a62c00 dead000000000003 [ 992.138357][T15778] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 992.146950][T15778] head: 00fff00000000040 ffff88801a442280 ffffea0000a62c00 dead000000000003 [ 992.155629][T15778] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 992.164325][T15778] head: 00fff00000000003 ffffea000045d201 00000000ffffffff 00000000ffffffff [ 992.172998][T15778] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 992.181689][T15778] page dumped because: kasan: bad access detected [ 992.188105][T15778] page_owner tracks the page as allocated [ 992.193820][T15778] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15349, tgid 15348 (syz.2.2709), ts 944322550794, free_ts 944208967228 [ 992.215362][T15778] post_alloc_hook+0x240/0x2a0 [ 992.220147][T15778] get_page_from_freelist+0x21e4/0x22c0 [ 992.225751][T15778] __alloc_frozen_pages_noprof+0x181/0x370 [ 992.231562][T15778] alloc_pages_mpol+0x232/0x4a0 [ 992.236425][T15778] allocate_slab+0x8a/0x370 [ 992.240936][T15778] ___slab_alloc+0xbeb/0x1420 [ 992.245659][T15778] __kmalloc_cache_noprof+0x296/0x3d0 [ 992.251045][T15778] audit_log_d_path+0xb5/0x190 [ 992.255813][T15778] audit_log_d_path_exe+0x42/0x70 [ 992.260849][T15778] audit_log_task+0x2b3/0x3c0 [ 992.265531][T15778] audit_seccomp+0x86/0x190 [ 992.270036][T15778] __seccomp_filter+0x9aa/0x1a40 [ 992.274975][T15778] syscall_trace_enter+0xaa/0x160 [ 992.280010][T15778] do_syscall_64+0xd3/0x3b0 [ 992.284525][T15778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.290441][T15778] page last free pid 15352 tgid 15346 stack trace: [ 992.296939][T15778] __free_frozen_pages+0xbc4/0xd30 [ 992.302151][T15778] __slab_free+0x303/0x3c0 [ 992.306585][T15778] qlist_free_all+0x97/0x140 [ 992.311195][T15778] kasan_quarantine_reduce+0x148/0x160 [ 992.316692][T15778] __kasan_slab_alloc+0x22/0x80 [ 992.321553][T15778] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 992.327034][T15778] getname_flags+0xb8/0x540 [ 992.331547][T15778] do_sys_openat2+0xbc/0x1c0 [ 992.336146][T15778] __x64_sys_openat+0x138/0x170 [ 992.341003][T15778] do_syscall_64+0xfa/0x3b0 [ 992.345517][T15778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.351427][T15778] [ 992.353756][T15778] Memory state around the buggy address: [ 992.359386][T15778] ffff88801174c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.367448][T15778] ffff88801174c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.375510][T15778] >ffff88801174c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.383593][T15778] ^ [ 992.389747][T15778] ffff88801174c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.397827][T15778] ffff88801174c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.405916][T15778] ================================================================== [ 992.422342][ T5925] em28xx 4-1:0.89: Registering snapshot button... [ 992.430900][ T5925] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input152 [ 992.436485][T15778] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 992.436511][T15778] CPU: 1 UID: 0 PID: 15778 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 992.436540][T15778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 992.436556][T15778] Call Trace: [ 992.436566][T15778] [ 992.436579][T15778] dump_stack_lvl+0x99/0x250 [ 992.436614][T15778] ? __asan_memcpy+0x40/0x70 [ 992.436643][T15778] ? __pfx_dump_stack_lvl+0x10/0x10 [ 992.436674][T15778] ? __pfx__printk+0x10/0x10 [ 992.436714][T15778] vpanic+0x281/0x750 [ 992.436742][T15778] ? preempt_schedule+0xae/0xc0 [ 992.436765][T15778] ? __pfx_vpanic+0x10/0x10 [ 992.436791][T15778] ? preempt_schedule_common+0x83/0xd0 [ 992.436815][T15778] ? preempt_schedule+0xae/0xc0 [ 992.436840][T15778] ? __pfx_preempt_schedule+0x10/0x10 [ 992.436867][T15778] panic+0xb9/0xc0 [ 992.436893][T15778] ? __pfx_panic+0x10/0x10 [ 992.436921][T15778] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 992.436963][T15778] ? v4l2_fh_open+0xc7/0x430 [ 992.436986][T15778] check_panic_on_warn+0x89/0xb0 [ 992.437019][T15778] ? v4l2_fh_open+0xc7/0x430 [ 992.437042][T15778] end_report+0x78/0x160 [ 992.437073][T15778] kasan_report+0x129/0x150 [ 992.437108][T15778] ? v4l2_fh_open+0xc7/0x430 [ 992.437136][T15778] v4l2_fh_open+0xc7/0x430 [ 992.437164][T15778] em28xx_v4l2_open+0x157/0x9a0 [ 992.437205][T15778] v4l2_open+0x20f/0x360 [ 992.437232][T15778] chrdev_open+0x4c9/0x5e0 [ 992.437257][T15778] ? __pfx_chrdev_open+0x10/0x10 [ 992.437280][T15778] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 992.437320][T15778] ? __pfx_chrdev_open+0x10/0x10 [ 992.437339][T15778] do_dentry_open+0x950/0x13f0 [ 992.437373][T15778] vfs_open+0x3b/0x340 [ 992.437394][T15778] ? path_openat+0x2ecd/0x3830 [ 992.437423][T15778] path_openat+0x2ee5/0x3830 [ 992.437458][T15778] ? arch_stack_walk+0xfc/0x150 [ 992.437496][T15778] ? stack_depot_save_flags+0x40/0x860 [ 992.437540][T15778] ? __pfx_path_openat+0x10/0x10 [ 992.437566][T15778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.437603][T15778] do_filp_open+0x1fa/0x410 [ 992.437629][T15778] ? __lock_acquire+0xab9/0xd20 [ 992.437666][T15778] ? __pfx_do_filp_open+0x10/0x10 [ 992.437708][T15778] ? _raw_spin_unlock+0x28/0x50 [ 992.437742][T15778] ? alloc_fd+0x64c/0x6c0 [ 992.437781][T15778] do_sys_openat2+0x121/0x1c0 [ 992.437808][T15778] ? __pfx_do_sys_openat2+0x10/0x10 [ 992.437834][T15778] ? exc_page_fault+0x76/0xf0 [ 992.437859][T15778] ? do_user_addr_fault+0xc8a/0x1390 [ 992.437897][T15778] __x64_sys_openat+0x138/0x170 [ 992.437925][T15778] do_syscall_64+0xfa/0x3b0 [ 992.437951][T15778] ? lockdep_hardirqs_on+0x9c/0x150 [ 992.437976][T15778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.438000][T15778] ? clear_bhb_loop+0x60/0xb0 [ 992.438028][T15778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.438053][T15778] RIP: 0033:0x7f2b118a7407 [ 992.438075][T15778] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 992.438098][T15778] RSP: 002b:00007ffe81639040 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 992.438125][T15778] RAX: ffffffffffffffda RBX: 00007f2b1207a880 RCX: 00007f2b118a7407 [ 992.438143][T15778] RDX: 0000000000000000 RSI: 00007ffe81639f1d RDI: ffffffffffffff9c [ 992.438161][T15778] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 992.438175][T15778] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 992.438189][T15778] R13: 00007ffe81639290 R14: 00007f2b121e1000 R15: 0000562ab8fdc4d8 [ 992.438219][T15778] [ 992.441880][T15778] Kernel Offset: disabled