[ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 253.867879][ T8944] device veth0_vlan entered promiscuous mode [ 253.876980][ T9442] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 253.884526][ T9442] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 253.911381][ T9442] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 253.923203][ T9288] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 253.996759][ T8944] device veth1_vlan entered promiscuous mode [ 254.021730][ T9098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.029088][ T9288] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 254.060419][ T9288] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 254.149864][ T9442] device hsr_slave_0 entered promiscuous mode [ 254.188106][ T9442] device hsr_slave_1 entered promiscuous mode [ 254.227834][ T9442] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 254.235483][ T9442] Cannot create hsr debugfs directory [ 254.262862][ T9098] 8021q: adding VLAN 0 to HW filter on device team0 [ 254.277459][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 254.286566][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 254.297548][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 254.305845][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 254.341246][ T8944] device veth0_macvtap entered promiscuous mode [ 254.351571][ T8944] device veth1_macvtap entered promiscuous mode [ 254.363741][ T9266] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.373007][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 254.382445][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 254.390967][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 254.427089][ T9266] 8021q: adding VLAN 0 to HW filter on device team0 [ 254.436553][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 254.444830][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 254.453508][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 254.462074][ T5289] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.469172][ T5289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.477142][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 254.484798][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 254.492416][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 254.501175][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 254.509585][ T5289] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.516602][ T5289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.537277][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 254.571729][ T9142] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.581312][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 254.590859][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 254.601696][ T4957] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.608785][ T4957] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.616520][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 254.626224][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 254.635192][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 254.643531][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 254.682229][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 254.691081][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 254.699273][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 254.707746][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 254.716074][ T4957] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.723103][ T4957] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.731286][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 254.740391][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 254.749027][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 254.756688][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 254.769285][ T8944] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 254.783506][ T9442] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 254.861447][ T9142] 8021q: adding VLAN 0 to HW filter on device team0 [ 254.869759][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 254.879085][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 254.887534][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 254.896842][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 254.912516][ T9098] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 254.923493][ T9098] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 254.938360][ T8944] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 254.945786][ T9442] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 255.001100][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 255.009516][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 255.018762][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 255.027040][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 255.035483][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 255.044292][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 255.053212][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 255.061978][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 255.070907][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 255.079561][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 255.088028][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 255.096626][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 255.105893][ T9731] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.112938][ T9731] bridge0: port 1(bridge_slave_0) entered forwarding state [ 255.130818][ T9442] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 255.180325][ T9442] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 255.249186][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 255.256925][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 255.265888][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 255.274149][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 255.282723][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 255.291266][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 255.300292][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 255.309337][ T9731] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.316379][ T9731] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.324611][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 255.346266][ T9266] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 255.365268][ T9288] 8021q: adding VLAN 0 to HW filter on device bond0 [ 255.372652][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 255.380745][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 255.388973][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 255.397122][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 255.474180][ T9098] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 255.501396][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 255.511623][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 255.520440][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 255.544679][ T9288] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.600262][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 255.608776][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 255.617251][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 255.625221][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 255.632752][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 255.641356][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 255.649988][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 255.658347][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 255.666767][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 255.681883][ T9266] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 255.699427][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 255.710234][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 255.718381][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 255.727124][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 255.737503][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.744544][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 255.755294][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 255.830753][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 255.840793][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 255.849826][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 255.859177][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 255.867498][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.874561][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.889258][ T9142] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 255.904293][T10201] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 255.930899][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 255.942649][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 255.955694][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 255.964514][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready 16:46:31 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000045c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = open(&(0x7f00000003c0)='./file0\x00', 0xc007e, 0x0) write$binfmt_aout(r5, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r5, r5, &(0x7f00000001c0), 0x8080fffffffe) [ 255.976147][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 255.985602][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 255.996986][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 256.016068][ T9098] device veth0_vlan entered promiscuous mode [ 256.043482][ T9266] device veth0_vlan entered promiscuous mode [ 256.062255][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 256.075582][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 256.085273][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 256.097430][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 256.106982][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 256.132960][ T9442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.145834][ T9098] device veth1_vlan entered promiscuous mode [ 256.323280][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 256.336285][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 256.344941][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 256.354216][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 256.362289][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 256.383338][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 256.400892][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 256.423501][ T9098] device veth0_macvtap entered promiscuous mode [ 256.436860][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 256.450178][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 256.478331][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 256.486739][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 256.507708][ T9098] device veth1_macvtap entered promiscuous mode [ 256.519911][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 256.528739][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 256.536835][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 256.548088][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 256.560716][ T9442] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.570763][ T9266] device veth1_vlan entered promiscuous mode [ 256.580489][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 256.588066][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 256.595421][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 256.604068][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 256.619426][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 256.628915][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 256.637253][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.644404][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.672148][ T9288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 256.680489][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 256.688743][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 256.697345][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 256.706022][ T4143] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.713127][ T4143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.724724][ T9142] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 256.737592][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 256.760552][ T9098] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.771219][ T9098] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.783527][ T9098] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 256.795282][ T9098] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.806243][ T9098] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.817441][ T9098] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 256.826647][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 256.834529][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 256.841930][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 256.850791][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 256.859850][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 256.868529][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 16:46:32 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) [ 256.876985][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 256.886051][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 256.897223][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 256.910775][ T9266] device veth0_macvtap entered promiscuous mode [ 257.032774][ T9266] device veth1_macvtap entered promiscuous mode [ 257.044299][ T9288] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.058691][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 257.066810][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 257.085504][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 257.100846][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 257.112659][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 257.121824][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 257.133247][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 257.141869][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 257.152435][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 257.160973][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 257.170123][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 257.213850][ C0] hrtimer: interrupt took 36057 ns [ 257.228134][ T9442] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 257.236616][T10224] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 257.248795][T10224] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 257.269103][T10224] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 257.282638][T10224] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 257.290344][T10224] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 257.315341][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 257.325562][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 257.430516][ T9266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 257.450415][ T9266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 257.460692][ T9266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 257.471419][ T9266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 257.482765][ T9266] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 257.492224][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 257.502167][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 257.523891][ T9142] device veth0_vlan entered promiscuous mode [ 257.535343][ T9442] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.543822][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 257.552406][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 257.560058][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 257.574881][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 257.594216][ T9266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 257.613755][ T9266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 257.632833][ T9266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 257.643873][ T9266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 257.654967][ T9266] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 257.665651][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 257.673445][T10241] kvm: pic: non byte read [ 257.681493][T10241] kvm: pic: non byte read [ 257.689156][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 257.704034][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 257.713491][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 257.723908][ T9142] device veth1_vlan entered promiscuous mode [ 257.749833][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 257.761416][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 257.777770][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 257.786675][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready 16:46:33 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) [ 257.894230][ T9288] device veth0_vlan entered promiscuous mode [ 257.903681][T10224] debugfs: File 'dropped' in directory 'loop0' already present! [ 257.915544][T10224] debugfs: File 'msg' in directory 'loop0' already present! [ 257.923829][T10224] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:33 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) [ 257.941742][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 257.972367][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 258.012820][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 258.028462][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 258.037142][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 258.046170][ T4957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 258.058547][ T9142] device veth0_macvtap entered promiscuous mode [ 258.116376][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 258.129029][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 258.150151][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 258.169408][ T9288] device veth1_vlan entered promiscuous mode [ 258.183525][T10257] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 258.195078][T10258] debugfs: File 'dropped' in directory 'loop0' already present! [ 258.207500][T10257] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:33 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) [ 258.217493][T10258] debugfs: File 'msg' in directory 'loop0' already present! [ 258.225422][T10258] debugfs: File 'trace0' in directory 'loop0' already present! [ 258.243894][T10257] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 258.290170][T10257] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 258.327049][T10257] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62160555]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000780)={"54abec7338595f275a2292c45ff078f1cbbf04241d1c3421ec9bf61b2221bc18246e74f0001e36735c2ad340bf94ad2a35cfc5d0953a3b2bfd41e2e051c6765447395415a9b05dffbe957e300168dc46f8377130fd28e50a805a6005ab6167da65430e3fcc214d7893c6d91026b5f5192f346a367dbc8ae5df0fd099b4e7a6dadd7f555b203f504eda86e0e8d8c5f319604db5a686750d03bf3a67210063e9a17ca0a1ccd80a7d57cb034b828b784b14c9e5dd70ca358c6819c3df7f4443dced6d9a56bb54eac6538cc61c5e9ef3bda9feeb62cbe4f0e1d1c7f6cbbcada85dbb247b0551773f0734e6f4733db49c22e497557c2f74bfa0e4af9b6228643f180d9f9e1e2bcdf0c35a5b8c388e728b574a066e190800db7b42573f534b8f60e8f756dc4d8dec7ad58b0474fc002851b265cc72099d43115828ac723e73009150fcf7196b4133e2988d4b0fc459e57293afef8837fa0d5d24b984a95cb4bdc48fc9c6e73ebee6b1a3239b2c0eef7c751ccb9f2dcdc3c69173db48df6b5d6e59e6465283de675a8d053e7f3abf86f43006a5a0c6225a589c12583e767b9d817f17bf690444a18e6f8a35b2cb4b60c191efbb16393560b568ee6c82bed918aa4a34b575ac9966b395aafa7fc3b7f467b484eb7d2617e0a240e8acbc2a7e02b650f7d1be52f462be20faa32dd88eb041e2c46b24ed7ab79c10f05296f5461f4ebda25dd7b9908da4be62b0871b169016fab8aae31c7ba45e5b30b7556a062999f43d2dbb9995d2d5de72ffe885bf6bce45caa470933c0906807da75cd38533d8f16d875452c543b259e78215011d2be638eab023513cfe0693d3107e17cfc87e038fc7d1db232d15307fe1d2a818d0a4bde2c53d221111ffa646514dd1fbd3c011b058f79c6fb0a31857ea309018bf72180a434611195c975cf5e285777231b6f158ecaf212183600379fe9762277c13cb6cde9cc0178b883fd1f210180e599f8eb33d33a9ff0f70db1de485b2f2434f2707bf9a54bb6aff687c515c430d5087f4d53a57adf7c97a06dcc61d7733a93dc505d57d8d5c83bf83e345a979307d708756c3f0f1c53a28883b665fda239019f32fc6f07d700d05023e9ef5b66d4b6be57ffd6fe39703fd4eed61535568f47ee51eff8290618e8387d0ba0d00c5bc4585d2d85688af46bb1da08bf42901634cb10e6b03ee276c16980090b59f3c57b428ae0a7ede758c781e2a5a8585e903adde0a0a281a7779a59067d82985655d9138b75042970e11aee4b95b8bcf232473767cca0139b2c2fb40045c6e031950c314015db2524c3f2fe941f249d158a44aa14774e61b2ee185bdfea8f317e440a39533c6db7ffd3c2b626c1e1e088bcebc59526b016cc6a0e4b766c3f00f619d366e5a4378bc15f805a6fb8c9400"}) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, 0x0) [ 258.438632][ T9142] device veth1_macvtap entered promiscuous mode [ 258.468253][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 258.479657][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready 16:46:34 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) [ 258.510004][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 258.541720][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 258.580739][ T9442] device veth0_vlan entered promiscuous mode [ 258.598618][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 258.619663][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 258.638839][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 258.704349][ T9442] device veth1_vlan entered promiscuous mode [ 258.729493][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 258.742545][ T9731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 16:46:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62160555]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000780)={"54abec7338595f275a2292c45ff078f1cbbf04241d1c3421ec9bf61b2221bc18246e74f0001e36735c2ad340bf94ad2a35cfc5d0953a3b2bfd41e2e051c6765447395415a9b05dffbe957e300168dc46f8377130fd28e50a805a6005ab6167da65430e3fcc214d7893c6d91026b5f5192f346a367dbc8ae5df0fd099b4e7a6dadd7f555b203f504eda86e0e8d8c5f319604db5a686750d03bf3a67210063e9a17ca0a1ccd80a7d57cb034b828b784b14c9e5dd70ca358c6819c3df7f4443dced6d9a56bb54eac6538cc61c5e9ef3bda9feeb62cbe4f0e1d1c7f6cbbcada85dbb247b0551773f0734e6f4733db49c22e497557c2f74bfa0e4af9b6228643f180d9f9e1e2bcdf0c35a5b8c388e728b574a066e190800db7b42573f534b8f60e8f756dc4d8dec7ad58b0474fc002851b265cc72099d43115828ac723e73009150fcf7196b4133e2988d4b0fc459e57293afef8837fa0d5d24b984a95cb4bdc48fc9c6e73ebee6b1a3239b2c0eef7c751ccb9f2dcdc3c69173db48df6b5d6e59e6465283de675a8d053e7f3abf86f43006a5a0c6225a589c12583e767b9d817f17bf690444a18e6f8a35b2cb4b60c191efbb16393560b568ee6c82bed918aa4a34b575ac9966b395aafa7fc3b7f467b484eb7d2617e0a240e8acbc2a7e02b650f7d1be52f462be20faa32dd88eb041e2c46b24ed7ab79c10f05296f5461f4ebda25dd7b9908da4be62b0871b169016fab8aae31c7ba45e5b30b7556a062999f43d2dbb9995d2d5de72ffe885bf6bce45caa470933c0906807da75cd38533d8f16d875452c543b259e78215011d2be638eab023513cfe0693d3107e17cfc87e038fc7d1db232d15307fe1d2a818d0a4bde2c53d221111ffa646514dd1fbd3c011b058f79c6fb0a31857ea309018bf72180a434611195c975cf5e285777231b6f158ecaf212183600379fe9762277c13cb6cde9cc0178b883fd1f210180e599f8eb33d33a9ff0f70db1de485b2f2434f2707bf9a54bb6aff687c515c430d5087f4d53a57adf7c97a06dcc61d7733a93dc505d57d8d5c83bf83e345a979307d708756c3f0f1c53a28883b665fda239019f32fc6f07d700d05023e9ef5b66d4b6be57ffd6fe39703fd4eed61535568f47ee51eff8290618e8387d0ba0d00c5bc4585d2d85688af46bb1da08bf42901634cb10e6b03ee276c16980090b59f3c57b428ae0a7ede758c781e2a5a8585e903adde0a0a281a7779a59067d82985655d9138b75042970e11aee4b95b8bcf232473767cca0139b2c2fb40045c6e031950c314015db2524c3f2fe941f249d158a44aa14774e61b2ee185bdfea8f317e440a39533c6db7ffd3c2b626c1e1e088bcebc59526b016cc6a0e4b766c3f00f619d366e5a4378bc15f805a6fb8c9400"}) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, 0x0) [ 258.761553][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 258.785341][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 258.827350][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 258.838219][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 258.870367][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 258.889649][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 258.918817][ T9142] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 258.927011][ T9288] device veth0_macvtap entered promiscuous mode [ 258.958536][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 258.966729][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 258.998608][ T5289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 259.012259][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.024673][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.037077][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.051338][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.061383][ T9142] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.074376][ T9142] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.086260][ T9142] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 259.098647][ T9288] device veth1_macvtap entered promiscuous mode [ 259.143121][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 259.152516][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 259.162156][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 259.171888][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 259.180980][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 259.200730][ T9442] device veth0_macvtap entered promiscuous mode [ 259.229151][ T9442] device veth1_macvtap entered promiscuous mode [ 259.261695][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.273327][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.300153][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.327255][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.337070][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.350285][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.361350][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.372256][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.391445][ T9288] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 259.402769][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.413711][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.424084][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.434896][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.445575][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.456059][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.466786][ T9288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.477231][ T9288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.488319][ T9288] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 259.570281][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 259.578446][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 259.586529][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 259.595288][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 259.604706][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 259.613459][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 259.701087][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.714141][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.724968][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.738067][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.749694][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.764667][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.780641][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.794097][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.820447][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 259.820453][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.828977][ T9442] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 259.879080][T10199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 259.894235][T10199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 259.908260][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.929289][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.942437][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.953212][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.965770][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 259.976544][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.989139][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 260.017205][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 16:46:35 executing program 2: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x1f, 0x0, {r2}, {}, 0x4, 0x800}) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = getpid() sched_setattr(r5, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0xb0, r1, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000880}, 0x4040000) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@dev}, &(0x7f0000000380)=0x14) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffffffffffe3a, 0x1}], 0x100488, 0x0) 16:46:35 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) [ 260.027824][ T9442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 260.038659][ T9442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 260.050180][ T9442] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 260.111149][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 260.128041][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 16:46:36 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:46:36 executing program 5: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x1f, 0x0, {r2}, {}, 0x4, 0x800}) getpid() r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0xb0, r1, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000880}, 0x4040000) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@dev}, &(0x7f0000000380)=0x14) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffffffffffe3a, 0x1}], 0x100488, 0x0) 16:46:36 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) 16:46:36 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) 16:46:36 executing program 2: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x1f, 0x0, {r2}, {}, 0x4, 0x800}) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = getpid() sched_setattr(r5, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0xb0, r1, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000880}, 0x4040000) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@dev}, &(0x7f0000000380)=0x14) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffffffffffe3a, 0x1}], 0x100488, 0x0) 16:46:36 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 260.566321][T10344] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 260.582288][T10344] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 260.619953][T10352] debugfs: File 'dropped' in directory 'loop0' already present! [ 260.658290][T10352] debugfs: File 'msg' in directory 'loop0' already present! [ 260.689095][T10352] debugfs: File 'trace0' in directory 'loop0' already present! [ 260.726862][T10354] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:36 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 260.744538][T10354] debugfs: File 'msg' in directory 'loop0' already present! 16:46:36 executing program 5: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x1f, 0x0, {r2}, {}, 0x4, 0x800}) getpid() r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0xb0, r1, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000880}, 0x4040000) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@dev}, &(0x7f0000000380)=0x14) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffffffffffe3a, 0x1}], 0x100488, 0x0) 16:46:36 executing program 2: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x1f, 0x0, {r2}, {}, 0x4, 0x800}) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = getpid() sched_setattr(r5, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0xb0, r1, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000880}, 0x4040000) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x375, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000340)={@dev}, &(0x7f0000000380)=0x14) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffffffffffe3a, 0x1}], 0x100488, 0x0) [ 260.814110][T10344] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 260.833541][T10354] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:36 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) [ 260.970128][T10344] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 260.995020][T10344] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:36 executing program 5: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@loopback, 0x0, 0x0, 0x2, 0x1}, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket$inet6(0xa, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local}, 0x20) 16:46:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ptrace$cont(0x20, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 16:46:37 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) [ 261.330777][T10346] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 261.350831][T10346] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 261.402435][T10346] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 261.416539][T10346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 261.425373][T10346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 261.503798][T10388] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 261.513409][T10390] debugfs: File 'dropped' in directory 'loop0' already present! [ 261.526754][T10388] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 261.541938][T10390] debugfs: File 'msg' in directory 'loop0' already present! 16:46:37 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) 16:46:37 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) [ 261.571382][T10390] debugfs: File 'trace0' in directory 'loop0' already present! [ 261.662622][T10388] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 261.694857][T10397] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:37 executing program 4: socket$inet(0x2, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040)='NLBL_UNLBL\x00') write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x80000013}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) [ 261.718866][T10388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 261.726462][T10397] debugfs: File 'msg' in directory 'loop0' already present! [ 261.736164][T10388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 261.746159][T10397] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:37 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) 16:46:37 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) [ 262.103993][T10394] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 262.121994][T10394] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 16:46:37 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) [ 262.211888][T10394] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:37 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) [ 262.291316][T10394] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 262.330138][T10394] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 262.409150][T10422] debugfs: File 'dropped' in directory 'loop0' already present! [ 262.462459][T10422] debugfs: File 'msg' in directory 'loop0' already present! [ 262.488955][T10422] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:38 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) [ 262.510162][T10420] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 262.524597][T10420] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:38 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r3, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r3, 0x0, 0x8084) [ 262.651387][T10420] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:38 executing program 4: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f00000001c0)='systemem0md5sum$\x00 \x92\xc1\xf9\x82%\xa1\xaf\b\x86\x85;\x91\xeb2~\x83\'\xfd\x84\x02\x18\xa3S\xc9\xdd\xb5c\n\xdfKe\xa8\xeb\x95\x00\xa4\xe6\xf6\'>\xed\xfaK\x8d\x8e`\xbb\xabB\x85\xba-1o\xc5Q\xb1l\x01\x87\xc0I\xfd\xa7\x14\xcf\xe0\xfa\x86\xe5\xa7\x1a\xa0 \xdc=\xecp\xf5<\xd5\xc7x2u\xeb\xf2n\x13\x97H\xfa!:+\xbc\x14\x91\xdd\x17\xe8h\xe3\x9d\x9f\x18\x11Y\x80\n*\xfe\xab\xfe\xd8u\xd1\f\xdb\x93\x1f\xf6y\x04\xd3\xc5\x9a\x03Y?B\x14\xb6:\x00\x99\x01\x11\x8b\x7f\x12\x19\'\x04>\xa4\xcd\xb0\xb8\xb2\x01\xf6\xb2Z\xae*p\x91v\xca:\xd4t\xd0\xf1\xdc+\x1c\xf2\xe8\x0e\xae\xa8\x8d\xd6u\xe6\')\xab\xf4\xb5?@P\xf0\xd8gh\xdf\xc7\xda\xfd\xa0!.\xed', 0x0) r1 = memfd_create(&(0x7f0000000140)='$.6/%cpuset]\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="7f454c46020000000000000000c4b40003003e000039a594209c1fd83d0000000000000000000000dfeb7bba00280593bd5d74dafc20380003"], 0x3c) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup(r1) write$P9_RGETATTR(r4, &(0x7f0000000400)={0xa0, 0x19, 0x0, {0x344, {}, 0xc3}}, 0xa0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0x0, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') [ 262.706505][T10420] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 262.733878][T10420] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 262.774288][T10433] debugfs: File 'dropped' in directory 'loop0' already present! [ 262.813054][T10433] debugfs: File 'msg' in directory 'loop0' already present! [ 262.825130][T10434] ERROR: Domain ' /sbin/init /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.4 proc:/self/fd/4' not defined. [ 262.856517][T10433] debugfs: File 'trace0' in directory 'loop0' already present! [ 263.059000][T10430] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 263.068630][T10430] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 263.168659][T10430] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 263.249778][T10430] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 263.270235][T10430] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:39 executing program 4: setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000080)={{0x0, @dev, 0x0, 0x0, 'lc\x00', 0x0, 0x1}, {@empty, 0x2}}, 0x44) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270fff8", 0x268}], 0x0, 0x0) 16:46:39 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000001280)=""/4096, 0x1000}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw6\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) 16:46:39 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) 16:46:39 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) 16:46:39 executing program 3: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) 16:46:39 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 264.310436][T10456] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 264.345831][T10457] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 512) [ 264.345952][T10456] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:40 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000001280)=""/4096, 0x1000}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw6\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) [ 264.384168][T10463] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:40 executing program 4: r0 = getpid() prctl$PR_SET_PTRACER(0x59616d61, r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002001100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x1c, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x80000000002c00) [ 264.430363][T10463] debugfs: File 'msg' in directory 'loop0' already present! [ 264.437895][T10463] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) read(r0, &(0x7f0000000200)=""/231, 0x1000006ce) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') dup2(r2, r1) 16:46:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup(0xffffffffffffffff) syz_open_procfs(0x0, 0x0) fchdir(0xffffffffffffffff) rt_sigaction(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, 0x0) [ 264.627131][T10456] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 264.683726][T10456] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 264.697050][T10456] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:40 executing program 2: mknod(0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7a1ad0d9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0xfffffffffffffe27) connect$inet(0xffffffffffffffff, 0x0, 0x5b) mprotect(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x750, {}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xc}}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xd}}, 0x46, 0x0, 0x2, 0x46a}) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000280)={0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f0000000140)=""/11) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x100000000000000) 16:46:40 executing program 4: 16:46:40 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0) pread64(r0, 0x0, 0x0, 0x0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$MON_IOCX_MFETCH(r0, 0x40189206, &(0x7f00000001c0)={0x0}) 16:46:40 executing program 2: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f0000000000)="eb3c906d6b66731f66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsuid(r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) 16:46:40 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:40 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) 16:46:40 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:40 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 16:46:40 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000280)='/dev/loop#\x00', 0x0, 0x100082) r1 = memfd_create(&(0x7f0000000380)='\x06\x00\x00\x00\x00\x00\x00\x00u\x86e\x00\x00\t\x00\xa9\x03\x00\x00', 0x0) pwritev(r1, &(0x7f0000002680)=[{&(0x7f00000000c0)="bf", 0x1}], 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r1, 0x0, 0x20000102000003) 16:46:40 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 265.345794][T10512] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 265.384648][T10512] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 265.401690][T10515] debugfs: File 'dropped' in directory 'loop0' already present! [ 265.426566][T10515] debugfs: File 'msg' in directory 'loop0' already present! [ 265.443235][T10512] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 265.455353][T10515] debugfs: File 'trace0' in directory 'loop0' already present! [ 265.475380][T10512] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 265.479337][T10517] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:41 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 265.501907][T10517] debugfs: File 'msg' in directory 'loop0' already present! [ 265.511754][T10517] debugfs: File 'trace0' in directory 'loop0' already present! [ 265.522456][T10512] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 265.556824][T10515] relay: one or more items not logged [item size (56) > sub-buffer size (9)] 16:46:41 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:41 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) [ 265.629499][T10514] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 265.646601][T10514] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 265.742759][T10514] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 265.803566][T10514] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 265.814418][T10514] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 265.827869][T10536] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:41 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:41 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) [ 265.854123][T10536] debugfs: File 'msg' in directory 'loop0' already present! [ 265.882461][T10536] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:41 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:41 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) [ 266.105653][T10547] debugfs: File 'dropped' in directory 'loop0' already present! [ 266.173214][T10534] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 266.178745][T10547] debugfs: File 'msg' in directory 'loop0' already present! [ 266.187440][T10534] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 16:46:41 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 16:46:41 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) [ 266.214509][T10547] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:41 executing program 1: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 266.272283][T10534] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 266.288966][T10534] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 266.302826][T10534] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 266.350747][T10561] debugfs: File 'dropped' in directory 'loop0' already present! [ 266.391210][T10561] debugfs: File 'msg' in directory 'loop0' already present! [ 266.414234][T10546] netlink: 'syz-executor.3': attribute type 27 has an invalid length. [ 266.426132][T10561] debugfs: File 'trace0' in directory 'loop0' already present! [ 266.444200][T10546] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 266.459538][T10567] debugfs: File 'dropped' in directory 'loop0' already present! [ 266.467449][T10567] debugfs: File 'msg' in directory 'loop0' already present! [ 266.475779][T10567] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:42 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) [ 266.497395][T10546] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 266.514672][T10546] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 266.523697][T10546] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 266.560135][T10558] netlink: 'syz-executor.2': attribute type 27 has an invalid length. [ 266.569843][T10558] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 16:46:42 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 266.651216][T10558] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 266.665773][T10574] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) [ 266.694816][T10558] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 266.703246][T10574] debugfs: File 'msg' in directory 'loop0' already present! [ 266.722882][T10558] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 266.732615][T10574] debugfs: File 'trace0' in directory 'loop0' already present! [ 266.789689][T10564] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 266.832103][T10564] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 266.864036][T10581] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:42 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 266.889578][T10581] debugfs: File 'msg' in directory 'loop0' already present! [ 266.914768][T10581] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:42 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) [ 266.954265][T10582] debugfs: File 'dropped' in directory 'loop0' already present! [ 266.955774][T10564] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 266.977303][T10582] debugfs: File 'msg' in directory 'loop0' already present! [ 266.996101][T10582] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:42 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 267.057622][T10564] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 267.090701][T10564] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:42 executing program 3: 16:46:42 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 267.188459][T10590] debugfs: File 'dropped' in directory 'loop0' already present! [ 267.210149][T10590] debugfs: File 'msg' in directory 'loop0' already present! 16:46:42 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 267.239492][T10571] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 267.248356][T10590] debugfs: File 'trace0' in directory 'loop0' already present! [ 267.255475][T10571] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 16:46:42 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) 16:46:42 executing program 3: [ 267.313739][T10571] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.334029][T10571] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 267.351577][T10571] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:43 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 267.468180][T10588] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.499679][T10588] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 267.509658][T10606] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:43 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 16:46:43 executing program 3: 16:46:43 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 267.526064][T10588] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 267.537894][T10606] debugfs: File 'msg' in directory 'loop0' already present! [ 267.583881][T10606] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:43 executing program 1: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 267.674163][T10603] validate_nla: 1 callbacks suppressed [ 267.674190][T10603] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 267.729681][T10603] __nla_validate_parse: 1 callbacks suppressed [ 267.729709][T10603] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 267.776017][T10616] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:43 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000)=0x2, 0x80, 0x40080000, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9}) pipe(0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 16:46:43 executing program 3: 16:46:43 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) [ 267.843994][T10616] debugfs: File 'msg' in directory 'loop0' already present! [ 267.865832][T10603] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:43 executing program 1: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 267.892200][T10616] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:43 executing program 3: [ 267.980274][T10603] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.001459][T10603] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.092061][T10635] debugfs: File 'dropped' in directory 'loop0' already present! [ 268.119847][T10635] debugfs: File 'msg' in directory 'loop0' already present! [ 268.150361][T10635] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:43 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) 16:46:43 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) 16:46:43 executing program 1: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 268.214102][T10615] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 268.228000][T10615] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 268.257006][T10615] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.273298][T10615] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.327623][T10615] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.379640][T10645] debugfs: File 'dropped' in directory 'loop0' already present! [ 268.404779][T10630] netlink: 'syz-executor.2': attribute type 27 has an invalid length. [ 268.424046][T10630] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 268.444885][T10645] debugfs: File 'msg' in directory 'loop0' already present! [ 268.455284][T10645] debugfs: File 'trace0' in directory 'loop0' already present! [ 268.462888][T10630] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:44 executing program 4: 16:46:44 executing program 3: 16:46:44 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:44 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flistxattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r1, 0x0) [ 268.507965][T10630] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.515413][T10630] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.650070][T10642] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 268.676500][T10642] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:44 executing program 2: 16:46:44 executing program 4: 16:46:44 executing program 3: 16:46:44 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:44 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000000000}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 268.820128][T10642] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.910291][T10642] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.929236][T10642] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:44 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:44 executing program 4: 16:46:44 executing program 3: 16:46:44 executing program 2: 16:46:44 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:44 executing program 5: write$tun(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:44 executing program 4: [ 269.332143][T10679] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 269.341323][T10679] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:45 executing program 3: 16:46:45 executing program 2: [ 269.390318][T10682] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:45 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 269.455047][T10682] debugfs: File 'msg' in directory 'loop0' already present! [ 269.465701][T10679] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 269.488746][T10682] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:45 executing program 4: 16:46:45 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 269.573216][T10679] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 269.590116][T10679] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:45 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:45 executing program 3: 16:46:45 executing program 2: 16:46:45 executing program 4: 16:46:45 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:45 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:45 executing program 3: [ 270.271927][T10710] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 270.281151][T10710] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:45 executing program 4: 16:46:45 executing program 2: [ 270.327607][T10713] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:46 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 270.381881][T10713] debugfs: File 'msg' in directory 'loop0' already present! 16:46:46 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:46 executing program 3: [ 270.444660][T10713] debugfs: File 'trace0' in directory 'loop0' already present! [ 270.465701][T10710] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 270.562598][T10710] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 270.587902][T10710] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:46 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:46 executing program 4: 16:46:46 executing program 2: 16:46:46 executing program 3: 16:46:46 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:46 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:46 executing program 2: [ 271.248323][T10743] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 271.257290][T10743] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:46 executing program 3: 16:46:46 executing program 4: [ 271.305176][T10746] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:47 executing program 5: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 271.359856][T10746] debugfs: File 'msg' in directory 'loop0' already present! [ 271.385283][T10743] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:47 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 271.411092][T10746] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:47 executing program 4: [ 271.487646][T10743] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 271.509172][T10743] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:47 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:47 executing program 2: 16:46:47 executing program 3: 16:46:47 executing program 4: 16:46:47 executing program 5: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:47 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:47 executing program 2: 16:46:47 executing program 3: [ 272.218198][T10777] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 272.237067][T10777] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:47 executing program 4: [ 272.279664][T10781] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:47 executing program 5: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 272.322701][T10781] debugfs: File 'msg' in directory 'loop0' already present! 16:46:48 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:48 executing program 2: [ 272.365758][T10777] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 272.384036][T10781] debugfs: File 'trace0' in directory 'loop0' already present! [ 272.452151][T10777] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 272.484266][T10777] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:48 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:48 executing program 3: 16:46:48 executing program 4: 16:46:48 executing program 2: 16:46:48 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:48 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:48 executing program 3: 16:46:48 executing program 4: [ 272.947569][T10813] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 272.970490][T10813] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:48 executing program 2: 16:46:48 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 273.023092][T10816] debugfs: File 'dropped' in directory 'loop0' already present! [ 273.091880][T10813] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 273.100560][T10816] debugfs: File 'msg' in directory 'loop0' already present! 16:46:48 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 273.133848][T10816] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:48 executing program 3: [ 273.223032][T10813] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 273.262369][T10813] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:49 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:49 executing program 2: 16:46:49 executing program 4: 16:46:49 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:49 executing program 3: 16:46:49 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:49 executing program 3: 16:46:49 executing program 4: 16:46:49 executing program 2: 16:46:49 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 273.753811][T10844] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 273.775416][T10844] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:49 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 273.806893][T10846] debugfs: File 'dropped' in directory 'loop0' already present! [ 273.863108][T10846] debugfs: File 'msg' in directory 'loop0' already present! 16:46:49 executing program 3: [ 273.910671][T10846] debugfs: File 'trace0' in directory 'loop0' already present! [ 273.930311][T10844] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 274.004919][T10844] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 274.014891][T10844] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:50 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:50 executing program 4: 16:46:50 executing program 2: 16:46:50 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 16:46:50 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:50 executing program 3: 16:46:50 executing program 3: 16:46:50 executing program 2: 16:46:50 executing program 4: [ 274.519412][T10869] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 274.531115][T10869] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:50 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 274.576303][T10871] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:50 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 274.621073][T10871] debugfs: File 'msg' in directory 'loop0' already present! [ 274.657435][T10871] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:50 executing program 4: [ 274.679685][T10869] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 274.781858][T10869] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 274.820636][T10869] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:50 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:50 executing program 2: 16:46:50 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:50 executing program 3: 16:46:50 executing program 4: 16:46:50 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:50 executing program 3: [ 275.373122][T10899] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 275.384413][T10899] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:51 executing program 2: 16:46:51 executing program 4: 16:46:51 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 275.430851][T10900] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:51 executing program 3: [ 275.510926][T10900] debugfs: File 'msg' in directory 'loop0' already present! [ 275.538493][T10899] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:51 executing program 4: [ 275.558650][T10900] debugfs: File 'trace0' in directory 'loop0' already present! [ 275.640443][T10899] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 275.676341][T10899] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:51 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:51 executing program 2: 16:46:51 executing program 3: [ 276.116415][T10921] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 276.133461][T10921] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 276.181230][T10922] debugfs: File 'dropped' in directory 'loop0' already present! [ 276.199072][T10922] debugfs: File 'msg' in directory 'loop0' already present! [ 276.208426][T10922] debugfs: File 'trace0' in directory 'loop0' already present! 16:46:51 executing program 4: 16:46:51 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:51 executing program 2: 16:46:51 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) [ 276.230118][T10921] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:51 executing program 3: 16:46:51 executing program 4: [ 276.308783][T10921] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 276.337760][T10921] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:52 executing program 2: 16:46:52 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:52 executing program 2: 16:46:52 executing program 3: 16:46:52 executing program 4: 16:46:52 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:52 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:52 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:52 executing program 2: 16:46:52 executing program 3: 16:46:52 executing program 4: 16:46:52 executing program 3: 16:46:52 executing program 2: [ 277.211689][T10957] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 277.224821][T10957] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:52 executing program 4: 16:46:52 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) [ 277.257400][T10961] debugfs: File 'dropped' in directory 'loop0' already present! [ 277.284727][T10961] debugfs: File 'msg' in directory 'loop0' already present! 16:46:53 executing program 2: [ 277.337464][T10961] debugfs: File 'trace0' in directory 'loop0' already present! [ 277.362375][T10957] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:53 executing program 3: [ 277.452621][T10957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 277.472779][T10957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:53 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:53 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) 16:46:53 executing program 4: 16:46:53 executing program 2: 16:46:53 executing program 3: 16:46:53 executing program 1: 16:46:53 executing program 2: 16:46:53 executing program 3: 16:46:53 executing program 4: 16:46:53 executing program 1: [ 278.151669][T10986] netlink: 'syz-executor.0': attribute type 27 has an invalid length. 16:46:53 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) [ 278.200397][T10986] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 278.210564][T10989] debugfs: File 'dropped' in directory 'loop0' already present! 16:46:53 executing program 2: [ 278.246337][T10989] debugfs: File 'msg' in directory 'loop0' already present! [ 278.277926][T10989] debugfs: File 'trace0' in directory 'loop0' already present! [ 278.363257][T10986] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 278.458231][T10986] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 278.477165][T10986] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:54 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:54 executing program 3: 16:46:54 executing program 1: 16:46:54 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 16:46:54 executing program 4: 16:46:54 executing program 2: 16:46:54 executing program 4: 16:46:54 executing program 2: 16:46:54 executing program 3: 16:46:54 executing program 1: 16:46:54 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 16:46:54 executing program 4: [ 279.174342][T11011] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 279.191402][T11011] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 279.222599][T11013] debugfs: File 'dropped' in directory 'loop0' already present! [ 279.238762][T11013] debugfs: File 'msg' in directory 'loop0' already present! [ 279.273869][T11013] debugfs: File 'trace0' in directory 'loop0' already present! [ 279.279317][T11011] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 279.339188][T11011] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 279.349366][T11011] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:55 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:55 executing program 1: 16:46:55 executing program 3: 16:46:55 executing program 4: 16:46:55 executing program 2: 16:46:55 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:55 executing program 2: 16:46:55 executing program 3: 16:46:55 executing program 4: 16:46:55 executing program 1: [ 280.054107][T11042] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 280.079441][T11042] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:55 executing program 2: 16:46:55 executing program 1: [ 280.211610][T11042] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 280.330861][T11042] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 280.357439][T11042] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:56 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:56 executing program 3: 16:46:56 executing program 4: 16:46:56 executing program 2: 16:46:56 executing program 1: 16:46:56 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:56 executing program 3: 16:46:56 executing program 1: 16:46:56 executing program 2: 16:46:56 executing program 4: [ 280.978955][T11072] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 280.999834][T11072] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 281.077702][T11072] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:56 executing program 3: [ 281.124375][T11072] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 281.148307][T11072] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:56 executing program 1: 16:46:57 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000200)) 16:46:57 executing program 2: 16:46:57 executing program 4: 16:46:57 executing program 1: 16:46:57 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0) getpid() ioctl$MON_IOCX_MFETCH(r0, 0x40189206, &(0x7f00000001c0)={0x0}) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:46:57 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 16:46:57 executing program 4: 16:46:57 executing program 2: 16:46:57 executing program 1: [ 281.957867][T11104] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 281.992301][T11104] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:57 executing program 1: [ 282.100025][T11104] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:46:57 executing program 2: 16:46:57 executing program 4: prlimit64(0x0, 0x0, &(0x7f00000001c0)={0x9}, 0x0) getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000340)='\v\xb3\xd1\xa9\x9fca\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9bF\x9f\xf1c', 0x3) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[], 0x5) sendfile(r0, r1, &(0x7f00000000c0), 0xfffb) pipe(&(0x7f0000000340)) write(0xffffffffffffffff, 0x0, 0x0) fcntl$addseals(r1, 0x409, 0xb) fremovexattr(r1, &(0x7f0000000100)=@known='trusted.overlay.origin\x00') [ 282.154987][T11104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 282.167952][T11104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:46:58 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000200)) 16:46:58 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:46:58 executing program 2: 16:46:58 executing program 4: prlimit64(0x0, 0x0, &(0x7f00000001c0)={0x9}, 0x0) getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000340)='\v\xb3\xd1\xa9\x9fca\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9bF\x9f\xf1c', 0x3) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[], 0x5) sendfile(r0, r1, &(0x7f00000000c0), 0xfffb) pipe(&(0x7f0000000340)) write(0xffffffffffffffff, 0x0, 0x0) fcntl$addseals(r1, 0x409, 0xb) fremovexattr(r1, &(0x7f0000000100)=@known='trusted.overlay.origin\x00') 16:46:58 executing program 3: 16:46:58 executing program 5: 16:46:58 executing program 5: 16:46:58 executing program 2: 16:46:58 executing program 3: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x100000001, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x0) [ 282.947140][T11135] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 282.961149][T11135] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:46:58 executing program 5: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='lowerdir=./file0,xino=off,xino=auto,index=on,index=on,workdir=./file0,metacopy=off,seclabel,obj_role=.mime_type]$\x00,pcr=00000000000000000021,fowner<', @ANYRESDEC=0x0, @ANYBLOB=',obj_user=.mime_type]$\x00,obj_role=^,fowne', @ANYRESDEC=0x0, @ANYBLOB=',fowner=', @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:46:58 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000400)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x12, r1, 0x0) r2 = eventfd(0x400) read(r2, &(0x7f0000000040)=""/28, 0x9f34a44e) 16:46:58 executing program 4: prlimit64(0x0, 0x0, &(0x7f00000001c0)={0x9}, 0x0) getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000340)='\v\xb3\xd1\xa9\x9fca\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9bF\x9f\xf1c', 0x3) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[], 0x5) sendfile(r0, r1, &(0x7f00000000c0), 0xfffb) pipe(&(0x7f0000000340)) write(0xffffffffffffffff, 0x0, 0x0) fcntl$addseals(r1, 0x409, 0xb) fremovexattr(r1, &(0x7f0000000100)=@known='trusted.overlay.origin\x00') [ 283.098753][T11135] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 283.179899][ T4143] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 283.202269][T11135] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 283.212470][T11135] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 283.263489][ T27] audit: type=1804 audit(1588956418.865:2): pid=11150 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/54/bus" dev="sda1" ino=15889 res=1 [ 283.296375][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 283.385559][ T27] audit: type=1804 audit(1588956418.985:3): pid=11154 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/54/bus" dev="sda1" ino=15889 res=1 [ 283.425182][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 283.456159][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 283.510438][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 283.583649][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 283.636712][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 283.648539][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.658912][ T4143] usb 2-1: config 0 descriptor?? [ 283.699122][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 283.708790][ T4143] scsi host1: usb-storage 2-1:0.0 16:46:59 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000200)) [ 283.803415][T11179] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 283.815651][T11179] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 283.886768][T11179] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 283.927172][T11179] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 283.937416][T11179] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 284.716271][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 284.726209][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 284.738475][ T256] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 284.748312][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 284.986578][ T4143] usb 2-1: USB disconnect, device number 2 [ 285.003597][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 285.042463][ T8892] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 285.774962][T10199] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 285.875556][T10199] usb 2-1: Using ep0 maxpacket: 16 [ 286.005259][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 286.015144][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 286.024818][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 286.036227][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 286.046659][T10199] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 286.056087][T10199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.070876][T10199] usb 2-1: config 0 descriptor?? [ 286.117940][T10199] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 286.132031][T10199] scsi host1: usb-storage 2-1:0.0 16:47:01 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x6, 0x0) 16:47:01 executing program 3: open(0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f00000000c0)={0x14, 0x17, 0x101, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, 0x0}, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) 16:47:01 executing program 5: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='lowerdir=./file0,xino=off,xino=auto,index=on,index=on,workdir=./file0,metacopy=off,seclabel,obj_role=.mime_type]$\x00,pcr=00000000000000000021,fowner<', @ANYRESDEC=0x0, @ANYBLOB=',obj_user=.mime_type]$\x00,obj_role=^,fowne', @ANYRESDEC=0x0, @ANYBLOB=',fowner=', @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:47:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000001280)=""/4096, 0x1000}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/nf_conntrack\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) [ 286.317306][ T4143] usb 2-1: USB disconnect, device number 3 16:47:01 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000200)) 16:47:02 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x84) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440), 0xfffffc41) perf_event_open(0x0, 0x0, 0x10, r0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0x3c) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000000)="0201a6ffffff0a000000ff45ac00000000006300e931190000000000000680ffffffa5000000e100e2ff87770072003007", 0x31}]) [ 286.469101][T11278] netlink: 'syz-executor.0': attribute type 27 has an invalid length. [ 286.483320][T11278] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:47:02 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) [ 286.606013][T11278] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:47:02 executing program 5: r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r0, &(0x7f0000000080)="0600", 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000340)=ANY=[], 0x2c) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000180)={{0x77359400}}, 0x0) [ 286.710183][T11278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 286.733015][T11278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 286.864361][ T4143] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 287.005249][ T4143] usb 2-1: Using ep0 maxpacket: 16 16:47:02 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x68001) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000000)={0x23, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:47:02 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:47:02 executing program 2: vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x2) r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000180)={0xfffffffef38, 0xc8}) [ 287.135897][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 287.167357][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 16:47:02 executing program 5: open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',ro,0']) [ 287.214840][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 287.234860][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 16:47:02 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) [ 287.274812][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 287.283877][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.375710][ T4143] usb 2-1: config 0 descriptor?? [ 287.416483][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 287.465664][ T4143] scsi host1: usb-storage 2-1:0.0 16:47:03 executing program 2: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000340)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) 16:47:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, "0316abdbb0d958d9a465645f447e9c0eee6f49"}) 16:47:03 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) [ 288.487904][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 288.497983][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 288.516797][ T29] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 288.552223][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 288.768538][T10199] usb 2-1: USB disconnect, device number 4 [ 288.788818][ T8892] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 288.847502][ T21] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:04 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:04 executing program 2: open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x807a}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[], [], 0x6c}}) 16:47:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x4000000000003bb, 0x0, 0x0) shutdown(r0, 0x0) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) 16:47:04 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) socket(0x10, 0x3, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:04 executing program 3: syz_emit_ethernet(0xa2, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd60"], 0x0) 16:47:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0xfffffe54) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) msync(&(0x7f0000839000/0x4000)=nil, 0x4000, 0x6) [ 289.338151][T11409] fuse: Bad value for 'group_id' 16:47:05 executing program 2: timer_create(0x0, &(0x7f0000000200)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_pts(r1, 0x2) dup3(r4, r1, 0x0) write(r1, &(0x7f0000c34fff), 0xffffff0b) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) tkill(r0, 0x1000000000016) 16:47:05 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='lowerdir=./file0,xino=off,xino=auto,index=on,index=on,workdir=./file0,metacopy=off,seclabel,obj_role=.mime_type]$\x00,pcr=00000000000000000021,fowner<', @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB=',fowner=', @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:47:05 executing program 5: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0x0, 0x7fff}, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x202000, 0x0) r0 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000280)='>', 0x1, 0xffffffffffffffff) request_key(&(0x7f0000001280)='asymmetric\x00', &(0x7f00000012c0)={'syz', 0x3}, &(0x7f0000001300)='GPL\x00', r0) keyctl$set_timeout(0xf, 0x0, 0x80000000) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 16:47:05 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='lowerdir=./file0,xino=off,xino=auto,index=on,index=on,workdir=./file0,metacopy=off,seclabel,obj_role=.mime_type]$\x00,pcr=00000000000000000021,fowner<', @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB=',fowner=', @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:47:05 executing program 4: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x0) [ 289.654636][T10199] usb 2-1: new high-speed USB device number 5 using dummy_hcd 16:47:05 executing program 4: open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESDEC]) [ 289.765075][T10199] usb 2-1: Using ep0 maxpacket: 16 [ 289.806430][T11446] fuse: Bad value for 'fd' [ 289.894907][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 289.909214][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 289.929989][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 289.946286][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 289.956499][T10199] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 289.966125][T10199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.976128][T10199] usb 2-1: config 0 descriptor?? [ 290.016002][T10199] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 290.023559][T10199] scsi host1: usb-storage 2-1:0.0 [ 291.035363][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 291.045406][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 291.058701][ T256] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 291.072499][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 291.296318][ T4143] usb 2-1: USB disconnect, device number 5 [ 291.316425][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 291.357611][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:07 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0xe, &(0x7f000002eff0)={0x0, 0x0}, 0x10) 16:47:07 executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5015, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022ff"], 0x0}, 0x0) 16:47:07 executing program 4: mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000206d041cc304000000000109022400010000a00009040000010301010009210000000122050009058103"], 0x0) 16:47:07 executing program 5: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0x0, 0x7fff}, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x202000, 0x0) r0 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000280)='>', 0x1, 0xffffffffffffffff) request_key(&(0x7f0000001280)='asymmetric\x00', &(0x7f00000012c0)={'syz', 0x3}, &(0x7f0000001300)='GPL\x00', r0) keyctl$set_timeout(0xf, 0x0, 0x80000000) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 16:47:07 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) [ 291.891027][T11535] sock: process `syz-executor.2' is using obsolete setsockopt SO_BSDCOMPAT [ 291.916748][T11528] debugfs: File 'dropped' in directory 'loop0' already present! [ 291.975040][T11528] debugfs: File 'msg' in directory 'loop0' already present! 16:47:07 executing program 2: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0x0, 0x7fff}, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x202000, 0x0) r0 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000280)='>', 0x1, 0xffffffffffffffff) request_key(&(0x7f0000001280)='asymmetric\x00', &(0x7f00000012c0)={'syz', 0x3}, &(0x7f0000001300)='GPL\x00', r0) keyctl$set_timeout(0xf, 0x0, 0x80000000) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 16:47:07 executing program 5: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xffff7ffffffff57a, 0x1, &(0x7f0000000380)=[{&(0x7f0000000040)="eb3c90040066732e66617400080401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x14907e, 0x0) write$P9_RREADDIR(r1, &(0x7f0000000100)=ANY=[], 0xb) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf32(r1, &(0x7f0000000bc0)=ANY=[], 0x801) [ 292.033785][T11528] debugfs: File 'trace0' in directory 'loop0' already present! 16:47:07 executing program 2: close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, 0x0, 0x0, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='lowerdir=./file0,xino=off,xino=auto,index=on,index=on,workdir=./file0,metacopy=off,seclabel,obj_role=.mime_type]$\x00,pcr=00000000000000000021,fowner<', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',fow', @ANYRESDEC, @ANYBLOB]) [ 292.154484][ T4143] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 292.167190][ T5289] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 292.169011][ T27] audit: type=1804 audit(1588956427.776:4): pid=11549 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir308819133/syzkaller.oWNDAX/54/file0/file0" dev="loop5" ino=166 res=1 16:47:07 executing program 5: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) [ 292.255779][ T9359] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 292.274848][ T4143] usb 2-1: Using ep0 maxpacket: 16 16:47:07 executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getgroups(0xfffffdff, 0x0) [ 292.357101][ T9359] usb 5-1: Using ep0 maxpacket: 32 [ 292.394765][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 292.405204][ T5289] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 292.422649][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 292.434292][ T5289] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 16:47:08 executing program 2: r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r0, &(0x7f0000000080)="0600", 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000340)=ANY=[], 0x2c) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000002eff0)={0x85c, &(0x7f0000000000)=[{}]}, 0x10) [ 292.448001][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 292.461139][ T5289] usb 4-1: New USB device found, idVendor=0458, idProduct=5015, bcdDevice= 0.40 [ 292.471142][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 292.494521][ T9359] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 292.519353][ T5289] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.538619][ T9359] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 292.553572][ T5289] usb 4-1: config 0 descriptor?? [ 292.568211][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 292.579761][ T9359] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 292.591867][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.603369][ T9359] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.619406][ T4143] usb 2-1: config 0 descriptor?? [ 292.629302][ T9359] usb 5-1: config 0 descriptor?? [ 292.665739][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 292.679060][ T9359] hub 5-1:0.0: USB hub found [ 292.754484][ T4143] scsi host1: usb-storage 2-1:0.0 [ 293.055419][ T5289] kye 0003:0458:5015.0001: unknown main item tag 0x0 [ 293.064410][ T9359] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 293.082402][ T5289] kye 0003:0458:5015.0001: hidraw0: USB HID v0.00 Device [HID 0458:5015] on usb-dummy_hcd.3-1/input0 [ 293.137762][ T5289] kye 0003:0458:5015.0001: tablet-enabling feature report not found [ 293.155040][ T5289] kye 0003:0458:5015.0001: tablet enabling failed [ 293.214381][ T9359] usbhid 5-1:0.0: can't add hid device: -71 [ 293.220404][ T9359] usbhid: probe of 5-1:0.0 failed with error -71 [ 293.257313][ T5] usb 4-1: USB disconnect, device number 2 [ 293.259522][ T9359] usb 5-1: USB disconnect, device number 2 [ 293.774408][ T9359] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 293.835227][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 293.845597][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 293.857369][ T29] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 293.865277][ T9359] usb 5-1: Using ep0 maxpacket: 32 [ 293.873024][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 293.985213][ T9359] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.016959][ T9359] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 294.034304][T11558] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 294.058577][ T9359] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 294.081970][ T9359] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.099318][ T5289] usb 2-1: USB disconnect, device number 6 [ 294.116822][ T8892] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 294.126116][ T9359] usb 5-1: config 0 descriptor?? [ 294.151693][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 294.194702][ T9359] hub 5-1:0.0: USB hub found [ 294.265011][T11558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.279931][T11558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 294.313809][T11558] usb 4-1: New USB device found, idVendor=0458, idProduct=5015, bcdDevice= 0.40 [ 294.323278][T11558] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.344989][T11558] usb 4-1: config 0 descriptor?? [ 294.477436][ T9359] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) 16:47:10 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) 16:47:10 executing program 5: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000206d041cc304000000000109022400010000a00009040000010301010009210000000122050009058103"], 0x0) [ 294.584307][ T9359] usbhid 5-1:0.0: can't add hid device: -71 [ 294.594916][ T9359] usbhid: probe of 5-1:0.0 failed with error -71 [ 294.651573][T11558] kye 0003:0458:5015.0002: unknown main item tag 0x0 [ 294.658927][ T9359] usb 5-1: USB disconnect, device number 3 [ 294.668160][T11558] kye 0003:0458:5015.0002: hidraw0: USB HID v0.00 Device [HID 0458:5015] on usb-dummy_hcd.3-1/input0 [ 294.703098][T11558] kye 0003:0458:5015.0002: tablet-enabling feature report not found [ 294.727823][T11558] kye 0003:0458:5015.0002: tablet enabling failed 16:47:10 executing program 3: mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000206d041cc304000000000109022400010000a00009040000010301010009210000000122050009058103"], 0x0) 16:47:10 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:10 executing program 2: open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',ro=00000000000000000100172,u', @ANYBLOB]) 16:47:10 executing program 4: mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000206d041cc304000000000109022400010000a00009040000010301010009210000000122050009058103"], 0x0) [ 294.866776][T11558] usb 4-1: USB disconnect, device number 3 [ 294.952978][T11711] debugfs: File 'dropped' in directory 'loop0' already present! [ 294.976559][T11711] debugfs: File 'msg' in directory 'loop0' already present! [ 294.977415][T11712] fuse: Unknown parameter 'u' [ 294.984508][ T9731] usb 2-1: new high-speed USB device number 7 using dummy_hcd 16:47:10 executing program 2: syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x0) [ 295.024283][ T5289] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 295.043530][T11711] debugfs: File 'trace0' in directory 'loop0' already present! 16:47:10 executing program 2: syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x100000001, 0x0) r0 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x68001) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000000)={0x23, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 295.117184][ T5289] usb 6-1: Using ep0 maxpacket: 32 [ 295.124615][ T9731] usb 2-1: Using ep0 maxpacket: 16 16:47:10 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x3, 0x3d) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 295.234591][ T5289] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.254273][ T4143] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 295.256578][ T9731] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 295.265048][ T5289] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.298228][ T9731] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 295.304342][ T5289] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 295.318224][ T5289] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.324246][ T9731] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 295.336883][ T5289] usb 6-1: config 0 descriptor?? [ 295.357293][ T9731] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 295.376447][ T4143] usb 5-1: Using ep0 maxpacket: 32 [ 295.382046][ T5289] hub 6-1:0.0: USB hub found [ 295.384216][ T9731] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 295.414193][ T9731] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.435571][ T9731] usb 2-1: config 0 descriptor?? [ 295.464220][T11558] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 295.475317][ T9731] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 295.503151][ T4143] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.514302][ T4143] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.524090][ T4143] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 295.546120][ T4143] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.547674][ T9731] scsi host1: usb-storage 2-1:0.0 [ 295.560268][T11558] usb 4-1: Using ep0 maxpacket: 32 [ 295.577936][ T4143] usb 5-1: config 0 descriptor?? [ 295.637171][ T4143] hub 5-1:0.0: USB hub found [ 295.654197][ T5289] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 295.686477][T11558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.705956][T11558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.718629][T11558] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 295.727896][T11558] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.741284][T11558] usb 4-1: config 0 descriptor?? 16:47:11 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) [ 295.764242][ T9731] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 295.764250][ T5289] usbhid 6-1:0.0: can't add hid device: -71 [ 295.764307][ T5289] usbhid: probe of 6-1:0.0 failed with error -71 [ 295.787187][T11558] hub 4-1:0.0: USB hub found [ 295.827601][ T5289] usb 6-1: USB disconnect, device number 2 [ 295.896596][ T9731] usb 3-1: Using ep0 maxpacket: 16 [ 295.903438][T11760] debugfs: File 'dropped' in directory 'loop0' already present! [ 295.911520][T11760] debugfs: File 'msg' in directory 'loop0' already present! [ 295.919419][T11760] debugfs: File 'trace0' in directory 'loop0' already present! [ 295.954193][ T4143] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 296.024767][ T9731] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 296.037037][ T9731] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 296.047756][ T9731] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 296.058272][ T9731] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 296.064188][ T4143] usbhid 5-1:0.0: can't add hid device: -71 [ 296.072787][ T9731] usb 3-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 296.077193][ T4143] usbhid: probe of 5-1:0.0 failed with error -71 [ 296.083752][ T9731] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.098955][ T9731] usb 3-1: config 0 descriptor?? [ 296.116797][ T4143] usb 5-1: USB disconnect, device number 4 [ 296.135298][ T9731] ums-alauda 3-1:0.0: USB Mass Storage device detected [ 296.168452][ T9731] scsi host2: usb-storage 3-1:0.0 [ 296.184204][T11558] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 296.294162][T11558] usbhid 4-1:0.0: can't add hid device: -71 [ 296.300412][T11558] usbhid: probe of 4-1:0.0 failed with error -71 [ 296.334740][T11558] usb 4-1: USB disconnect, device number 4 [ 296.364218][ T5289] usb 6-1: new high-speed USB device number 3 using dummy_hcd 16:47:12 executing program 4: close(0xffffffffffffffff) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) setxattr(0x0, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xb) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 296.454626][ T5289] usb 6-1: Using ep0 maxpacket: 32 16:47:12 executing program 4: r0 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) r1 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write$9p(r0, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r0, r1, 0x0, 0x1c500) ioctl$TIOCGPTPEER(r0, 0x5441, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) write$9p(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00') [ 296.575051][ T5289] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 296.593136][ T5289] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.608238][ T5289] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.04 [ 296.618124][ T5289] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.628228][ T5289] usb 6-1: config 0 descriptor?? [ 296.638561][ T27] audit: type=1804 audit(1588956432.246:5): pid=11797 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir839325459/syzkaller.MxD4uA/61/file0" dev="sda1" ino=15959 res=1 [ 296.662108][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 296.677424][ T5289] hub 6-1:0.0: USB hub found [ 296.697375][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 296.747950][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 296.798312][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 296.916051][ T5289] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 296.971638][ T27] audit: type=1800 audit(1588956432.576:6): pid=11797 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=15959 res=0 [ 296.991029][T11558] usb 2-1: USB disconnect, device number 7 [ 297.009565][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 297.024182][ T5289] usbhid 6-1:0.0: can't add hid device: -71 [ 297.032865][ T5289] usbhid: probe of 6-1:0.0 failed with error -71 [ 297.059070][ T8892] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 297.094711][ T5289] usb 6-1: USB disconnect, device number 3 [ 297.194702][ T7] scsi 2:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 297.210147][ T7] scsi 2:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 297.223625][ T7] sd 2:0:0:0: Attached scsi generic sg1 type 0 [ 297.244015][ T7] sd 2:0:0:1: Attached scsi generic sg2 type 0 [ 297.465616][ T4143] usb 3-1: USB disconnect, device number 2 [ 297.477791][ T29] sd 2:0:0:0: [sdb] Attached SCSI removable disk 16:47:13 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) [ 297.535074][ T21] sd 2:0:0:1: [sdc] Attached SCSI removable disk 16:47:13 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) setxattr(0x0, 0x0, &(0x7f0000000380)='.mime_type]$\x00', 0xd, 0x0) membarrier(0x0, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB=',fowner=', @ANYRESDEC, @ANYBLOB]) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 16:47:13 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100006c8c0a40f60d21004bd1000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000900)={0x1c, &(0x7f00000006c0)={0x0, 0x0, 0x2, "124e"}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)={0x0, 0x0, 0x2, "9871"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 16:47:13 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa410, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x5, 0x2, 0x0, 0x0, 0x0, 0x1, 0x2b42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3ff80000000000, 0x8000}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000001280)=""/4096, 0x1000}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/nf_conntrack\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) [ 297.677342][T11913] debugfs: File 'dropped' in directory 'loop0' already present! 16:47:13 executing program 4: unshare(0x40000000) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090001007866726d000000000c000280080002"], 0x48}}, 0x0) [ 297.734454][T11913] debugfs: File 'msg' in directory 'loop0' already present! [ 297.789369][T11913] debugfs: File 'trace0' in directory 'loop0' already present! [ 297.808202][T11927] IPVS: ftp: loaded support on port[0] = 21 [ 297.862515][T11927] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 297.879292][T11927] IPVS: ftp: loaded support on port[0] = 21 [ 297.924302][ T9731] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 297.928697][T11958] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 298.044036][T11558] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 298.147879][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 298.184708][ T9731] usb 4-1: New USB device found, idVendor=0df6, idProduct=0021, bcdDevice=d1.4b [ 298.193800][ T9731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.264329][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 298.284004][T10199] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 298.284178][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 298.352334][ T9731] usb 4-1: config 0 descriptor?? [ 298.378387][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 298.414007][T10199] usb 3-1: device descriptor read/8, error -71 [ 298.441652][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 298.505572][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 298.517931][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.530783][T11558] usb 2-1: config 0 descriptor?? [ 298.575671][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 298.595758][T11558] scsi host1: usb-storage 2-1:0.0 16:47:14 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) [ 298.644242][T10199] usb 3-1: device descriptor read/8, error -71 [ 298.748631][T12001] debugfs: File 'dropped' in directory 'loop0' already present! [ 298.768031][T12001] debugfs: File 'msg' in directory 'loop0' already present! [ 298.791968][T12001] debugfs: File 'trace0' in directory 'loop0' already present! 16:47:14 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f8000003000000300300009802000000e2ffffff00000000000000000000009802000098020000a10200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000c10000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400700098000000000000000000000000000000ecff000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @local}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x11}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x84, 0x0, @dev, @local}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x0, "c80004"}, '\n|UB'}}}}, 0x32) [ 298.994085][T12007] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables 16:47:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x5, 0x2, 0x0, 0x0, 0x0, 0x1, 0x2b42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3ff80000000000, 0x8000}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000001280)=""/4096, 0x1000}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/nf_conntrack\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) 16:47:15 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) [ 299.678217][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 299.692038][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 299.708201][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 299.720271][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 299.969413][ T4143] usb 2-1: USB disconnect, device number 8 [ 299.992143][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 300.069159][ T21] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:15 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f8000003000000300300009802000000e2ffffff00000000000000000000009802000098020000a10200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000c10000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400700098000000000000000000000000000000ecff000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @local}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x11}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x84, 0x0, @dev, @local}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x0, "c80004"}, '\n|UB'}}}}, 0x32) 16:47:16 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:16 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) [ 300.613836][ T9731] usb 4-1: Cannot set autoneg [ 300.618846][ T9731] MOSCHIP usb-ethernet driver: probe of 4-1:0.0 failed with error -71 16:47:16 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000180)={0xfffffffef38, 0xc8}) [ 300.658720][ T9731] usb 4-1: USB disconnect, device number 5 [ 300.893843][ T21] tipc: TX() has been purged, node left! [ 301.093917][ T4143] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 301.183856][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 301.306673][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 301.322136][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 301.334651][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 301.345970][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 301.357066][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 301.367887][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.380849][ T4143] usb 2-1: config 0 descriptor?? [ 301.403787][T10199] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 301.425045][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 301.472628][ T4143] scsi host1: usb-storage 2-1:0.0 [ 301.666629][T10199] usb 4-1: New USB device found, idVendor=0df6, idProduct=0021, bcdDevice=d1.4b [ 301.680173][T10199] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.702658][T10199] usb 4-1: config 0 descriptor?? 16:47:17 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100006c8c0a40f60d21004bd1000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000900)={0x1c, &(0x7f00000006c0)={0x0, 0x0, 0x2, "124e"}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)={0x0, 0x0, 0x2, "9871"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 16:47:17 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x278, 0x4c000000, 0x0, 0x108, 0x50, 0x108, 0x278, 0x1e0, 0x1e0, 0x1e0, 0x1e0, 0x3, 0x0, {[{{@uncond, 0x0, 0xd8, 0x108, 0x0, {}, [@common=@unspec=@state={{0x28, 'state\x00'}}, @common=@unspec=@connlimit={{0x40, 'connlimit\x00'}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_to_bridge\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x40000, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2d8) setresuid(0x0, 0x0, 0xee00) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, 0x0, 0x4c, 0x0) getgroups(0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89f2, &(0x7f0000000000)='l0\x00') 16:47:17 executing program 5: sched_setattr(0x0, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x0) 16:47:17 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f8000003000000300300009802000000e2ffffff00000000000000000000009802000098020000a10200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000c10000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400700098000000000000000000000000000000ecff000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @local}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x11}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x84, 0x0, @dev, @local}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x0, "c80004"}, '\n|UB'}}}}, 0x32) 16:47:17 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:17 executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000084f0400b300000000000109022400010000000009040000090300000009210100000122290009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f00000001c0)={0x0, 0x0, 0x7b, {0x26, 0x0, "4e098bae2a60b36c9986b15f8acdc55871dc9ed78757e6826322ea0e1a99f77251512146"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) [ 302.046248][T10199] usb 4-1: Cannot set MAC address [ 302.051345][T10199] MOSCHIP usb-ethernet driver: probe of 4-1:0.0 failed with error -71 [ 302.113778][T10199] usb 4-1: USB disconnect, device number 6 [ 302.126502][T12140] xt_CT: You must specify a L4 protocol and not use inversions on it 16:47:17 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) [ 302.167477][T12158] xt_CT: You must specify a L4 protocol and not use inversions on it 16:47:17 executing program 4: open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f00000001c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[], [], 0x6c}}) 16:47:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x44, &(0x7f000002eff0)={0x0, 0x0}, 0x10) [ 302.336331][T12168] fuse: Bad value for 'group_id' 16:47:18 executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x1004e20}, 0x10) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000180)=0x7fffffff, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003c80), 0x38e, 0x62, 0x0) [ 302.463895][T12176] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 302.483725][ T5] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 302.523715][T10199] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 302.570984][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 302.581194][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 302.583949][ T5] usb 6-1: Using ep0 maxpacket: 8 [ 302.598404][ T21] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 302.632855][ T21] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 302.733999][ T5] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 302.753668][ T5] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 302.763422][ T5] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 302.776250][ T5] usb 6-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 302.785600][ T5] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.793732][T10199] usb 4-1: New USB device found, idVendor=0df6, idProduct=0021, bcdDevice=d1.4b [ 302.802755][T10199] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.813163][ T5] usb 6-1: config 0 descriptor?? [ 302.829543][T10199] usb 4-1: config 0 descriptor?? [ 302.841940][ T5289] usb 2-1: USB disconnect, device number 9 [ 302.856187][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 302.881907][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 303.304703][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x7 [ 303.338557][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x7 16:47:19 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 16:47:19 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0xa, 0x4, 0x4, 0x86, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x2000100}, 0x40) syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0xaaaaaaaaaaaac46, &(0x7f0000000040)=[{&(0x7f0000000100)="906ded9c567a14606b6673176661740008040100", 0x14, 0x2}], 0x0, 0x0) [ 303.383713][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x2 [ 303.391217][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x0 [ 303.423776][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x0 [ 303.431750][ T5] thrustmaster 0003:044F:B300.0003: unknown main item tag 0x0 [ 303.454093][ T5] thrustmaster 0003:044F:B300.0003: hidraw0: USB HID v0.01 Device [HID 044f:b300] on usb-dummy_hcd.5-1/input0 [ 303.503688][ T5] thrustmaster 0003:044F:B300.0003: no inputs found [ 303.533684][ T5] usb 6-1: USB disconnect, device number 4 [ 303.763693][ T5289] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 303.873618][ T5289] usb 2-1: Using ep0 maxpacket: 16 [ 303.993931][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 304.003731][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 304.013529][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 304.033599][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 304.043356][ T5289] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 304.053196][ T5289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.063202][ T5289] usb 2-1: config 0 descriptor?? [ 304.106641][ T5289] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 304.120209][ T5289] scsi host1: usb-storage 2-1:0.0 [ 304.283589][ T5] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 304.383907][ T5] usb 6-1: Using ep0 maxpacket: 8 [ 304.503843][ T5] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 304.514750][ T5] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 304.524848][ T5] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 304.537814][ T5] usb 6-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 304.546927][ T5] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.556043][ T5] usb 6-1: config 0 descriptor?? [ 304.844618][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x7 [ 304.852256][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x7 [ 304.877335][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x2 [ 304.891348][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x0 [ 304.908526][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x0 [ 304.922535][ T5] thrustmaster 0003:044F:B300.0004: unknown main item tag 0x0 [ 304.937482][ T5] thrustmaster 0003:044F:B300.0004: hidraw0: USB HID v0.01 Device [HID 044f:b300] on usb-dummy_hcd.5-1/input0 [ 304.957252][ T5] thrustmaster 0003:044F:B300.0004: no inputs found [ 305.054691][ T5289] usb 6-1: USB disconnect, device number 5 [ 305.153531][T10199] usb 4-1: Cannot set autoneg [ 305.158309][T10199] MOSCHIP usb-ethernet driver: probe of 4-1:0.0 failed with error -71 [ 305.189444][T10199] usb 4-1: USB disconnect, device number 7 [ 305.201127][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 305.215441][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 305.226627][ T7] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 305.242358][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 305.473589][T10199] usb 2-1: USB disconnect, device number 10 [ 305.487806][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 305.524622][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:21 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100006c8c0a40f60d21004bd1000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000900)={0x1c, &(0x7f00000006c0)={0x0, 0x0, 0x2, "124e"}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)={0x0, 0x0, 0x2, "9871"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 16:47:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x1fc}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:21 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000780)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f8000003000000300300009802000000e2ffffff00000000000000000000009802000098020000a10200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000c10000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400700098000000000000000000000000000000ecff000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @local}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x11}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x84, 0x0, @dev, @local}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x0, "c80004"}, '\n|UB'}}}}, 0x32) 16:47:21 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c80) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) membarrier(0x10, 0x0) socket$netlink(0x10, 0x3, 0xb) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 16:47:21 executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000084f0400b300000000000109022400010000000009040000090300000009210100000122290009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f00000001c0)={0x0, 0x0, 0x7b, {0x26, 0x0, "4e098bae2a60b36c9986b15f8acdc55871dc9ed78757e6826322ea0e1a99f77251512146"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 16:47:21 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x20048010, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 16:47:21 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 306.015977][ T5] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 306.023512][ T12] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 306.113755][ T12] usb 6-1: Using ep0 maxpacket: 8 16:47:21 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000000000010600000000000000000a20000000000a010000000000040000000000000f0900010073797a300000000070000000120a0100001000000000000000800000040004800900020073797a30000000000900010073797a3000000000080003400000000509000200908559b3925e54be04000480040004800800034400000001140004800c00010000000008000000000a0000000000000000a1170da00cfe363d228b39185c3967c0f698bb93dc047affad1440288546596f39b277a62ec47361d0fde65bb4b0bda333f5da013cfbe9be857df96f9f38bf9e1544d3b194cfc4fcb81023560d63dadb7f7b5fe922c47ae02620de710a46fb20305f71813dcacf3d9504888c15b4e22a31a6c395c9a39382b8c4caeacd6d19dc1274ba0674779b4ee084b94c36f7fb4bc8aed9feb2e52c2b4af5dbc995bd2e5f350200000000000000b3fc61655750ad"], 0xb8}}, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x8, 0xfeffffff00000000}, 0x0) [ 306.233498][ T5] usb 4-1: New USB device found, idVendor=0df6, idProduct=0021, bcdDevice=d1.4b [ 306.242676][ T12] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 306.249572][T12402] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 306.257992][ T5] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.262807][T12402] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 306.274152][ T12] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 306.282895][T12402] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 306.303835][ T5] usb 4-1: config 0 descriptor?? [ 306.313440][ T12] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 306.337159][T12402] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 306.343452][ T12] usb 6-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 306.348466][T12402] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 306.368219][ T4143] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 306.373488][ T12] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.393823][T12402] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 306.409926][ T12] usb 6-1: config 0 descriptor?? 16:47:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) [ 306.474208][ T4143] usb 2-1: Using ep0 maxpacket: 16 16:47:22 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) [ 306.593884][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 306.608000][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 306.621980][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 306.640890][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 306.651663][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 306.662384][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.682089][ T4143] usb 2-1: config 0 descriptor?? [ 306.734802][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 306.758173][ T4143] scsi host1: usb-storage 2-1:0.0 16:47:22 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000003c0), 0x4) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[], 0x2bcf) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x100) 16:47:22 executing program 4: syz_emit_ethernet(0x32, &(0x7f0000001880)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @dev}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) [ 306.934322][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x7 [ 306.943457][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x7 [ 306.951063][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x2 [ 307.023420][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x0 [ 307.043393][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x0 [ 307.050932][ T12] thrustmaster 0003:044F:B300.0005: unknown main item tag 0x0 [ 307.084054][ T12] thrustmaster 0003:044F:B300.0005: hidraw0: USB HID v0.01 Device [HID 044f:b300] on usb-dummy_hcd.5-1/input0 [ 307.095790][ T12] thrustmaster 0003:044F:B300.0005: no inputs found [ 307.157589][ T12] usb 6-1: USB disconnect, device number 6 [ 307.834631][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 307.856700][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 307.871933][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 307.881288][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 308.113410][ T4957] usb 2-1: USB disconnect, device number 11 [ 308.133372][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 308.178461][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 308.583320][ T5] usb 4-1: Cannot set autoneg [ 308.588114][ T5] MOSCHIP usb-ethernet driver: probe of 4-1:0.0 failed with error -71 [ 308.602277][ T5] usb 4-1: USB disconnect, device number 8 16:47:24 executing program 3: clone(0x2000000c00ffbf, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000002c0), 0xffffffffffffff4e, 0x0, 0x0, 0x0) clone(0x2102801df7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:47:24 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x76, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0xeb}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='reno\x00', 0x5) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860ac5cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x8204, 0x20c49a, 0x0, 0x27) 16:47:24 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:24 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="0207000702"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="020a000007000000b6f1ffff0000854105001a000000000000d74619edc700000000000000000000000020000000000000000000000020"], 0x38}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 16:47:24 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000003c0), 0x4) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[], 0x2bcf) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x100) 16:47:24 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 309.446257][ T4957] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 309.543260][ T4957] usb 2-1: Using ep0 maxpacket: 16 16:47:25 executing program 3: ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2], 0xd4}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f00000005c0)=ANY=[@ANYBLOB="6e617400000000000000000000000000000000000000000000000000000000001b000000050000001803000000000000a8000000e801000000000000400100008002000080020000800200008002000080020000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ee87b58a000000000000000000f1ffffffffffffff000000000000007000a800000000000000000000000000000000000000000038004e45544d41500000000000000000000000000000000000ab1a00000000000100000011000000ac1414aaffffffff00000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070009800000000000000000000000000000000000000000028004e46515545554500000000000000000000000000000000000000000000010000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000a800000000000000000000000000000000000000000038004e45544d41500000000000000000000000000000000000000000000000000100000009000000ac1e001fe00000020000000000000000e0000001000000000000000000000000697036677265300000000000000000007665746831000000000000000000000000000000006b0000000000000000000000000000000000000000000000000000000000000000000070009800000000000000000000000000000000003f00000028004e46515545554500000000000000000000000000000000000000000000030000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup3(r6, r5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) 16:47:25 executing program 5: r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0xc80c0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @dev}, 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000b00)=ANY=[@ANYBLOB="66696c746572006ce69fccd18967e900000000000000000000000000000000000e00000004000000d80300001802000000000000000000000000000000000000080300000803000008030000080300000803000004000000000000000000000000000000000000000000ffffac1414aa00000000000000000000ffffe000000100000000000000000000000000000000000000000000000000000000000000006970646470300000000000000000000073697430000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd000000000000000000f1ff00000001480100000000000000000000000000000015000000000000000030007265616c6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000280061646472747970650000000000000000000000000000000000000000000102008000000000004800544545000000000000000000000000000000000000000000000000000001fe8000000000000000000000000000bb69703665727370616e30000000000000000000000000000000000000000000000000000000000000000000000000000000000000001bde5b2ce443e91f00000000000080000000000000000000000000000000000001000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d000000000000000000000000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000ff020000000000000000000000000001fe88000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000006c61706230000000000000000000000076786361000000000000df00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800f000000000000060550000000000000000000000000000000000480054454500000000000000000000000000000000000000000000e7ffffff01ac1e00010000000000000000000000000000001600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) [ 309.663683][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 309.665119][T12616] x_tables: duplicate underflow at hook 1 [ 309.679713][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 309.691906][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 309.692842][T12618] x_tables: duplicate underflow at hook 2 [ 309.705302][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 309.718782][ T4957] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 309.725613][T12618] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 309.736007][ T4957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 16:47:25 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) [ 309.778135][T12618] x_tables: duplicate underflow at hook 2 [ 309.779634][ T4957] usb 2-1: config 0 descriptor?? [ 309.838179][ T4957] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 309.859524][ T4957] scsi host1: usb-storage 2-1:0.0 16:47:25 executing program 5: r0 = socket(0xa, 0x1, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000740)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) r3 = openat$cgroup_ro(r2, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r4, r3, 0x0, 0xb) 16:47:25 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:25 executing program 2: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="240000002e0007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000004e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 16:47:25 executing program 5: syz_emit_ethernet(0x3e, &(0x7f0000000040)={@broadcast, @empty=[0x0, 0x0, 0x0, 0x0, 0xff], @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "a57ff7", 0x8, 0x0, 0x0, @rand_addr, @mcast2, {[@routing={0x0, 0x0, 0x1, 0x6}]}}}}}, 0x0) 16:47:25 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000280)='^\x00', 0x0) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f00000003c0)=0x17642c4) pwritev(r1, &(0x7f0000000400)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x0) sendfile(r0, r1, 0x0, 0x102002700) 16:47:25 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000180)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr, @multicast1}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x2}]}}}}}}}, 0x0) 16:47:25 executing program 5: syz_emit_ethernet(0x3e, &(0x7f0000000040)={@broadcast, @empty=[0x0, 0x0, 0x0, 0x0, 0xff], @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "a57ff7", 0x8, 0x0, 0x0, @rand_addr, @mcast2, {[@routing={0x0, 0x0, 0x1, 0x6}]}}}}}, 0x0) 16:47:25 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000900)=@filter={'filter\x00', 0xe, 0x4, 0x3e8, 0x108, 0x0, 0x108, 0x248, 0x0, 0x318, 0x318, 0x318, 0x318, 0x318, 0x4, 0x0, {[{{@ipv6={@ipv4={[], [], @local}, @remote, [], [], 'bridge_slave_0\x00'}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@mcast1, [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}}, {{@ipv6={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], [], '\x00', 'netdevsim0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'bridge0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0x3590, 0x1}}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "7eedfcb331f3ae839a733f3041901a8d235bd39675399e5719d27a532748"}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x448) syz_emit_ethernet(0x66, &(0x7f0000000380)={@broadcast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d64d4d", 0x30, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "000600", 0x0, 0x0, 0x0, @mcast2, @loopback}}}}}}}, 0x0) [ 310.883964][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 310.896908][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 310.908968][ T256] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 310.920518][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 311.144059][T11558] usb 2-1: USB disconnect, device number 12 [ 311.163207][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 311.235486][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:27 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:27 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x58}}, 0x0) 16:47:27 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="850000002200000007000000000000089500000000000000e26c9bd1a6361b80cdd64bdf00000000000869045aac0000659f55df08f9b90788ff7f00000010000029c21ebbcde61d8ab5922aef6c3e007fe61241638962cf6cfd3f1d4163d3cfca3733b30070a7cf53021a9554328a702688f92b6b71569d65e33dc657afac04379cca76515b89d7b536008c219991704f11c51b1d076f03b0f917c766f3a7598bbc00feb3bc8e88f79df517b37b56bcbc294a5325b191cff1f9e675458a43b8a8935bf9cf0be7d0aeaac41405e341cd0ba0d6fd562489dad595712a4051bb6cf826ab757193fc09d305f95c55d5746404000000000000007b61805ed48978c6a338db38e7330061756670906351ae30efb6d2f4b8c0019cdf1e93f640f159320c8b088f4d646c372eb312d4967aff9e4c14c66c905dcb54ed82c7cba4c81f91d6dfed18767bf0df584b4b6c31b8d5611f921e3aa02a67dd324b8176020e9c024751df38c05727f82c9263820edeb44f046bfe64babb6d7ba86526b7886a0c2481c5812812a6fa3fca3758cbd8c32b25c28be225bd1f16297baa065f5bf96330fad0aaa4388c06c0eb2ecdf87a05e1eb9927fa29af9577fcd868cc269374d58cb777d73a63246ce6f0467167626957e0e83869c39bba2cc632fcf76329ab910b7a13d9ec9a64e7f6b56aeab8c38f69a21327e7025d576535198743d403ec43572d7d0baf93e8a2617b260627805ca44200335ea4363066944d0aa6feb9704949ba40d46425197327bcdf75cbf1ba582f90ad717b842b9f0eccf02a473dd508a16138904933689ea6ee0241206473075eaeff2b69c2f2bf6f691c3560e0688fdc3f7a3586790a2a39fbea352e35753c59ebc1bd27ab663d1f28"], &(0x7f0000014ff5)='GPL\x00', 0x2, 0x103a, &(0x7f0000014000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2a3}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x0, 0xe80, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a00000000072feb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242b09880bd320d98a61a90021c9bf", 0x0, 0x401}, 0x28) 16:47:27 executing program 5: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f9c) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000380)=@un=@abs={0x0, 0x0, 0x4e24}, 0x80, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)="62c11cca5c18144ea0aa87dabe8cacc6bc69cd1122be75902bee23340e3117fff3149fa719ddebf0e932cb2e465fc6310edde927b2ae0ffd2e866d5104f017029dcd04aeb141ab32e33a437a2b77575abb9b670e8afd4ee5226a6c94d973a3f2dbfc47273f213736ab63d3341e2503f3fa3b0f257f76019d8ed1353bd7b10fc4a2d1fe75a0d899dc4f4733e9a7d9667a2d2d7ccae4c207091c317b7a8dcf32ce888c40", 0xa3}, {0x0}, {0x0}, {&(0x7f0000000680)="ad1c9caa3ac0f8a40787d46842b5879b6a15ba7d90c489e9f9bd1af615382005c7e09870a77e005ba8c2ab1679d8c646d82060bcfe2c6f", 0x37}, {&(0x7f0000000700)="efc75bff47aa9cbac69ad6788d06b5e7c8839665ff30bd542a460862037d2a19a28b78ab1cc2b9a027420e44bd2b5b765e8d6c81e23797c571735a0c3ffd0858579830cd1ebe370e9907abbd6aa9f4512ab9d220fbe09951d426c8981605fade85", 0x61}, {&(0x7f0000000780)="a4cccf6a1082c3389e5c9de3e03a37daf64ae84fced310a8b1a273b1e9db5f9cb0aa06fb514e7e7443b84ad2ad126d279bdc715c28406a31c1d824693932dc26df460987d287b6815213d4595c519212f2f408c263ae863c89f6e9915bd86a17542eda5bfb172f6d2573f665d627062e05d5ba8bac221b75deb9ad598d0cb0291bf550a2780c5424ece48b6be28e25db1ec448a44b0d011d892f245ed02ae58793a3a96672feb50980bd2bb38f6c9140c14fb3b8ec41156448c0d53e740870f449355256b69b8fed59536df20499d9d1ca", 0xd1}], 0x7, &(0x7f0000000900)=[{0xc8, 0x10e, 0x9, "98316aa7c6ad3d523db08a4da6354afbe8f7924b8f4da0fbbc5c8123a3d44cf7ebbe7df4ce96c5a5d443f62f67e60fb73633ec5e142ccbfe905fc7a1b8a54f1a584e092a1856c3916b6d561449f9870add03907b7d1443e6f67743d7fd975a02821b3013e02b3af0317a1cf716c7b33f29da85fd3f4947f3f18608a022084c0eff35fd9283478cfe128a0bd81fa7279b7001ceaed4a1ffb1ce3bf13bb73bc1db046e0e3610d7c1cfb2dc9a53dd408e9a0e0b42b9"}, {0xa8, 0x4, 0x8000, "7ce1b18f91ef567b06f50abe5fccaba1fd81d291799ff9936210af95fca6fa2fa12e0555e877744a62360b6b57e25deaef3a49f9dccd07d8c020480971876353f5a5ff3b6ed9434e8a23181732bb9b3a85a1ef89ca1d9eaa6a5e6ca091b8d8fbc1c789161befa46120382828512d227efcca65b4510388478017d69b248911cea6546850cb0a2c8fe2a584034383e8f580e6e2"}, {0x50, 0x0, 0x5509, "0d654d2e03a04b809338172c0073b4bebd17736ac1ed514b406893df3450b49d8fc0456855c6ffee7503375ebf30d8ed0e18d1864c92970b67"}], 0x1c0}, 0x10000) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000340)=0x80000001) 16:47:27 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:27 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) 16:47:27 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/74, 0x4a}, {&(0x7f0000000200)=""/209, 0xd1}], 0x2, 0x0) 16:47:27 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="0207000702"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="020a000007000000b6f1ffff0000854105001a000000000000d74619edc700000000000000000000000020000000000000000000000020"], 0x38}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 16:47:27 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/74, 0x4a}, {&(0x7f0000000200)=""/209, 0xd1}], 0x2, 0x0) 16:47:27 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x400000000000002, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r0) write$uinput_user_dev(r3, &(0x7f0000000980)={'syz0\x00'}, 0x45c) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x1) ioctl$UI_DEV_CREATE(r3, 0x5501) 16:47:27 executing program 2: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f9c) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xe43) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000400)='posix_acl_access^%/vboxnet0em1[\x00') [ 312.013063][T11558] usb 2-1: new high-speed USB device number 13 using dummy_hcd 16:47:27 executing program 3: bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40305829, 0x0) mkdir(0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000004c0)='lo\x00\x96o8\x14d\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\'m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1') sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) [ 312.075352][T12769] input: syz0 as /devices/virtual/input/input5 [ 312.125840][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 312.158157][T12782] device lo entered promiscuous mode [ 312.217510][T12785] input: syz0 as /devices/virtual/input/input6 [ 312.259011][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 312.306375][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 312.362737][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 312.390965][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 312.402596][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 312.413240][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 312.435946][T11558] usb 2-1: config 0 descriptor?? [ 312.504188][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 312.528022][T11558] scsi host1: usb-storage 2-1:0.0 [ 313.593684][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 313.603988][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 313.616799][ T21] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 313.629888][ T21] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 313.854667][ T12] usb 2-1: USB disconnect, device number 13 [ 313.883119][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 313.925399][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:29 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:29 executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200000b000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb4ba431ca711fcd0cdfa146ec558e25e70ee25a9937f02008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318f0ec0efd49897ac804801ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb6220309900080000d760751b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7eaa49c62ba0fe52fa65f1328d6704902c9e7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7bca6b13a14f36758f57e6148ba532e6ea09c346dfebd31a0808b802000000000000ea334d8323893c5337669dd27080e71113610e10d858f8327ef01fb6c86adac12233f9a4ecdc7cec61ce63000000800117009a9ab359b4eea0c6e957673f00000000800000dbfd2e6dfe0ca0423deadd7130856f756436303767ff7f4f29e5dad9796edb697a6ea0182babc18cae2edca9590c359ea84296017a00000000c872825dfecb9010657e2b4809207e3b250cca649d5dcd6f3e2132f4a071015a3d1c5308471b9717bce11c7a33762dda6f1acf45bca757318932c9f3dcb6a532b7f2846a759fb1f9ec9960bc3b2336856d33313e154910a0e2ffc08930fbe6c7aeec24691653c60f32db2a68b1fafb83b3a13d6a0a4da8a75fe676fbeb8e5ac7c1524f7f8df6ac4c33cc9b82afaae7994b1aea29ebbc6bccedc0d2a01b2d84c45d5f4c9527533c5ac995808cf30a2353e7960700000014ab35ee8425253342c05dd6eb54683be99eaff3ebe83159342a2e0b6ba1017cc465269dee2b929fd1cf202fa4dbc6ca6b6435f55cc62cec091ce4ae610fb02839780945cb1949"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe, 0xa00, &(0x7f0000001a80)="b9ff0300600d698cb89e14f088a8", 0x0, 0x100, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 16:47:29 executing program 3: bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40305829, 0x0) mkdir(0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000004c0)='lo\x00\x96o8\x14d\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\'m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1') sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) 16:47:29 executing program 2: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f9c) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xe43) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000400)='posix_acl_access^%/vboxnet0em1[\x00') 16:47:29 executing program 4: bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000001740)=""/102400}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000080)) 16:47:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:30 executing program 5: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x11, 0x3, 0x300) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x4) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @local}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory', 0xea}]}, 0xfa38) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) 16:47:30 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000001600)="fa0c000026008152915a655267d7d137ab2ff96e27bf28b285fe3903a44a6017edcaa3a2b4dade3baee72569b51366463fedf5e787c05b0cb5927a3a7edfb4d078e9ae1504d489e058be9fafaa633705b6d4bf1301f2cd9ebf19254a1b0b9760612582bccd3983ce4474844c065e914dab8bbd52a45f431678bfe28633bf7c8dc83df809238ed87f1e393883ef750ce79c6f84e5e5de176e2f26024e4e3a3d8fbdaf3254022f265d8ccc5fd7205d9d9c2c4076c58162523082d81a39c43f782332ba8e82b4107a049cb82bba8b5edd80473844291437b8d22edca68047582e6be601e9df5e60a32c7cd202c5a30b8b606e43362739551cbb013b65e238f41cc00d7900140cf06b7bc9030f2563bcf9d4f4b7f48c79ec1a323d06276a0a3f8846b7c62b66f9709cabcaad234c53f3bc9b11165a6321f1db1057f076cfaebf8fbfa033fdc1dc2c3e314b36b3b3dd50425447da8bc5938ff7a17361100ab0b1ffeab7ac487411824224781eb9cdd4edef57ae91cd61f56a56c0599cfc3a491447207610f242da6cd6b030ae5f35e3181c44ae68665a023759b9ef4358db46107edc49194aed72b62600ec0ae4fc9065be059fc010cd6e6c9ea77c666b5e25693fbcf595e3e57113ff3a0e0c63d0604a16ea5adb8b7b54d47d4d8804612fde571863064528a49bf684d8a880a11afd819f186c177c49cac3ba1e9d1aa7ad0ff36b9e36d73c05b8abcaf96df0aacd2c9653f30ec29e1284af8749a9b2803c2727e992a6e65df192e1875c3e6d3553ffb7cb34ffee8f8ac0123c390454b42a0316952cbc9949376d9320ec207f77c2d5eb9e86d720cf8e9008a9a51932b45cd4cab21414c92d1c20f9e15e3fc16c7ce181e9ab19b01b70343934c823b1215e173405dd225233823cd4a604a77f06b14eb05b860e6cf8790335788c43abe9de1598e9952e5c7e6b2f8b17b1788ff3033e7d1635b008834bdf4054e6195e55000827c6202b227dde06f23ae21c00b371bdb6b7ea47b2e78844b52a77f9f0929790dcd7df2752e4af092d539c87c18751a5eb3eb4d38a2a0e070064b4ffaacff0543b115cc89f6c7e78f12147ebfcf1c80bac8f98deb59cbe670adb4cd1882a7e0ca4ba85ae9d445223ffb32301d46c0c9b05a830cbea0f72294ab3b539e4ed7cac2e22b235e8ceedeb643fb90b061a58368e76036ff3c1828d8a4e21288662afb6f2acab00d734db7ffc8373a928571819ce9ea6cb0956a6093b2b1f65662b76bc6ac8a19008cf08a6342d64674271451714e1d0e4ff7647fe7551d3cf16f37cb5547317e4fef51e4fb471de6ffbb90c2dd4a64266c4c2f75fc62e58ec306fb92212fb262d8b138899a3b53e67cde2f97d94cd2265cc04d32b29edf77e75b1f88372495cb2937f183bfc8604d72efb3af5c1f41b665b25592676b0ad2185478eade7e663e743e0e09cce6224c787ce1d789dc4a9b350bfe3a75f551341b11dd96cdaea17989dad565b16324a69842dc29a0ed16744ea5935598ac8238e146139189927a14d3b2863044b63b468ae75f48fab68ad235c36daffebfe4b468fc9b13198b1a683dcd3b3b4294ba22caddbacf8792d5783bc12e2538e4609e6bb6e9eeab98a06452c252a657f400260458c29fae8879097698c9aba2b2d889fc78f00d0d8271e09e8542b71018be6ff8cb03cb423e79303047d6ce124a00f64461b899bbddc4fe87ff677533391e16c01fa9cd6420bdc856c4c7f057b249ee9817efd6ab2cd02eb887d2631435ef2d5a1c7e57ac046ef615a1285ca89ade18ae69af3b3f8f76ca8aa060e373c0f99424fe1c5fadc72fe145fd2d4e4da4b78597890516857de188fcdaf15e3b0871b346cd39ab772cc25fab49e60c818cde934b137144adfc4fbde3ddbeccce9679f02b66746e822c67b3ed5fdafb4a936a2683b39a002115ecd62220605ca542610a80f2e3530aa89d3ed6ed9c57bbfd5db3a0b62786a608309a355443c616032008f9458b2f10db93e29470192370084e9322c309c9b23333b46d04e79176659503ad4b05deebb3c67d715ee6e84a89002ea6f7f71bf41ad36b42c8ae01c97174dbb641e50641aba60c291a84e906c013087370a5043e07d36fcead378f6c1e6ed3f5ac695124b82b20261cf7c9b82172e09c81d7d39eed72aee5678613a3c671ddd44f2c7c75a3b5d316aa165d56594fccab20903d7f503a08928e76c779918b2463b720ee6367a43e494a1db3ed1a80690e665570c01ce7eb979cdd95d4e1ca51730eb2cd63ffb2a56049601627c9788254945142dce85adbe1eb5997d16cdfe2a3758b13dc6bb121e2206ae64206868c1c5e89a101bc121719ac435dcad093f5f67cefd863cc7c8f3fc8a9dc62a83c115f1ce714b18af067951aa06dd9bb4ed98a820bf4704d156977caa4e6415b2a0df0386e2f6a061bf44abc8a397cf4abdafc51b78ebec9831f3c60fde6e62a1fd082903080aef20ff8de8bc0dced06f627514600539ca7114a088848da4244a85b4cf5b976d3a698c9a568d417e276917baba05d1a02181db2e6cc35986da4ccc63f8cd8e85a4a923dd27e2f499664601fdc44fdf46e2d2880cd5a7ece89c370234c438dcc0b43865cc62bad21e9dc37da758cbe01752f02fd9cbfe98630a30a78bb1239e25cdaba3d45d13cd3e7216d9d8070f3ff1a0cd9a0c91f29974c98f2677ba88c1091bde4be0cd37ea5eeb3b9cbb0360a00ddd40bbd60ffb8d4daa973ef0977c18dd4b38a605cee957872dca85787c37b6931293eddb77015faf143d1d28d24822d1a5d134799e8175a38b255aaf0e39b68c7f734e2e1e7044626daa84c9113e86d86ef63c863703703ea163319261dcf516c32d49478f7af30d52baa18ea6b0fc286c06b7e4ee019bf3fe74845a652d4a52aaa241a189c411e90e2953863a2bc4124e573607b94cdff19e280731824931a83f056cb5857672619b97ce38081592c0c319ce72e04e9eadce89775cfb5a4b2842663bc79bde565435cbcd46c4d505ceef7dde86512d39d4cb270deb7e79ebf8602bdc0d76c3e833d36ee08be10be634f44056c2f3fd6a328c7cd562e9c96ff7845fc3df81a876bb07f1cc833bed6ca1dc5cf935a4e959db6a4fae6edbc45357d8758faa9cd04cd41eb6efcfbd91658519bf520b90107f767d126854818485e98cb7ef56804de6950bf4e72098a949d14ea0e4e9f2534cf16cac0aeb970fc5c39f37e93910d5c99ac163792260d2280ec5c9a79bf295588ec23f524aae65f800f9c39e338f3d66b1a69e5488e04823eab36ae6ec6a2c5ce133ccd819a2b217b1ab7f4afd1697bb42929b3131358b5421c83f925571934442d0fd0ce3990d4e5d31d8b956f76df3c2f8533e46b892c88692ce009155dd5c7dbe4c86874b95762650f63e4b4aabb41320978b05b80cfe8fa2830904ef6b5c4f7ad46ca5dac151c9077c4d2c6adfe5066a8eb09a9bc6892330ea2b259a53c7137f8498254e1b04bf920c35c5333c4d640b11da60917ae921037b4aedbd6a0fbeeaf88ef6defc830552b4cbe3fe2a844806a48923dd428ea1c8d797bd8e6aabd1d1a8c97c8038b627120a77f4e47fa1f788aa9da268b0ec10fc453cb722685df76547dbf55a16663aa2b2a51e9c52456cccdf682592d1369dd12e3d3cb504e0f2d7004e60c297d5a25d0298045dae8fca8cb795ea57288b85a7e705820087d55ca6c42e920e2aa1174e128622cf64a197fd728cb2949536ba63e8bda8589261f1377caea37302e47228d3708a5666c66ba711d3c0b310a8c47e86d26597299d523c28c90e4feab43e950f398f7b61ccf7e6490d75ba6d8214e2d5ef2d7a088db490e1ebacf4e6eecc896cb1c704f0a8fcdf4ccb5dfa53eaf43d709287f36c10188c19fd59da7d73494de089c1b0a69ee22dcb847001c5317846a876bee1685d11c4db0673ec4c3a12008bb719650525b3c39e2b0469edda93830b3f1bde3e5b0b4637197866bb08c5858cf0d9876e3c7cad54169887bf9c80f9f4be362e1bc8c27f3434e9a918bac355c184bd899b9aebe6be20e70c0c69234342eb8b57aa9ffb7797a32df91cec2bbc90201658ca227abf1fe68e65363867e1f6ad79b827f363d64fbd3b188d95307d011c4ce5bf4407908c058eeb97ec98dd0ebfdab6b348fa387f2a7573cac25344c983e8fd526c30ee6d59fe99a30c7d7e2864aa22bfa49df5f32da68309cab3ed9c2ce69b6ecb8508ce28a43ebd6c809b8afd07a4606e664965d316f3707a3abee9bcdc32a78031b0171fb565d90c16cd56e5792c0cf618b799715f32538e38f493d4e19ec76fc8a07576a13975706bfc2bb1516c2d18a4385cc37a206eac6c9fb8d073572ba2671d2198abf24fdd0c40d079ae44962c26743b4bf5950ac5ee34c5d7bd60b364ce670958112c37b9829bed7e1327356d6b94af3ba020c2337b2dba37d00af8a128a614390cdde62ce871f948427fb5c187df9a1540a5cc71da1a86144acbfd94bf433f744f0c4f2a675eba3ed251c5b11b08dfefc726c0394a9b75121d88467ed4b2cd69819dfe50693a4a4c8370d3af12f41c0067283bbb5a90044a340fc357a11081a6c13bb9c32d9caa448479fd5f0302b6729ca7233094540b14546d6bcc15771c2686279b34f9c0914f5306d0fabd5979266ea01a17a22507e560dbf904dd62c40e2bcc", 0xcfa}], 0x1}, 0x0) recvmsg(r0, &(0x7f00000023c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f0000000c40)={0x0, 0x0, 0x0}, 0x0) 16:47:30 executing program 4: r0 = socket(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000280), 0x0) dup2(r0, r1) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, 0x0, 0x0) [ 314.602069][T12893] netlink: 3286 bytes leftover after parsing attributes in process `syz-executor.3'. [ 314.612564][T12893] netlink: 3286 bytes leftover after parsing attributes in process `syz-executor.3'. [ 314.624607][T12893] netlink: 3286 bytes leftover after parsing attributes in process `syz-executor.3'. [ 314.646570][T12893] netlink: 3286 bytes leftover after parsing attributes in process `syz-executor.3'. [ 314.672871][T12895] netlink: 3286 bytes leftover after parsing attributes in process `syz-executor.3'. 16:47:30 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/pid\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/pid\x00') [ 314.722951][ T5289] usb 2-1: new high-speed USB device number 14 using dummy_hcd 16:47:30 executing program 3: socket$kcm(0x10, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000800000095000000000000002ba7e1d30c5aaa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc41056bdc17487902317142fac7e78ce74a2c75a7be168c1886d0d4d94f2f4e345c652fbc1626cca2a28d35806151ee988e6e06c8cedf7ceb9fc404000000c588b277beee1cbf9b0a4def23d410f6accd3641110bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8580218ce7400dae15cb7947c491b8bc46b8eda1868720000074e468ee23fd2f73902ebcfcf498227759800011b405b433a8acd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b56780260ed606a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad2a431ab9142f3a06d54740a4bc5e32bd378af7c9676a08e774c487e32d198e7e5bb316dfe8cd338807a6d785f895b4ec7bf48cabecead649f96ea24d32872c494160cb5d46ce680eeb80157eb23f9902519a693b85c655fa73103170cbc496d7122034385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaacc59608f4d4e6067338b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bc99473ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b4c11c58217bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a5eae871903ece51c895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f9ce91d3fdd528efe6c1dca17f45ba5e8bd311a40030d5c1ce75ffff996a80153ac677bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246df20356ae073b1df08ae2c268b0073bb99d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b939daf2a45e7c50782c7aa055dd066fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f5c635d8d646c885f820ce59ecc731deba3998c27b815f7b0acba754c01ed8bf1bbac14da8c6a2b966d861f9dd547abf817063b549adefcc925909f6d9e72e9b15e5603eb5f80b58fd76e45d249401307e3a0df2bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b96e07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac4218eeff5f2d23a430fa44c30ce84b93c97a23e6c97953faf4420638489e6a6ded6d8c414a87b652b95278e99b06dbb6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34612f6ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x200408c4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x5, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffff8ec7}, 0x10}, 0x78) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000040)=@ax25={{0x3, @bcast, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @null]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000280)="f9c51ce11851f3e2e2e399cfaa7f28ab1248144db58732e7f88757b36b86470687e2478cbcf9f67a4dc3d49cf9311aef71578bd4460760ae277c2afe29e26f2a37502b2a52b30883529d630df5eb5816a4f3977c67afdf64b54621fa51ce37b2ac13156a934ea06a47324fc69fa2d986a7ef94ca9e2738a3eb82b45f3f857e3c7c916fe5", 0x84}, {&(0x7f0000000100)}, {&(0x7f0000000400)="68cb42e091e058db671d7a61df43a80306e4ebb18ef442fbd2dd16a0a62fc23f290499bd365973c69ca3d3088289b324cf03a3040c4731ac7c28883d6f50eaf5c44bf921403847c1c550ef6e0c46fcd5b73448d6bce76c0cde52f28da73a343d1a0c485fe4b7cce14fa5817de81995c997a12317cf11b0ba329f5c83992bbeab", 0x80}, {&(0x7f0000000600)="62b7fbc2962a187d02bc38bc6d86aa663711733af19bc66bc85567c6065d16558e96235ab7d559ad94c7231d78fc6b2797debecb8d1971bc5297759b160bb13c1be53587ab5f27a43137d7caae2a65f390c8e4a6fb429b79c33e3da21bc74469ac6b0dc31fb25ce5", 0x68}, {&(0x7f0000000680)="dd7fb3429db19783b37e4de8f9e1e926bd4e1af924b448e5dfc06623737aea44dc064ef0706897cdf95dcbc13e6e6ecc5690f46508cb045a853fbb4bd6918483db8e624f4fd6aadd6430751699b2ef34fcd870af6d9abcde415cfd5ec8fe963b518b0ce8fd412cba70c37e99f1e0b867c8590a98bbbf2e0336ed61b0d89aafc5e9742cfd11c4a812acefd89f02f8a9428952c80ae032468df9948de7b03be9b98a316593d2eb34edb5ecc40a1de7e4e9b0a8901a819d7242c6f0be7b5eeb18a3c1234b7aef39ffaa6cd51444a687d3bf1e657865167078a12fdb4fa038dfe3485b77dcbdbebc2f9bf4f142586f7ab631dec532164621228cb181b3bca502474664930254cccd029afc453ca5143a954adae1d20fa3a86667563120367a14f914b46ab9ab858390016e54ae82c23279f33fe8c5b5bdea1d9dd965aa73b0e6c5f87a639caa8efa1f9d90e988449d7d8e9b6fbd46d98d328f21a5a75c0338785acb6a5132aa40f603882122edddb7a465b3b6b36b5091004711a5215173dcedb3957e6800395bfbe8329cf423ba249e365298f1f6b5b03694abb5b1fb1fd1ae75d2cac7c218f4d6f692861bd4c52f710139a8f93eab90a8a368368ca9ab7629c536dc3e50cb4fbeb77e8a25d57547403bbe253f0c6410b8d1a0cd84a526f561ba721ca2ffa423c1237f711d95113c2d9578b4bd2ed88054e64718f6ae7b15dc01609816d6a55038bce8f879d71b82ab605d9cf32925ae83a25b48910c60c38c36017271bf90db30c2d724a8c895d29020aa50cf4fef3230e2b8a69f8b854d705cdfe7cfb0a95bb82cb9179ca4e815cbad096226cfaa6dadad7c823baa3d0db9f96b1b23ffe48b24b543a0f38f56e4229f1719854b575f88dbe24888466057a1e941ba04a3dbb928ce416f70e28fe14ab9092672ce08055f556e72583ff94ca82212e1fb40468c5a13f8dc2bc795d1c0e371aa3b7730b3b1b437ee837a9dc3c5ad52c5b5e23bedbd63132bb4269a8c2e918d90e6d70b8a7dc1ed6cebd6ae10f6052432513c1d29b8ca7d90a624a81f9ea344c5e4ace0d66a4e1c13ff05454d26e720aa195101c3b5429c34dd01cc62f9c6b20928315743c27a82d9b6f435069b4f2181e76d195fad2d0f315cd5b3e8974c5566ead6d50154d1f1b274480075b5d97c212c8c0dab62cbd7aae8f7fa0004a23ba41ae5f7cb7e45dd3aca5949ea5c11119d647a9b776f48a9c1bfe0bf77a304d34dee33a38cf28c0b74c0290a6bde375381d330d0daef894936f70a0892d195282a80b960c6d6c6a7a619e49276a643336dc31d5c0325fde558fa9cdd77da4491d027d5ce781b7bb99f382e000e2b8c4dc3dce5b726b639d65adc613141297963063006743c35cf09347d27038740c40ff69020320673b05ee28fa6fb4c47499e162907ec54bd64802e8cc5f65694716d0b87fda0b6ccfdd438e8c434b74f5f901ae9c5e1a9661e7929dd8877f52830a2f059f38016fb4105a8ae2c3c75425974618e4c7dd1304efb94d782cb14a20a68f7668efa9625d4430e4886852e0b2d8d3a50040d6292aae4cd58640dd701653a517abf362f87663d5712e5dcf54abaad05c68a291e1acb903ace1fa44caea476450c7f0ed34ec9b1b43c56fb9a8c888822d1c26301bda82fe9c17d5879efb17cf7da2a1518f290dd444a01f95d23b0a5593c6d8a0ab1a17f200237aa9770465fb4d00b60f22d5f1bad2f8f1223ad43a6d20e34453f0198825ea03cb9d22a6b3468aa0cbf9c0a763e7a170d094d4049ea82c49925915be122b62289f2a46f592a995770944768b640abf62197b739051ba882b8b0516b04eb58b28688fa64a12545fc25b29e0c7a492e4f7815a686b6c089c7657efed8e8adf07f5c3d327a668cc69dac75369caedea1b87fa16ab7e6cf4da4466465e541e842148dd4ab152cd8a78b52c8c2a52edec1ce24c7069db36e6283d203f9aa0a40f44b47ec77456c3c9472e0e9d74c29fded1081073b98040b611ce28063a53f7c26fd3dcbb07408aab5afdf6dc5cc945218e1bc7e5c1b2a5596ddd1f5935ed0cba79d94ec566e354d0ad4d7e5fa525b633f01c2af4d9b44934de77397527f39d3dcd639faf05a00c47903de0e35c94ace7a69a8cf8b685295b4210bd29662b11c575eaa83b09173b7ae9f219c4a8f41391d53ff00cde80129526e25e8b0c3215679d9f72fc34387c9f88e3ade668b415ec7bae3c8b273c8a8554c7061e86d15afc75653ff556a96ac50a9f96bf1af36cb3d967aa9847c197db6ce8a00329a1ddd6a67afd636db24f2574a44fd3062ba7ad0074844230ba546c16d6dfb2fe01f58bc4a461af03640a3c85603e8fe3aafb2ee2087bd2fd0bacdcae1f0b21a2548bed570db95aa4501fb71ef1679a537e84ec4ac836bd7de0242fbbabc41ff6fb162ab7dee937fc2557cd05613017cfa9b28dd8d798a37111c3b1494fef600c6e396315fa50e5ef21289a0ccf646e61c31ee1032d2d48679e223953b67dfccddf93390f7c121be3ce44a70de3624c52640f667595807a76036cdf31b2a2b4dec0e613c54fd97711347b6f95dcf18150fdece8508ec1add06e95ad72cd379dfff0da0fe0473b6f31da73052610b0d6b5eab90c6d45fa13f9f551870e9ce8bc7d2d1ededc6891e18dda7b2d42662d168e8dac8d48cff66103cf6cd750ffb9669354e122c578f42a9c530eb43e61f0c08a92a4da83460eca1a6f7c96b2dd502c0e7e7a0324b5dba38955d806b7656264ec904ea765512464d90154e9fb8547c5ee71f2b6252802e8003b7a9ce4d827ee72e4e7331d044f5313331b8ffa25a0cac863a9073247af1cfa34db1aef47ed5422ac4d0a6b367e1a662fd73a5834d5aec259957eb4dfe83488f2397d275a92dac603011154c751e3ce9917b2741d3ca8296f1e793fc45af76dcae40a2cb01247da9504e63fe044b33b5a7959d6cf521974ee2bba5bf02dd74ddcb635db63b08432ace8709a7d4ff1f46b35b525e34a2701d7a03ee70570f32b35603b89186191a090cee40edc756071907f921f90e12948a3f53a2cbbcc2aa9805ef5bafee6222ab9316cd101f42b6726d8637b44807791e58f1a3fb34b657375248726499c6b1f6b22537acf5e1365112134ff67789c16ca76f51262c482172826d99e4b585de1962f032ab97a33a264a79163b48b15e06870bbe77ea352b72d7f90f038b58475b3929b0fbe1a9c1897118929ea698fb8ae8994082481127a85e6f63bcfdf391d4745e036fb9d5614bd21e518eb7a99d5ec3db8f03e0f5e0926562d23a4350c41dbece750d867dc09318c2d5a0c101eb613f81ad090c623e453e486294b3dc3ec83df2ed779489565700619ec59607e53c5e5e7fcac8933b0490233a8982f9c8b013e25d4678fe7069814a1fe2bcd405296b48433e84386a4fcf0057f01124217358c45c8ee599c994f2dc1b2f29cd61304b921a40c7125f5da3c0e843c1b36625ae1fc5039c7455ad50c23241ef619982e3a0ebc0cb0dbfdd03e639b1c7df729b347bfc508c3c84183ff77d947b1fba2c2c8f47c2ee40696a118d603648515b89542f401f648bdb233b4227e4054b402ffc6b750eb5193f1f0add8fe8c5f56200745fee52c896a13cf6fd27b7385cdbb100d7b0849d3ad919f4a06bd40d9ed8ebd2f4acd4f81228124a64052c47efd7ffae32f3f0fe56200e44c6b75376032caf31e53415eab3c53bb9e4ccb0efa002d8202840ecfbdd187aeed3d648f24368164e73aaf4e9057ccd7fb8650d530490ba98a7dea3f5efdb1eaa231521073a7d5677ce474889b7ee12e46d6d4d12a973042efe845f6b597794f7509357376cf82fb75439ef3fe75813b9f51e1ce532d1e1299c901c12cf27acb008", 0xac0}], 0x5}, 0x841) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000043000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100c4320404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r3, 0x0, 0xfffffdef) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0xfff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 16:47:30 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x1e) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000140)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000040), 0x12) [ 314.823741][ T5289] usb 2-1: Using ep0 maxpacket: 16 [ 314.943226][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 314.967428][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 314.991843][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 315.012052][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 315.022671][ T5289] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 315.032574][ T5289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.042743][ T5289] usb 2-1: config 0 descriptor?? [ 315.084080][ T5289] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 315.116235][ T5289] scsi host1: usb-storage 2-1:0.0 [ 316.153594][ T911] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 316.163693][ T911] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 316.177063][ T911] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 316.193425][ T911] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 316.413722][ T12] usb 2-1: USB disconnect, device number 14 [ 316.433105][ T256] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 316.485197][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:32 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:32 executing program 3: socket$kcm(0x10, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000800000095000000000000002ba7e1d30c5aaa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc41056bdc17487902317142fac7e78ce74a2c75a7be168c1886d0d4d94f2f4e345c652fbc1626cca2a28d35806151ee988e6e06c8cedf7ceb9fc404000000c588b277beee1cbf9b0a4def23d410f6accd3641110bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8580218ce7400dae15cb7947c491b8bc46b8eda1868720000074e468ee23fd2f73902ebcfcf498227759800011b405b433a8acd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b56780260ed606a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad2a431ab9142f3a06d54740a4bc5e32bd378af7c9676a08e774c487e32d198e7e5bb316dfe8cd338807a6d785f895b4ec7bf48cabecead649f96ea24d32872c494160cb5d46ce680eeb80157eb23f9902519a693b85c655fa73103170cbc496d7122034385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaacc59608f4d4e6067338b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bc99473ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b4c11c58217bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a5eae871903ece51c895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f9ce91d3fdd528efe6c1dca17f45ba5e8bd311a40030d5c1ce75ffff996a80153ac677bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246df20356ae073b1df08ae2c268b0073bb99d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b939daf2a45e7c50782c7aa055dd066fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f5c635d8d646c885f820ce59ecc731deba3998c27b815f7b0acba754c01ed8bf1bbac14da8c6a2b966d861f9dd547abf817063b549adefcc925909f6d9e72e9b15e5603eb5f80b58fd76e45d249401307e3a0df2bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b96e07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac4218eeff5f2d23a430fa44c30ce84b93c97a23e6c97953faf4420638489e6a6ded6d8c414a87b652b95278e99b06dbb6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34612f6ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x200408c4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x5, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffff8ec7}, 0x10}, 0x78) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000040)=@ax25={{0x3, @bcast, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @null]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000280)="f9c51ce11851f3e2e2e399cfaa7f28ab1248144db58732e7f88757b36b86470687e2478cbcf9f67a4dc3d49cf9311aef71578bd4460760ae277c2afe29e26f2a37502b2a52b30883529d630df5eb5816a4f3977c67afdf64b54621fa51ce37b2ac13156a934ea06a47324fc69fa2d986a7ef94ca9e2738a3eb82b45f3f857e3c7c916fe5", 0x84}, {&(0x7f0000000100)}, {&(0x7f0000000400)="68cb42e091e058db671d7a61df43a80306e4ebb18ef442fbd2dd16a0a62fc23f290499bd365973c69ca3d3088289b324cf03a3040c4731ac7c28883d6f50eaf5c44bf921403847c1c550ef6e0c46fcd5b73448d6bce76c0cde52f28da73a343d1a0c485fe4b7cce14fa5817de81995c997a12317cf11b0ba329f5c83992bbeab", 0x80}, {&(0x7f0000000600)="62b7fbc2962a187d02bc38bc6d86aa663711733af19bc66bc85567c6065d16558e96235ab7d559ad94c7231d78fc6b2797debecb8d1971bc5297759b160bb13c1be53587ab5f27a43137d7caae2a65f390c8e4a6fb429b79c33e3da21bc74469ac6b0dc31fb25ce5", 0x68}, {&(0x7f0000000680)="dd7fb3429db19783b37e4de8f9e1e926bd4e1af924b448e5dfc06623737aea44dc064ef0706897cdf95dcbc13e6e6ecc5690f46508cb045a853fbb4bd6918483db8e624f4fd6aadd6430751699b2ef34fcd870af6d9abcde415cfd5ec8fe963b518b0ce8fd412cba70c37e99f1e0b867c8590a98bbbf2e0336ed61b0d89aafc5e9742cfd11c4a812acefd89f02f8a9428952c80ae032468df9948de7b03be9b98a316593d2eb34edb5ecc40a1de7e4e9b0a8901a819d7242c6f0be7b5eeb18a3c1234b7aef39ffaa6cd51444a687d3bf1e657865167078a12fdb4fa038dfe3485b77dcbdbebc2f9bf4f142586f7ab631dec532164621228cb181b3bca502474664930254cccd029afc453ca5143a954adae1d20fa3a86667563120367a14f914b46ab9ab858390016e54ae82c23279f33fe8c5b5bdea1d9dd965aa73b0e6c5f87a639caa8efa1f9d90e988449d7d8e9b6fbd46d98d328f21a5a75c0338785acb6a5132aa40f603882122edddb7a465b3b6b36b5091004711a5215173dcedb3957e6800395bfbe8329cf423ba249e365298f1f6b5b03694abb5b1fb1fd1ae75d2cac7c218f4d6f692861bd4c52f710139a8f93eab90a8a368368ca9ab7629c536dc3e50cb4fbeb77e8a25d57547403bbe253f0c6410b8d1a0cd84a526f561ba721ca2ffa423c1237f711d95113c2d9578b4bd2ed88054e64718f6ae7b15dc01609816d6a55038bce8f879d71b82ab605d9cf32925ae83a25b48910c60c38c36017271bf90db30c2d724a8c895d29020aa50cf4fef3230e2b8a69f8b854d705cdfe7cfb0a95bb82cb9179ca4e815cbad096226cfaa6dadad7c823baa3d0db9f96b1b23ffe48b24b543a0f38f56e4229f1719854b575f88dbe24888466057a1e941ba04a3dbb928ce416f70e28fe14ab9092672ce08055f556e72583ff94ca82212e1fb40468c5a13f8dc2bc795d1c0e371aa3b7730b3b1b437ee837a9dc3c5ad52c5b5e23bedbd63132bb4269a8c2e918d90e6d70b8a7dc1ed6cebd6ae10f6052432513c1d29b8ca7d90a624a81f9ea344c5e4ace0d66a4e1c13ff05454d26e720aa195101c3b5429c34dd01cc62f9c6b20928315743c27a82d9b6f435069b4f2181e76d195fad2d0f315cd5b3e8974c5566ead6d50154d1f1b274480075b5d97c212c8c0dab62cbd7aae8f7fa0004a23ba41ae5f7cb7e45dd3aca5949ea5c11119d647a9b776f48a9c1bfe0bf77a304d34dee33a38cf28c0b74c0290a6bde375381d330d0daef894936f70a0892d195282a80b960c6d6c6a7a619e49276a643336dc31d5c0325fde558fa9cdd77da4491d027d5ce781b7bb99f382e000e2b8c4dc3dce5b726b639d65adc613141297963063006743c35cf09347d27038740c40ff69020320673b05ee28fa6fb4c47499e162907ec54bd64802e8cc5f65694716d0b87fda0b6ccfdd438e8c434b74f5f901ae9c5e1a9661e7929dd8877f52830a2f059f38016fb4105a8ae2c3c75425974618e4c7dd1304efb94d782cb14a20a68f7668efa9625d4430e4886852e0b2d8d3a50040d6292aae4cd58640dd701653a517abf362f87663d5712e5dcf54abaad05c68a291e1acb903ace1fa44caea476450c7f0ed34ec9b1b43c56fb9a8c888822d1c26301bda82fe9c17d5879efb17cf7da2a1518f290dd444a01f95d23b0a5593c6d8a0ab1a17f200237aa9770465fb4d00b60f22d5f1bad2f8f1223ad43a6d20e34453f0198825ea03cb9d22a6b3468aa0cbf9c0a763e7a170d094d4049ea82c49925915be122b62289f2a46f592a995770944768b640abf62197b739051ba882b8b0516b04eb58b28688fa64a12545fc25b29e0c7a492e4f7815a686b6c089c7657efed8e8adf07f5c3d327a668cc69dac75369caedea1b87fa16ab7e6cf4da4466465e541e842148dd4ab152cd8a78b52c8c2a52edec1ce24c7069db36e6283d203f9aa0a40f44b47ec77456c3c9472e0e9d74c29fded1081073b98040b611ce28063a53f7c26fd3dcbb07408aab5afdf6dc5cc945218e1bc7e5c1b2a5596ddd1f5935ed0cba79d94ec566e354d0ad4d7e5fa525b633f01c2af4d9b44934de77397527f39d3dcd639faf05a00c47903de0e35c94ace7a69a8cf8b685295b4210bd29662b11c575eaa83b09173b7ae9f219c4a8f41391d53ff00cde80129526e25e8b0c3215679d9f72fc34387c9f88e3ade668b415ec7bae3c8b273c8a8554c7061e86d15afc75653ff556a96ac50a9f96bf1af36cb3d967aa9847c197db6ce8a00329a1ddd6a67afd636db24f2574a44fd3062ba7ad0074844230ba546c16d6dfb2fe01f58bc4a461af03640a3c85603e8fe3aafb2ee2087bd2fd0bacdcae1f0b21a2548bed570db95aa4501fb71ef1679a537e84ec4ac836bd7de0242fbbabc41ff6fb162ab7dee937fc2557cd05613017cfa9b28dd8d798a37111c3b1494fef600c6e396315fa50e5ef21289a0ccf646e61c31ee1032d2d48679e223953b67dfccddf93390f7c121be3ce44a70de3624c52640f667595807a76036cdf31b2a2b4dec0e613c54fd97711347b6f95dcf18150fdece8508ec1add06e95ad72cd379dfff0da0fe0473b6f31da73052610b0d6b5eab90c6d45fa13f9f551870e9ce8bc7d2d1ededc6891e18dda7b2d42662d168e8dac8d48cff66103cf6cd750ffb9669354e122c578f42a9c530eb43e61f0c08a92a4da83460eca1a6f7c96b2dd502c0e7e7a0324b5dba38955d806b7656264ec904ea765512464d90154e9fb8547c5ee71f2b6252802e8003b7a9ce4d827ee72e4e7331d044f5313331b8ffa25a0cac863a9073247af1cfa34db1aef47ed5422ac4d0a6b367e1a662fd73a5834d5aec259957eb4dfe83488f2397d275a92dac603011154c751e3ce9917b2741d3ca8296f1e793fc45af76dcae40a2cb01247da9504e63fe044b33b5a7959d6cf521974ee2bba5bf02dd74ddcb635db63b08432ace8709a7d4ff1f46b35b525e34a2701d7a03ee70570f32b35603b89186191a090cee40edc756071907f921f90e12948a3f53a2cbbcc2aa9805ef5bafee6222ab9316cd101f42b6726d8637b44807791e58f1a3fb34b657375248726499c6b1f6b22537acf5e1365112134ff67789c16ca76f51262c482172826d99e4b585de1962f032ab97a33a264a79163b48b15e06870bbe77ea352b72d7f90f038b58475b3929b0fbe1a9c1897118929ea698fb8ae8994082481127a85e6f63bcfdf391d4745e036fb9d5614bd21e518eb7a99d5ec3db8f03e0f5e0926562d23a4350c41dbece750d867dc09318c2d5a0c101eb613f81ad090c623e453e486294b3dc3ec83df2ed779489565700619ec59607e53c5e5e7fcac8933b0490233a8982f9c8b013e25d4678fe7069814a1fe2bcd405296b48433e84386a4fcf0057f01124217358c45c8ee599c994f2dc1b2f29cd61304b921a40c7125f5da3c0e843c1b36625ae1fc5039c7455ad50c23241ef619982e3a0ebc0cb0dbfdd03e639b1c7df729b347bfc508c3c84183ff77d947b1fba2c2c8f47c2ee40696a118d603648515b89542f401f648bdb233b4227e4054b402ffc6b750eb5193f1f0add8fe8c5f56200745fee52c896a13cf6fd27b7385cdbb100d7b0849d3ad919f4a06bd40d9ed8ebd2f4acd4f81228124a64052c47efd7ffae32f3f0fe56200e44c6b75376032caf31e53415eab3c53bb9e4ccb0efa002d8202840ecfbdd187aeed3d648f24368164e73aaf4e9057ccd7fb8650d530490ba98a7dea3f5efdb1eaa231521073a7d5677ce474889b7ee12e46d6d4d12a973042efe845f6b597794f7509357376cf82fb75439ef3fe75813b9f51e1ce532d1e1299c901c12cf27acb008", 0xac0}], 0x5}, 0x841) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000043000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100c4320404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r3, 0x0, 0xfffffdef) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0xfff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 16:47:32 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000340)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84\x13\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000040)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) 16:47:32 executing program 5: socket$kcm(0x10, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000800000095000000000000002ba7e1d30c5aaa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc41056bdc17487902317142fac7e78ce74a2c75a7be168c1886d0d4d94f2f4e345c652fbc1626cca2a28d35806151ee988e6e06c8cedf7ceb9fc404000000c588b277beee1cbf9b0a4def23d410f6accd3641110bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8580218ce7400dae15cb7947c491b8bc46b8eda1868720000074e468ee23fd2f73902ebcfcf498227759800011b405b433a8acd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b56780260ed606a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad2a431ab9142f3a06d54740a4bc5e32bd378af7c9676a08e774c487e32d198e7e5bb316dfe8cd338807a6d785f895b4ec7bf48cabecead649f96ea24d32872c494160cb5d46ce680eeb80157eb23f9902519a693b85c655fa73103170cbc496d7122034385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaacc59608f4d4e6067338b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bc99473ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b4c11c58217bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a5eae871903ece51c895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f9ce91d3fdd528efe6c1dca17f45ba5e8bd311a40030d5c1ce75ffff996a80153ac677bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246df20356ae073b1df08ae2c268b0073bb99d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b939daf2a45e7c50782c7aa055dd066fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f5c635d8d646c885f820ce59ecc731deba3998c27b815f7b0acba754c01ed8bf1bbac14da8c6a2b966d861f9dd547abf817063b549adefcc925909f6d9e72e9b15e5603eb5f80b58fd76e45d249401307e3a0df2bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b96e07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac4218eeff5f2d23a430fa44c30ce84b93c97a23e6c97953faf4420638489e6a6ded6d8c414a87b652b95278e99b06dbb6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34612f6ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x200408c4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x5, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffff8ec7}, 0x10}, 0x78) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000040)=@ax25={{0x3, @bcast, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @null]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000280)="f9c51ce11851f3e2e2e399cfaa7f28ab1248144db58732e7f88757b36b86470687e2478cbcf9f67a4dc3d49cf9311aef71578bd4460760ae277c2afe29e26f2a37502b2a52b30883529d630df5eb5816a4f3977c67afdf64b54621fa51ce37b2ac13156a934ea06a47324fc69fa2d986a7ef94ca9e2738a3eb82b45f3f857e3c7c916fe5", 0x84}, {&(0x7f0000000100)}, {&(0x7f0000000400)="68cb42e091e058db671d7a61df43a80306e4ebb18ef442fbd2dd16a0a62fc23f290499bd365973c69ca3d3088289b324cf03a3040c4731ac7c28883d6f50eaf5c44bf921403847c1c550ef6e0c46fcd5b73448d6bce76c0cde52f28da73a343d1a0c485fe4b7cce14fa5817de81995c997a12317cf11b0ba329f5c83992bbeab", 0x80}, {&(0x7f0000000600)="62b7fbc2962a187d02bc38bc6d86aa663711733af19bc66bc85567c6065d16558e96235ab7d559ad94c7231d78fc6b2797debecb8d1971bc5297759b160bb13c1be53587ab5f27a43137d7caae2a65f390c8e4a6fb429b79c33e3da21bc74469ac6b0dc31fb25ce5", 0x68}, {&(0x7f0000000680)="dd7fb3429db19783b37e4de8f9e1e926bd4e1af924b448e5dfc06623737aea44dc064ef0706897cdf95dcbc13e6e6ecc5690f46508cb045a853fbb4bd6918483db8e624f4fd6aadd6430751699b2ef34fcd870af6d9abcde415cfd5ec8fe963b518b0ce8fd412cba70c37e99f1e0b867c8590a98bbbf2e0336ed61b0d89aafc5e9742cfd11c4a812acefd89f02f8a9428952c80ae032468df9948de7b03be9b98a316593d2eb34edb5ecc40a1de7e4e9b0a8901a819d7242c6f0be7b5eeb18a3c1234b7aef39ffaa6cd51444a687d3bf1e657865167078a12fdb4fa038dfe3485b77dcbdbebc2f9bf4f142586f7ab631dec532164621228cb181b3bca502474664930254cccd029afc453ca5143a954adae1d20fa3a86667563120367a14f914b46ab9ab858390016e54ae82c23279f33fe8c5b5bdea1d9dd965aa73b0e6c5f87a639caa8efa1f9d90e988449d7d8e9b6fbd46d98d328f21a5a75c0338785acb6a5132aa40f603882122edddb7a465b3b6b36b5091004711a5215173dcedb3957e6800395bfbe8329cf423ba249e365298f1f6b5b03694abb5b1fb1fd1ae75d2cac7c218f4d6f692861bd4c52f710139a8f93eab90a8a368368ca9ab7629c536dc3e50cb4fbeb77e8a25d57547403bbe253f0c6410b8d1a0cd84a526f561ba721ca2ffa423c1237f711d95113c2d9578b4bd2ed88054e64718f6ae7b15dc01609816d6a55038bce8f879d71b82ab605d9cf32925ae83a25b48910c60c38c36017271bf90db30c2d724a8c895d29020aa50cf4fef3230e2b8a69f8b854d705cdfe7cfb0a95bb82cb9179ca4e815cbad096226cfaa6dadad7c823baa3d0db9f96b1b23ffe48b24b543a0f38f56e4229f1719854b575f88dbe24888466057a1e941ba04a3dbb928ce416f70e28fe14ab9092672ce08055f556e72583ff94ca82212e1fb40468c5a13f8dc2bc795d1c0e371aa3b7730b3b1b437ee837a9dc3c5ad52c5b5e23bedbd63132bb4269a8c2e918d90e6d70b8a7dc1ed6cebd6ae10f6052432513c1d29b8ca7d90a624a81f9ea344c5e4ace0d66a4e1c13ff05454d26e720aa195101c3b5429c34dd01cc62f9c6b20928315743c27a82d9b6f435069b4f2181e76d195fad2d0f315cd5b3e8974c5566ead6d50154d1f1b274480075b5d97c212c8c0dab62cbd7aae8f7fa0004a23ba41ae5f7cb7e45dd3aca5949ea5c11119d647a9b776f48a9c1bfe0bf77a304d34dee33a38cf28c0b74c0290a6bde375381d330d0daef894936f70a0892d195282a80b960c6d6c6a7a619e49276a643336dc31d5c0325fde558fa9cdd77da4491d027d5ce781b7bb99f382e000e2b8c4dc3dce5b726b639d65adc613141297963063006743c35cf09347d27038740c40ff69020320673b05ee28fa6fb4c47499e162907ec54bd64802e8cc5f65694716d0b87fda0b6ccfdd438e8c434b74f5f901ae9c5e1a9661e7929dd8877f52830a2f059f38016fb4105a8ae2c3c75425974618e4c7dd1304efb94d782cb14a20a68f7668efa9625d4430e4886852e0b2d8d3a50040d6292aae4cd58640dd701653a517abf362f87663d5712e5dcf54abaad05c68a291e1acb903ace1fa44caea476450c7f0ed34ec9b1b43c56fb9a8c888822d1c26301bda82fe9c17d5879efb17cf7da2a1518f290dd444a01f95d23b0a5593c6d8a0ab1a17f200237aa9770465fb4d00b60f22d5f1bad2f8f1223ad43a6d20e34453f0198825ea03cb9d22a6b3468aa0cbf9c0a763e7a170d094d4049ea82c49925915be122b62289f2a46f592a995770944768b640abf62197b739051ba882b8b0516b04eb58b28688fa64a12545fc25b29e0c7a492e4f7815a686b6c089c7657efed8e8adf07f5c3d327a668cc69dac75369caedea1b87fa16ab7e6cf4da4466465e541e842148dd4ab152cd8a78b52c8c2a52edec1ce24c7069db36e6283d203f9aa0a40f44b47ec77456c3c9472e0e9d74c29fded1081073b98040b611ce28063a53f7c26fd3dcbb07408aab5afdf6dc5cc945218e1bc7e5c1b2a5596ddd1f5935ed0cba79d94ec566e354d0ad4d7e5fa525b633f01c2af4d9b44934de77397527f39d3dcd639faf05a00c47903de0e35c94ace7a69a8cf8b685295b4210bd29662b11c575eaa83b09173b7ae9f219c4a8f41391d53ff00cde80129526e25e8b0c3215679d9f72fc34387c9f88e3ade668b415ec7bae3c8b273c8a8554c7061e86d15afc75653ff556a96ac50a9f96bf1af36cb3d967aa9847c197db6ce8a00329a1ddd6a67afd636db24f2574a44fd3062ba7ad0074844230ba546c16d6dfb2fe01f58bc4a461af03640a3c85603e8fe3aafb2ee2087bd2fd0bacdcae1f0b21a2548bed570db95aa4501fb71ef1679a537e84ec4ac836bd7de0242fbbabc41ff6fb162ab7dee937fc2557cd05613017cfa9b28dd8d798a37111c3b1494fef600c6e396315fa50e5ef21289a0ccf646e61c31ee1032d2d48679e223953b67dfccddf93390f7c121be3ce44a70de3624c52640f667595807a76036cdf31b2a2b4dec0e613c54fd97711347b6f95dcf18150fdece8508ec1add06e95ad72cd379dfff0da0fe0473b6f31da73052610b0d6b5eab90c6d45fa13f9f551870e9ce8bc7d2d1ededc6891e18dda7b2d42662d168e8dac8d48cff66103cf6cd750ffb9669354e122c578f42a9c530eb43e61f0c08a92a4da83460eca1a6f7c96b2dd502c0e7e7a0324b5dba38955d806b7656264ec904ea765512464d90154e9fb8547c5ee71f2b6252802e8003b7a9ce4d827ee72e4e7331d044f5313331b8ffa25a0cac863a9073247af1cfa34db1aef47ed5422ac4d0a6b367e1a662fd73a5834d5aec259957eb4dfe83488f2397d275a92dac603011154c751e3ce9917b2741d3ca8296f1e793fc45af76dcae40a2cb01247da9504e63fe044b33b5a7959d6cf521974ee2bba5bf02dd74ddcb635db63b08432ace8709a7d4ff1f46b35b525e34a2701d7a03ee70570f32b35603b89186191a090cee40edc756071907f921f90e12948a3f53a2cbbcc2aa9805ef5bafee6222ab9316cd101f42b6726d8637b44807791e58f1a3fb34b657375248726499c6b1f6b22537acf5e1365112134ff67789c16ca76f51262c482172826d99e4b585de1962f032ab97a33a264a79163b48b15e06870bbe77ea352b72d7f90f038b58475b3929b0fbe1a9c1897118929ea698fb8ae8994082481127a85e6f63bcfdf391d4745e036fb9d5614bd21e518eb7a99d5ec3db8f03e0f5e0926562d23a4350c41dbece750d867dc09318c2d5a0c101eb613f81ad090c623e453e486294b3dc3ec83df2ed779489565700619ec59607e53c5e5e7fcac8933b0490233a8982f9c8b013e25d4678fe7069814a1fe2bcd405296b48433e84386a4fcf0057f01124217358c45c8ee599c994f2dc1b2f29cd61304b921a40c7125f5da3c0e843c1b36625ae1fc5039c7455ad50c23241ef619982e3a0ebc0cb0dbfdd03e639b1c7df729b347bfc508c3c84183ff77d947b1fba2c2c8f47c2ee40696a118d603648515b89542f401f648bdb233b4227e4054b402ffc6b750eb5193f1f0add8fe8c5f56200745fee52c896a13cf6fd27b7385cdbb100d7b0849d3ad919f4a06bd40d9ed8ebd2f4acd4f81228124a64052c47efd7ffae32f3f0fe56200e44c6b75376032caf31e53415eab3c53bb9e4ccb0efa002d8202840ecfbdd187aeed3d648f24368164e73aaf4e9057ccd7fb8650d530490ba98a7dea3f5efdb1eaa231521073a7d5677ce474889b7ee12e46d6d4d12a973042efe845f6b597794f7509357376cf82fb75439ef3fe75813b9f51e1ce532d1e1299c901c12cf27acb008", 0xac0}], 0x5}, 0x841) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000043000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100c4320404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r3, 0x0, 0xfffffdef) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0xfff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 16:47:32 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200000b000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb4ba431ca711fcd0cdfa146ec558e25e70ee25a9937f02008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318f0ec0efd49897ac804801ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb6220309900080000d760751b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7eaa49c62ba0fe52fa65f1328d6704902c9e7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7bca6b13a14f36758f57e6148ba532e6ea09c346dfebd31a0808b802000000000000ea334d8323893c5337669dd27080e71113610e10d858f8327ef01fb6c86adac12233f9a4ecdc7cec61ce63000000800117009a9ab359b4eea0c6e957673f00000000800000dbfd2e6dfe0ca0423deadd7130856f756436303767ff7f4f29e5dad9796edb697a6ea0182babc18cae2edca9590c359ea84296017a00000000c872825dfecb9010657e2b4809207e3b250cca649d5dcd6f3e2132f4a071015a3d1c5308471b9717bce11c7a33762dda6f1acf45bca757318932c9f3dcb6a532b7f2846a759fb1f9ec9960bc3b2336856d33313e154910a0e2ffc08930fbe6c7aeec24691653c60f32db2a68b1fafb83b3a13d6a0a4da8a75fe676fbeb8e5ac7c1524f7f8df6ac4c33cc9b82afaae7994b1aea29ebbc6bccedc0d2a01b2d84c45d5f4c9527533c5ac995808cf30a2353e7960700000014ab35ee8425253342c05dd6eb54683be99eaff3ebe83159342a2e0b6ba1017cc465269dee2b929fd1cf202fa4dbc6ca6b6435f55cc62cec091ce4ae610fb02839780945cb1949"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xce7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffbfffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe, 0xa00, &(0x7f0000001a80)="b9ff0300600d698cb89e14f088a8", 0x0, 0x100, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 16:47:32 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:32 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x73) sendmmsg$inet6(r0, &(0x7f0000001640)=[{{&(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x0, 0x0, @local}, 0x1c, 0x0}}], 0x2, 0x0) 16:47:32 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x0, {{0x2, 0x0, @multicast2}}}, 0x88) 16:47:32 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(r0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x80000000004) write(r2, &(0x7f00000000c0)="29000000140005b7ff000000040860eb2c01b6ff00", 0x15) r3 = socket$inet6(0xa, 0x80003, 0x6b) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c00)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000c1030000030000002004000000000000800200000000000000000000800000005003000050030000500300005003000050030000030000000000000000000000fe8000000000000000000000000000bbff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000076657468315f746f5f626f6e640000006e657470636930000000000000000000000000000000000000000000000000000000000000000000001d000000000000000000000000000000000000500280020000000001000000000000000000000000000000000000005001686173686c696d69740000000000000000000000000000000000010000027465616d5f736c6176655f3100080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000400000000000000b61a000800000000000000000000000000005800686173686c696d697400000000000000000000000000000000000000000173797a6b616c6c657231000000000000000000000000000004000000000000000000000005000000a600000000000000005f0200000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027ab666b0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000a800d0000000000000000000000000000000000700000000000000002800434c4153534946590000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000212f00000000000000000000feffffff"], 0x1) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[], 0x24}}, 0x8000) 16:47:32 executing program 3: socket$kcm(0x10, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000800000095000000000000002ba7e1d30c5aaa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc41056bdc17487902317142fac7e78ce74a2c75a7be168c1886d0d4d94f2f4e345c652fbc1626cca2a28d35806151ee988e6e06c8cedf7ceb9fc404000000c588b277beee1cbf9b0a4def23d410f6accd3641110bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8580218ce7400dae15cb7947c491b8bc46b8eda1868720000074e468ee23fd2f73902ebcfcf498227759800011b405b433a8acd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b56780260ed606a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad2a431ab9142f3a06d54740a4bc5e32bd378af7c9676a08e774c487e32d198e7e5bb316dfe8cd338807a6d785f895b4ec7bf48cabecead649f96ea24d32872c494160cb5d46ce680eeb80157eb23f9902519a693b85c655fa73103170cbc496d7122034385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaacc59608f4d4e6067338b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bc99473ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b4c11c58217bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a5eae871903ece51c895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f9ce91d3fdd528efe6c1dca17f45ba5e8bd311a40030d5c1ce75ffff996a80153ac677bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246df20356ae073b1df08ae2c268b0073bb99d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b939daf2a45e7c50782c7aa055dd066fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f5c635d8d646c885f820ce59ecc731deba3998c27b815f7b0acba754c01ed8bf1bbac14da8c6a2b966d861f9dd547abf817063b549adefcc925909f6d9e72e9b15e5603eb5f80b58fd76e45d249401307e3a0df2bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b96e07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac4218eeff5f2d23a430fa44c30ce84b93c97a23e6c97953faf4420638489e6a6ded6d8c414a87b652b95278e99b06dbb6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34612f6ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x200408c4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x5, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffff8ec7}, 0x10}, 0x78) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000040)=@ax25={{0x3, @bcast, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @null]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000280)="f9c51ce11851f3e2e2e399cfaa7f28ab1248144db58732e7f88757b36b86470687e2478cbcf9f67a4dc3d49cf9311aef71578bd4460760ae277c2afe29e26f2a37502b2a52b30883529d630df5eb5816a4f3977c67afdf64b54621fa51ce37b2ac13156a934ea06a47324fc69fa2d986a7ef94ca9e2738a3eb82b45f3f857e3c7c916fe5", 0x84}, {&(0x7f0000000100)}, {&(0x7f0000000400)="68cb42e091e058db671d7a61df43a80306e4ebb18ef442fbd2dd16a0a62fc23f290499bd365973c69ca3d3088289b324cf03a3040c4731ac7c28883d6f50eaf5c44bf921403847c1c550ef6e0c46fcd5b73448d6bce76c0cde52f28da73a343d1a0c485fe4b7cce14fa5817de81995c997a12317cf11b0ba329f5c83992bbeab", 0x80}, {&(0x7f0000000600)="62b7fbc2962a187d02bc38bc6d86aa663711733af19bc66bc85567c6065d16558e96235ab7d559ad94c7231d78fc6b2797debecb8d1971bc5297759b160bb13c1be53587ab5f27a43137d7caae2a65f390c8e4a6fb429b79c33e3da21bc74469ac6b0dc31fb25ce5", 0x68}, {&(0x7f0000000680)="dd7fb3429db19783b37e4de8f9e1e926bd4e1af924b448e5dfc06623737aea44dc064ef0706897cdf95dcbc13e6e6ecc5690f46508cb045a853fbb4bd6918483db8e624f4fd6aadd6430751699b2ef34fcd870af6d9abcde415cfd5ec8fe963b518b0ce8fd412cba70c37e99f1e0b867c8590a98bbbf2e0336ed61b0d89aafc5e9742cfd11c4a812acefd89f02f8a9428952c80ae032468df9948de7b03be9b98a316593d2eb34edb5ecc40a1de7e4e9b0a8901a819d7242c6f0be7b5eeb18a3c1234b7aef39ffaa6cd51444a687d3bf1e657865167078a12fdb4fa038dfe3485b77dcbdbebc2f9bf4f142586f7ab631dec532164621228cb181b3bca502474664930254cccd029afc453ca5143a954adae1d20fa3a86667563120367a14f914b46ab9ab858390016e54ae82c23279f33fe8c5b5bdea1d9dd965aa73b0e6c5f87a639caa8efa1f9d90e988449d7d8e9b6fbd46d98d328f21a5a75c0338785acb6a5132aa40f603882122edddb7a465b3b6b36b5091004711a5215173dcedb3957e6800395bfbe8329cf423ba249e365298f1f6b5b03694abb5b1fb1fd1ae75d2cac7c218f4d6f692861bd4c52f710139a8f93eab90a8a368368ca9ab7629c536dc3e50cb4fbeb77e8a25d57547403bbe253f0c6410b8d1a0cd84a526f561ba721ca2ffa423c1237f711d95113c2d9578b4bd2ed88054e64718f6ae7b15dc01609816d6a55038bce8f879d71b82ab605d9cf32925ae83a25b48910c60c38c36017271bf90db30c2d724a8c895d29020aa50cf4fef3230e2b8a69f8b854d705cdfe7cfb0a95bb82cb9179ca4e815cbad096226cfaa6dadad7c823baa3d0db9f96b1b23ffe48b24b543a0f38f56e4229f1719854b575f88dbe24888466057a1e941ba04a3dbb928ce416f70e28fe14ab9092672ce08055f556e72583ff94ca82212e1fb40468c5a13f8dc2bc795d1c0e371aa3b7730b3b1b437ee837a9dc3c5ad52c5b5e23bedbd63132bb4269a8c2e918d90e6d70b8a7dc1ed6cebd6ae10f6052432513c1d29b8ca7d90a624a81f9ea344c5e4ace0d66a4e1c13ff05454d26e720aa195101c3b5429c34dd01cc62f9c6b20928315743c27a82d9b6f435069b4f2181e76d195fad2d0f315cd5b3e8974c5566ead6d50154d1f1b274480075b5d97c212c8c0dab62cbd7aae8f7fa0004a23ba41ae5f7cb7e45dd3aca5949ea5c11119d647a9b776f48a9c1bfe0bf77a304d34dee33a38cf28c0b74c0290a6bde375381d330d0daef894936f70a0892d195282a80b960c6d6c6a7a619e49276a643336dc31d5c0325fde558fa9cdd77da4491d027d5ce781b7bb99f382e000e2b8c4dc3dce5b726b639d65adc613141297963063006743c35cf09347d27038740c40ff69020320673b05ee28fa6fb4c47499e162907ec54bd64802e8cc5f65694716d0b87fda0b6ccfdd438e8c434b74f5f901ae9c5e1a9661e7929dd8877f52830a2f059f38016fb4105a8ae2c3c75425974618e4c7dd1304efb94d782cb14a20a68f7668efa9625d4430e4886852e0b2d8d3a50040d6292aae4cd58640dd701653a517abf362f87663d5712e5dcf54abaad05c68a291e1acb903ace1fa44caea476450c7f0ed34ec9b1b43c56fb9a8c888822d1c26301bda82fe9c17d5879efb17cf7da2a1518f290dd444a01f95d23b0a5593c6d8a0ab1a17f200237aa9770465fb4d00b60f22d5f1bad2f8f1223ad43a6d20e34453f0198825ea03cb9d22a6b3468aa0cbf9c0a763e7a170d094d4049ea82c49925915be122b62289f2a46f592a995770944768b640abf62197b739051ba882b8b0516b04eb58b28688fa64a12545fc25b29e0c7a492e4f7815a686b6c089c7657efed8e8adf07f5c3d327a668cc69dac75369caedea1b87fa16ab7e6cf4da4466465e541e842148dd4ab152cd8a78b52c8c2a52edec1ce24c7069db36e6283d203f9aa0a40f44b47ec77456c3c9472e0e9d74c29fded1081073b98040b611ce28063a53f7c26fd3dcbb07408aab5afdf6dc5cc945218e1bc7e5c1b2a5596ddd1f5935ed0cba79d94ec566e354d0ad4d7e5fa525b633f01c2af4d9b44934de77397527f39d3dcd639faf05a00c47903de0e35c94ace7a69a8cf8b685295b4210bd29662b11c575eaa83b09173b7ae9f219c4a8f41391d53ff00cde80129526e25e8b0c3215679d9f72fc34387c9f88e3ade668b415ec7bae3c8b273c8a8554c7061e86d15afc75653ff556a96ac50a9f96bf1af36cb3d967aa9847c197db6ce8a00329a1ddd6a67afd636db24f2574a44fd3062ba7ad0074844230ba546c16d6dfb2fe01f58bc4a461af03640a3c85603e8fe3aafb2ee2087bd2fd0bacdcae1f0b21a2548bed570db95aa4501fb71ef1679a537e84ec4ac836bd7de0242fbbabc41ff6fb162ab7dee937fc2557cd05613017cfa9b28dd8d798a37111c3b1494fef600c6e396315fa50e5ef21289a0ccf646e61c31ee1032d2d48679e223953b67dfccddf93390f7c121be3ce44a70de3624c52640f667595807a76036cdf31b2a2b4dec0e613c54fd97711347b6f95dcf18150fdece8508ec1add06e95ad72cd379dfff0da0fe0473b6f31da73052610b0d6b5eab90c6d45fa13f9f551870e9ce8bc7d2d1ededc6891e18dda7b2d42662d168e8dac8d48cff66103cf6cd750ffb9669354e122c578f42a9c530eb43e61f0c08a92a4da83460eca1a6f7c96b2dd502c0e7e7a0324b5dba38955d806b7656264ec904ea765512464d90154e9fb8547c5ee71f2b6252802e8003b7a9ce4d827ee72e4e7331d044f5313331b8ffa25a0cac863a9073247af1cfa34db1aef47ed5422ac4d0a6b367e1a662fd73a5834d5aec259957eb4dfe83488f2397d275a92dac603011154c751e3ce9917b2741d3ca8296f1e793fc45af76dcae40a2cb01247da9504e63fe044b33b5a7959d6cf521974ee2bba5bf02dd74ddcb635db63b08432ace8709a7d4ff1f46b35b525e34a2701d7a03ee70570f32b35603b89186191a090cee40edc756071907f921f90e12948a3f53a2cbbcc2aa9805ef5bafee6222ab9316cd101f42b6726d8637b44807791e58f1a3fb34b657375248726499c6b1f6b22537acf5e1365112134ff67789c16ca76f51262c482172826d99e4b585de1962f032ab97a33a264a79163b48b15e06870bbe77ea352b72d7f90f038b58475b3929b0fbe1a9c1897118929ea698fb8ae8994082481127a85e6f63bcfdf391d4745e036fb9d5614bd21e518eb7a99d5ec3db8f03e0f5e0926562d23a4350c41dbece750d867dc09318c2d5a0c101eb613f81ad090c623e453e486294b3dc3ec83df2ed779489565700619ec59607e53c5e5e7fcac8933b0490233a8982f9c8b013e25d4678fe7069814a1fe2bcd405296b48433e84386a4fcf0057f01124217358c45c8ee599c994f2dc1b2f29cd61304b921a40c7125f5da3c0e843c1b36625ae1fc5039c7455ad50c23241ef619982e3a0ebc0cb0dbfdd03e639b1c7df729b347bfc508c3c84183ff77d947b1fba2c2c8f47c2ee40696a118d603648515b89542f401f648bdb233b4227e4054b402ffc6b750eb5193f1f0add8fe8c5f56200745fee52c896a13cf6fd27b7385cdbb100d7b0849d3ad919f4a06bd40d9ed8ebd2f4acd4f81228124a64052c47efd7ffae32f3f0fe56200e44c6b75376032caf31e53415eab3c53bb9e4ccb0efa002d8202840ecfbdd187aeed3d648f24368164e73aaf4e9057ccd7fb8650d530490ba98a7dea3f5efdb1eaa231521073a7d5677ce474889b7ee12e46d6d4d12a973042efe845f6b597794f7509357376cf82fb75439ef3fe75813b9f51e1ce532d1e1299c901c12cf27acb008", 0xac0}], 0x5}, 0x841) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000043000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100c4320404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r3, 0x0, 0xfffffdef) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0xfff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 16:47:32 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'ipvlan1\x00', &(0x7f0000000000)=@ethtool_drvinfo={0x3, "1b5b51ec77d20b4f9e47ca74112f102378d1757a2ed05e976eeec4fd95b24cad", "ec74389cb2b53486eeea240ce1e37f59536016360544b29678a9fe20ec2ccb49", "aa042a64b216b7c51e09c06ce4fdc6b66b17813e988802e6c9b004f5a6373994", "3df56840c3f1356dc491344d33f5178fa1d43eb7973e549b66fa1513ba703b08", "3f45ef2ec088fd26e144c1e07f3761f5fb481322cc6567d2c0cdb21ef95a39ad", "a3b25a55d9a20f6f8bca737f"}}) 16:47:32 executing program 5: r0 = socket$inet(0x2, 0x3, 0x5) setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB='M'], 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000080)=0xc) r2 = socket(0x10, 0x80802, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x50, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x0, 0xe}}, [@filter_kind_options=@f_rsvp6={{0xa, 0x1, 'rsvp6\x00'}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @mcast1}]}}, @TCA_RATE={0x6}]}, 0x50}}, 0x0) [ 317.303079][T13022] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 317.304977][ T12] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 317.475680][ T12] usb 2-1: Using ep0 maxpacket: 16 [ 317.593590][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 317.610775][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 317.627326][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 317.637759][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 317.666723][ T12] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 317.688095][ T12] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.699754][ T12] usb 2-1: config 0 descriptor?? [ 317.747097][ T12] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 317.769486][ T12] scsi host1: usb-storage 2-1:0.0 [ 318.803512][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 318.813749][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 318.824986][ T256] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 318.833602][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 319.066356][ T5289] usb 2-1: USB disconnect, device number 15 [ 319.092730][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 319.135636][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:47:35 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:35 executing program 3: socket$kcm(0x10, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000800000095000000000000002ba7e1d30c5aaa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc41056bdc17487902317142fac7e78ce74a2c75a7be168c1886d0d4d94f2f4e345c652fbc1626cca2a28d35806151ee988e6e06c8cedf7ceb9fc404000000c588b277beee1cbf9b0a4def23d410f6accd3641110bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8580218ce7400dae15cb7947c491b8bc46b8eda1868720000074e468ee23fd2f73902ebcfcf498227759800011b405b433a8acd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b56780260ed606a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad2a431ab9142f3a06d54740a4bc5e32bd378af7c9676a08e774c487e32d198e7e5bb316dfe8cd338807a6d785f895b4ec7bf48cabecead649f96ea24d32872c494160cb5d46ce680eeb80157eb23f9902519a693b85c655fa73103170cbc496d7122034385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaacc59608f4d4e6067338b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bc99473ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b4c11c58217bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a5eae871903ece51c895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f9ce91d3fdd528efe6c1dca17f45ba5e8bd311a40030d5c1ce75ffff996a80153ac677bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246df20356ae073b1df08ae2c268b0073bb99d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b939daf2a45e7c50782c7aa055dd066fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f5c635d8d646c885f820ce59ecc731deba3998c27b815f7b0acba754c01ed8bf1bbac14da8c6a2b966d861f9dd547abf817063b549adefcc925909f6d9e72e9b15e5603eb5f80b58fd76e45d249401307e3a0df2bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b96e07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac4218eeff5f2d23a430fa44c30ce84b93c97a23e6c97953faf4420638489e6a6ded6d8c414a87b652b95278e99b06dbb6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34612f6ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x200408c4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x5, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffff8ec7}, 0x10}, 0x78) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000040)=@ax25={{0x3, @bcast, 0x4}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @null]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000280)="f9c51ce11851f3e2e2e399cfaa7f28ab1248144db58732e7f88757b36b86470687e2478cbcf9f67a4dc3d49cf9311aef71578bd4460760ae277c2afe29e26f2a37502b2a52b30883529d630df5eb5816a4f3977c67afdf64b54621fa51ce37b2ac13156a934ea06a47324fc69fa2d986a7ef94ca9e2738a3eb82b45f3f857e3c7c916fe5", 0x84}, {&(0x7f0000000100)}, {&(0x7f0000000400)="68cb42e091e058db671d7a61df43a80306e4ebb18ef442fbd2dd16a0a62fc23f290499bd365973c69ca3d3088289b324cf03a3040c4731ac7c28883d6f50eaf5c44bf921403847c1c550ef6e0c46fcd5b73448d6bce76c0cde52f28da73a343d1a0c485fe4b7cce14fa5817de81995c997a12317cf11b0ba329f5c83992bbeab", 0x80}, {&(0x7f0000000600)="62b7fbc2962a187d02bc38bc6d86aa663711733af19bc66bc85567c6065d16558e96235ab7d559ad94c7231d78fc6b2797debecb8d1971bc5297759b160bb13c1be53587ab5f27a43137d7caae2a65f390c8e4a6fb429b79c33e3da21bc74469ac6b0dc31fb25ce5", 0x68}, {&(0x7f0000000680)="dd7fb3429db19783b37e4de8f9e1e926bd4e1af924b448e5dfc06623737aea44dc064ef0706897cdf95dcbc13e6e6ecc5690f46508cb045a853fbb4bd6918483db8e624f4fd6aadd6430751699b2ef34fcd870af6d9abcde415cfd5ec8fe963b518b0ce8fd412cba70c37e99f1e0b867c8590a98bbbf2e0336ed61b0d89aafc5e9742cfd11c4a812acefd89f02f8a9428952c80ae032468df9948de7b03be9b98a316593d2eb34edb5ecc40a1de7e4e9b0a8901a819d7242c6f0be7b5eeb18a3c1234b7aef39ffaa6cd51444a687d3bf1e657865167078a12fdb4fa038dfe3485b77dcbdbebc2f9bf4f142586f7ab631dec532164621228cb181b3bca502474664930254cccd029afc453ca5143a954adae1d20fa3a86667563120367a14f914b46ab9ab858390016e54ae82c23279f33fe8c5b5bdea1d9dd965aa73b0e6c5f87a639caa8efa1f9d90e988449d7d8e9b6fbd46d98d328f21a5a75c0338785acb6a5132aa40f603882122edddb7a465b3b6b36b5091004711a5215173dcedb3957e6800395bfbe8329cf423ba249e365298f1f6b5b03694abb5b1fb1fd1ae75d2cac7c218f4d6f692861bd4c52f710139a8f93eab90a8a368368ca9ab7629c536dc3e50cb4fbeb77e8a25d57547403bbe253f0c6410b8d1a0cd84a526f561ba721ca2ffa423c1237f711d95113c2d9578b4bd2ed88054e64718f6ae7b15dc01609816d6a55038bce8f879d71b82ab605d9cf32925ae83a25b48910c60c38c36017271bf90db30c2d724a8c895d29020aa50cf4fef3230e2b8a69f8b854d705cdfe7cfb0a95bb82cb9179ca4e815cbad096226cfaa6dadad7c823baa3d0db9f96b1b23ffe48b24b543a0f38f56e4229f1719854b575f88dbe24888466057a1e941ba04a3dbb928ce416f70e28fe14ab9092672ce08055f556e72583ff94ca82212e1fb40468c5a13f8dc2bc795d1c0e371aa3b7730b3b1b437ee837a9dc3c5ad52c5b5e23bedbd63132bb4269a8c2e918d90e6d70b8a7dc1ed6cebd6ae10f6052432513c1d29b8ca7d90a624a81f9ea344c5e4ace0d66a4e1c13ff05454d26e720aa195101c3b5429c34dd01cc62f9c6b20928315743c27a82d9b6f435069b4f2181e76d195fad2d0f315cd5b3e8974c5566ead6d50154d1f1b274480075b5d97c212c8c0dab62cbd7aae8f7fa0004a23ba41ae5f7cb7e45dd3aca5949ea5c11119d647a9b776f48a9c1bfe0bf77a304d34dee33a38cf28c0b74c0290a6bde375381d330d0daef894936f70a0892d195282a80b960c6d6c6a7a619e49276a643336dc31d5c0325fde558fa9cdd77da4491d027d5ce781b7bb99f382e000e2b8c4dc3dce5b726b639d65adc613141297963063006743c35cf09347d27038740c40ff69020320673b05ee28fa6fb4c47499e162907ec54bd64802e8cc5f65694716d0b87fda0b6ccfdd438e8c434b74f5f901ae9c5e1a9661e7929dd8877f52830a2f059f38016fb4105a8ae2c3c75425974618e4c7dd1304efb94d782cb14a20a68f7668efa9625d4430e4886852e0b2d8d3a50040d6292aae4cd58640dd701653a517abf362f87663d5712e5dcf54abaad05c68a291e1acb903ace1fa44caea476450c7f0ed34ec9b1b43c56fb9a8c888822d1c26301bda82fe9c17d5879efb17cf7da2a1518f290dd444a01f95d23b0a5593c6d8a0ab1a17f200237aa9770465fb4d00b60f22d5f1bad2f8f1223ad43a6d20e34453f0198825ea03cb9d22a6b3468aa0cbf9c0a763e7a170d094d4049ea82c49925915be122b62289f2a46f592a995770944768b640abf62197b739051ba882b8b0516b04eb58b28688fa64a12545fc25b29e0c7a492e4f7815a686b6c089c7657efed8e8adf07f5c3d327a668cc69dac75369caedea1b87fa16ab7e6cf4da4466465e541e842148dd4ab152cd8a78b52c8c2a52edec1ce24c7069db36e6283d203f9aa0a40f44b47ec77456c3c9472e0e9d74c29fded1081073b98040b611ce28063a53f7c26fd3dcbb07408aab5afdf6dc5cc945218e1bc7e5c1b2a5596ddd1f5935ed0cba79d94ec566e354d0ad4d7e5fa525b633f01c2af4d9b44934de77397527f39d3dcd639faf05a00c47903de0e35c94ace7a69a8cf8b685295b4210bd29662b11c575eaa83b09173b7ae9f219c4a8f41391d53ff00cde80129526e25e8b0c3215679d9f72fc34387c9f88e3ade668b415ec7bae3c8b273c8a8554c7061e86d15afc75653ff556a96ac50a9f96bf1af36cb3d967aa9847c197db6ce8a00329a1ddd6a67afd636db24f2574a44fd3062ba7ad0074844230ba546c16d6dfb2fe01f58bc4a461af03640a3c85603e8fe3aafb2ee2087bd2fd0bacdcae1f0b21a2548bed570db95aa4501fb71ef1679a537e84ec4ac836bd7de0242fbbabc41ff6fb162ab7dee937fc2557cd05613017cfa9b28dd8d798a37111c3b1494fef600c6e396315fa50e5ef21289a0ccf646e61c31ee1032d2d48679e223953b67dfccddf93390f7c121be3ce44a70de3624c52640f667595807a76036cdf31b2a2b4dec0e613c54fd97711347b6f95dcf18150fdece8508ec1add06e95ad72cd379dfff0da0fe0473b6f31da73052610b0d6b5eab90c6d45fa13f9f551870e9ce8bc7d2d1ededc6891e18dda7b2d42662d168e8dac8d48cff66103cf6cd750ffb9669354e122c578f42a9c530eb43e61f0c08a92a4da83460eca1a6f7c96b2dd502c0e7e7a0324b5dba38955d806b7656264ec904ea765512464d90154e9fb8547c5ee71f2b6252802e8003b7a9ce4d827ee72e4e7331d044f5313331b8ffa25a0cac863a9073247af1cfa34db1aef47ed5422ac4d0a6b367e1a662fd73a5834d5aec259957eb4dfe83488f2397d275a92dac603011154c751e3ce9917b2741d3ca8296f1e793fc45af76dcae40a2cb01247da9504e63fe044b33b5a7959d6cf521974ee2bba5bf02dd74ddcb635db63b08432ace8709a7d4ff1f46b35b525e34a2701d7a03ee70570f32b35603b89186191a090cee40edc756071907f921f90e12948a3f53a2cbbcc2aa9805ef5bafee6222ab9316cd101f42b6726d8637b44807791e58f1a3fb34b657375248726499c6b1f6b22537acf5e1365112134ff67789c16ca76f51262c482172826d99e4b585de1962f032ab97a33a264a79163b48b15e06870bbe77ea352b72d7f90f038b58475b3929b0fbe1a9c1897118929ea698fb8ae8994082481127a85e6f63bcfdf391d4745e036fb9d5614bd21e518eb7a99d5ec3db8f03e0f5e0926562d23a4350c41dbece750d867dc09318c2d5a0c101eb613f81ad090c623e453e486294b3dc3ec83df2ed779489565700619ec59607e53c5e5e7fcac8933b0490233a8982f9c8b013e25d4678fe7069814a1fe2bcd405296b48433e84386a4fcf0057f01124217358c45c8ee599c994f2dc1b2f29cd61304b921a40c7125f5da3c0e843c1b36625ae1fc5039c7455ad50c23241ef619982e3a0ebc0cb0dbfdd03e639b1c7df729b347bfc508c3c84183ff77d947b1fba2c2c8f47c2ee40696a118d603648515b89542f401f648bdb233b4227e4054b402ffc6b750eb5193f1f0add8fe8c5f56200745fee52c896a13cf6fd27b7385cdbb100d7b0849d3ad919f4a06bd40d9ed8ebd2f4acd4f81228124a64052c47efd7ffae32f3f0fe56200e44c6b75376032caf31e53415eab3c53bb9e4ccb0efa002d8202840ecfbdd187aeed3d648f24368164e73aaf4e9057ccd7fb8650d530490ba98a7dea3f5efdb1eaa231521073a7d5677ce474889b7ee12e46d6d4d12a973042efe845f6b597794f7509357376cf82fb75439ef3fe75813b9f51e1ce532d1e1299c901c12cf27acb008", 0xac0}], 0x5}, 0x841) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000043000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100c4320404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r3, 0x0, 0xfffffdef) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0xfff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 16:47:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="5500000018007f5f00fe01b2a4a28093020600f2ffff7f01020b00000a0012000200280014000000190005407fffffff0022de1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d400", 0x55}], 0x1}, 0x0) 16:47:35 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup(r1, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000040), 0x12) 16:47:35 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_int(r0, &(0x7f0000000140), 0x12) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000080)={'gretap0\x00', @broadcast}) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)=@l2tp={0x2, 0x0, @remote}, 0x80, 0x0}, 0x0) r1 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x42, &(0x7f0000000000), 0x58) 16:47:35 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:35 executing program 4: recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000380)=@ax25={{0x3, @bcast}, [@null, @netrom, @remote, @rose, @null, @rose, @netrom, @null]}, 0x80, 0x0, 0x0, &(0x7f0000000540)}, 0x2002) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000100), 0x12) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = socket$kcm(0x2, 0x2000000000003, 0x2) sendmsg$inet(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0}, 0x2000c008) sendmsg$inet(r1, &(0x7f0000000040)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f00000002c0)}, 0x0) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000480)=ANY=[@ANYBLOB="aa5ca39c047740ce8cc4"], 0xda00) r3 = openat$cgroup(r2, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r3, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r4, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c00)=ANY=[@ANYRES64=0x0, @ANYRES64=r5, @ANYRESHEX, @ANYBLOB, @ANYBLOB, @ANYRES64], 0x3a}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100000004040000f3007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487509101cba12c07d57d995b61e89a4530f923062242b416ae9eeefc0e9c60ebab1c17682dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69b25f2a2b7b96b0d0b4af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8674c644dca3286551d8efa6256f1fe50917b2c6b05e6001c29d7ca47dc62a087cc7f0e053927bc50e40a369aba3b08f0a8620c4d29eff8408ea28a6cb9fc8e7d360fced56ead5fa0c52f90bafb888e01aa8d5d70cf2ec06edc22ca72157000b8beb850e2007f6118f6df8235d0fe1428c367c2d625414413dc04d025d4a6b727e1cd4bd9c6e123e37c81956901005352068bc40073b07ebe8e7023fb0ce22c76445275d13012e6d6e8304744704a88401b58461f89c9de98bbb0b91f080a0a6c0880e71efc8444c7a0bafa52c316250c709216f24d9e8ceb6ef708d56be4548dc36a359f0753174b766e0cfd836d81f7a18e02999483fc914f98eed61b12d87de304d73f4551301a24652a2c539c24af27a773bc206164fdda25bc2866f5fb64ed65afeefcc34c56040bf4c1315da2b2cbd54e4061eeef8aa908eae11a97af000000008b335accc588a66ce3155c7d14504a2c8e7f8ec8dd6ef48546127593b8b230c2496951629d7aab90cb7821e8aa04d014e935b4a10d5d8a4dc4ad752968981692612a6f7c93df32ea63b18ce9c3faa3e82ce9ce755b8127329495faaeeaafeb8a06db79334b94c06e9c58bf51d551471ad77c4db23ac9a11fa42a3df2e91155d8c4c72cdbbbc08ca1b02c9c7869129f3335c0d88ba0455e75520a583fb71fea463a3d3c88b0d4b07fb65c658ab8181e11ea9ed4430cac9da320b7228229778b93e30ebcdfc9e7abf1fbb8ec146b0f8c40e06f93b310f44b64b47cd6e1d989736ec9dbc08836a7d7d4f1a422c9ec3fb9346a59f80bc6403ed89a47373534822c3eedc3566062aaac6aac8e6fa89e950b0a175737eb8fd5b1a60a3b07cc11669c14245ec90000000000000000002e4936d62ea967806def9c0f660e31ae510324f291619c9774012dc25becb0580b7769a045cf5d5247304b7bef6a670e9f210e767dd6b642f6471210b923195f440450d89b2087798b86eeb92c95ce2917bd53d85587119c428c622335f7b720c5a2421ce526130214eaefbf157ffe18019629ee2fa725b1ffadad6b9031cb77bbd70891225b374e1f685b69422f75ac59a5faece0bd56224de22a36e67399ac7ec683ef9754e545aa0d6dc13fca61a5e529db342b6b7c21ea0b27a2ac0203ad6ceca4e21ae99beccd9d8a1d88cd1c9285f9489f3ee4b851a2b09ca3864fb4db860a3ad8ae30e486f416223c3e73ccef12ff664eb3660c2756bc5981883f5ccbdea1e280d2cd8dd22316eb41b5374909088016b4616d517f38121f272ac596b1b876322b6e78efda249db1de2b52afe02d16de1dc2ed869dcfdf860ac73cf8ac1be479b1267fdf893285343a511aba95ab0bd168dbf5775a1b1b56c55e0d10a8b837fb0000000067eb8c47958d2911e21570491b874afc2a2d54ad7e0492d94f3931b625e4926be5ef329b285c2a7545"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x18000000000002a0, 0xe80, 0xff000000, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141440e0", 0x0, 0x9}, 0x28) [ 319.654827][T13117] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 319.663620][T13116] sock: sock_set_timeout: `syz-executor.5' (pid 13116) tries to set negative timeout [ 319.676668][T13117] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.2'. 16:47:35 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x11b, 0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x11) r1 = socket$kcm(0xa, 0x2, 0x11) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$inet(r1, &(0x7f0000000740)={&(0x7f00000001c0)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000005c0)="57c069cff14393ae267200a3f835646d56231e9e49135e98d556ae68e805988b4c803193986c42eb468818addd40419f8a6db75337ee06d9b9e2be4b05a0efae13ccb0808b04108116334a984f3349e9dd0b4854ce76d5d994cb9f2090f8a182d9a3640e37a1adbe565fe58d5229e1fe6ff01f3328568127cca4e47b6d0b9e4e05aa813afc4ce5603abb18c871ab0e5f1a2f52c4e03ba3f961de59eb6539aa4c6a09a9eb67284eb1c836c3fd976a", 0xae}, {&(0x7f00000007c0)="bdc72976885c3850e499e7ba08567121bdfd6a8cfa6c83ecfc76160c0c757863322d17e60f0e19b8b748d322edc19e6d67ffda1b1df462089d3e61f4073f3e9b84a5768c7d5453efc5e0b4d6a5fa4f7b6c450c6ddc05db5c68ffa5680c5ae25051e3e14a7a39cef2bcc85ca47d4e8ee3534b2b5cc3aa34de9cdc5926b6d7c73cfb5d6d0cc3018ddf4a1f9e59d70d8948059ade674b285afa454f0e6d084d2f1ec90b5cf4b1e998632f5669ab8ee05d82a7530b8584eaf2de4b4fe26d937fa8ce7019e9593035adbfcfc05f99d05d88fb75cbd5d090ac70bbe1797e674e3dbd2c", 0xe0}], 0x2}, 0x24004850) recvmsg$kcm(r2, &(0x7f0000001cc0)={&(0x7f0000004e00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, 0x0}, 0x0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000080)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @remote}}}], 0x20}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40086602, 0x400007) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xc0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=0xff, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2, 0x2}, 0x0, 0x0, &(0x7f0000000380)={0x5, 0x14, 0x2, 0x1000003}, &(0x7f0000000900)=0x246, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=0x607}}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x0, &(0x7f00000001c0), &(0x7f0000000200)='GPL\x00', 0xffff, 0x1a, &(0x7f0000000500)=""/26, 0x0, 0x0, [], r3, 0x1e, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x8, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x4, 0x1, 0xb4}, 0x10, r5, r6}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0xcd, &(0x7f0000000940), &(0x7f0000000c40)=""/205, 0xf265, 0x0, 0xef, 0x6, &(0x7f0000000b00)="22076eda896440cb4fc32acfb59f74ad410b1f1c48eb9f689755cce9249242d9b1840f1e8fa13046d9d9a860a9b2f601a3b8b8ee27d9f1ed577b4e40c0344002ab91daeff5fc387e0940293e002ab66d237349a3439ffd57df3f79d056333f7a2a61f8fc00858e0861d12f81043d575b38d2506edb0cd3f3a174413b20f262087856a6d3e88181e3ae15c6e78547574e28b7f3dd29f2bb62fb4ff29313192693ce162642e5b4749c20109eb4180c824e82e970ec832c0b61d643cb993a14e4f02fb7522f1616eba9b09661afffdf62672beefb312a0edcbd1da8553f4445f7d0e6b0c7c52b57bb7bbe8322faaf125f", &(0x7f00000003c0)="ee7f59800ef3"}, 0x40) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0xff00, 0x80fe}, 0x80, &(0x7f0000003800)=[{&(0x7f0000000180)="f4001100002b2c25e994efd18498d66205baa68754a3f5ffffff02000000000000000000000000002100000000000000", 0x30}], 0x1}, 0x0) socket$kcm(0x2b, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f00000008c0)=r7) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) 16:47:35 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup(r0, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000040), 0x12) 16:47:35 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x22040ffd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_tcp_buf(r0, 0x6, 0xb, 0x0, &(0x7f0000000100)) 16:47:35 executing program 2: 16:47:35 executing program 4: recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000380)=@ax25={{0x3, @bcast}, [@null, @netrom, @remote, @rose, @null, @rose, @netrom, @null]}, 0x80, 0x0, 0x0, &(0x7f0000000540)}, 0x2002) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000100), 0x12) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = socket$kcm(0x2, 0x2000000000003, 0x2) sendmsg$inet(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0}, 0x2000c008) sendmsg$inet(r1, &(0x7f0000000040)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f00000002c0)}, 0x0) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000480)=ANY=[@ANYBLOB="aa5ca39c047740ce8cc4"], 0xda00) r3 = openat$cgroup(r2, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r3, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r4, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c00)=ANY=[@ANYRES64=0x0, @ANYRES64=r5, @ANYRESHEX, @ANYBLOB, @ANYBLOB, @ANYRES64], 0x3a}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100000004040000f3007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487509101cba12c07d57d995b61e89a4530f923062242b416ae9eeefc0e9c60ebab1c17682dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69b25f2a2b7b96b0d0b4af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8674c644dca3286551d8efa6256f1fe50917b2c6b05e6001c29d7ca47dc62a087cc7f0e053927bc50e40a369aba3b08f0a8620c4d29eff8408ea28a6cb9fc8e7d360fced56ead5fa0c52f90bafb888e01aa8d5d70cf2ec06edc22ca72157000b8beb850e2007f6118f6df8235d0fe1428c367c2d625414413dc04d025d4a6b727e1cd4bd9c6e123e37c81956901005352068bc40073b07ebe8e7023fb0ce22c76445275d13012e6d6e8304744704a88401b58461f89c9de98bbb0b91f080a0a6c0880e71efc8444c7a0bafa52c316250c709216f24d9e8ceb6ef708d56be4548dc36a359f0753174b766e0cfd836d81f7a18e02999483fc914f98eed61b12d87de304d73f4551301a24652a2c539c24af27a773bc206164fdda25bc2866f5fb64ed65afeefcc34c56040bf4c1315da2b2cbd54e4061eeef8aa908eae11a97af000000008b335accc588a66ce3155c7d14504a2c8e7f8ec8dd6ef48546127593b8b230c2496951629d7aab90cb7821e8aa04d014e935b4a10d5d8a4dc4ad752968981692612a6f7c93df32ea63b18ce9c3faa3e82ce9ce755b8127329495faaeeaafeb8a06db79334b94c06e9c58bf51d551471ad77c4db23ac9a11fa42a3df2e91155d8c4c72cdbbbc08ca1b02c9c7869129f3335c0d88ba0455e75520a583fb71fea463a3d3c88b0d4b07fb65c658ab8181e11ea9ed4430cac9da320b7228229778b93e30ebcdfc9e7abf1fbb8ec146b0f8c40e06f93b310f44b64b47cd6e1d989736ec9dbc08836a7d7d4f1a422c9ec3fb9346a59f80bc6403ed89a47373534822c3eedc3566062aaac6aac8e6fa89e950b0a175737eb8fd5b1a60a3b07cc11669c14245ec90000000000000000002e4936d62ea967806def9c0f660e31ae510324f291619c9774012dc25becb0580b7769a045cf5d5247304b7bef6a670e9f210e767dd6b642f6471210b923195f440450d89b2087798b86eeb92c95ce2917bd53d85587119c428c622335f7b720c5a2421ce526130214eaefbf157ffe18019629ee2fa725b1ffadad6b9031cb77bbd70891225b374e1f685b69422f75ac59a5faece0bd56224de22a36e67399ac7ec683ef9754e545aa0d6dc13fca61a5e529db342b6b7c21ea0b27a2ac0203ad6ceca4e21ae99beccd9d8a1d88cd1c9285f9489f3ee4b851a2b09ca3864fb4db860a3ad8ae30e486f416223c3e73ccef12ff664eb3660c2756bc5981883f5ccbdea1e280d2cd8dd22316eb41b5374909088016b4616d517f38121f272ac596b1b876322b6e78efda249db1de2b52afe02d16de1dc2ed869dcfdf860ac73cf8ac1be479b1267fdf893285343a511aba95ab0bd168dbf5775a1b1b56c55e0d10a8b837fb0000000067eb8c47958d2911e21570491b874afc2a2d54ad7e0492d94f3931b625e4926be5ef329b285c2a7545"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x18000000000002a0, 0xe80, 0xff000000, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141440e0", 0x0, 0x9}, 0x28) [ 319.974991][T11558] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 320.083017][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 320.222793][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 320.245016][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 320.266687][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 320.287522][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 320.300673][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 320.310079][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.319343][T11558] usb 2-1: config 0 descriptor?? [ 320.363876][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 320.383359][T11558] scsi host1: usb-storage 2-1:0.0 [ 320.566635][T11558] usb 2-1: USB disconnect, device number 16 16:47:36 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:36 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:36 executing program 3: 16:47:36 executing program 2: 16:47:36 executing program 4: 16:47:36 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x11b, 0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x11) r1 = socket$kcm(0xa, 0x2, 0x11) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$inet(r1, &(0x7f0000000740)={&(0x7f00000001c0)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000005c0)="57c069cff14393ae267200a3f835646d56231e9e49135e98d556ae68e805988b4c803193986c42eb468818addd40419f8a6db75337ee06d9b9e2be4b05a0efae13ccb0808b04108116334a984f3349e9dd0b4854ce76d5d994cb9f2090f8a182d9a3640e37a1adbe565fe58d5229e1fe6ff01f3328568127cca4e47b6d0b9e4e05aa813afc4ce5603abb18c871ab0e5f1a2f52c4e03ba3f961de59eb6539aa4c6a09a9eb67284eb1c836c3fd976a", 0xae}, {&(0x7f00000007c0)="bdc72976885c3850e499e7ba08567121bdfd6a8cfa6c83ecfc76160c0c757863322d17e60f0e19b8b748d322edc19e6d67ffda1b1df462089d3e61f4073f3e9b84a5768c7d5453efc5e0b4d6a5fa4f7b6c450c6ddc05db5c68ffa5680c5ae25051e3e14a7a39cef2bcc85ca47d4e8ee3534b2b5cc3aa34de9cdc5926b6d7c73cfb5d6d0cc3018ddf4a1f9e59d70d8948059ade674b285afa454f0e6d084d2f1ec90b5cf4b1e998632f5669ab8ee05d82a7530b8584eaf2de4b4fe26d937fa8ce7019e9593035adbfcfc05f99d05d88fb75cbd5d090ac70bbe1797e674e3dbd2c", 0xe0}], 0x2}, 0x24004850) recvmsg$kcm(r2, &(0x7f0000001cc0)={&(0x7f0000004e00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, 0x0}, 0x0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000080)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @remote}}}], 0x20}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40086602, 0x400007) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xc0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=0xff, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2, 0x2}, 0x0, 0x0, &(0x7f0000000380)={0x5, 0x14, 0x2, 0x1000003}, &(0x7f0000000900)=0x246, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=0x607}}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x0, &(0x7f00000001c0), &(0x7f0000000200)='GPL\x00', 0xffff, 0x1a, &(0x7f0000000500)=""/26, 0x0, 0x0, [], r3, 0x1e, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x8, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x4, 0x1, 0xb4}, 0x10, r5, r6}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0xcd, &(0x7f0000000940), &(0x7f0000000c40)=""/205, 0xf265, 0x0, 0xef, 0x6, &(0x7f0000000b00)="22076eda896440cb4fc32acfb59f74ad410b1f1c48eb9f689755cce9249242d9b1840f1e8fa13046d9d9a860a9b2f601a3b8b8ee27d9f1ed577b4e40c0344002ab91daeff5fc387e0940293e002ab66d237349a3439ffd57df3f79d056333f7a2a61f8fc00858e0861d12f81043d575b38d2506edb0cd3f3a174413b20f262087856a6d3e88181e3ae15c6e78547574e28b7f3dd29f2bb62fb4ff29313192693ce162642e5b4749c20109eb4180c824e82e970ec832c0b61d643cb993a14e4f02fb7522f1616eba9b09661afffdf62672beefb312a0edcbd1da8553f4445f7d0e6b0c7c52b57bb7bbe8322faaf125f", &(0x7f00000003c0)="ee7f59800ef3"}, 0x40) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0xff00, 0x80fe}, 0x80, &(0x7f0000003800)=[{&(0x7f0000000180)="f4001100002b2c25e994efd18498d66205baa68754a3f5ffffff02000000000000000000000000002100000000000000", 0x30}], 0x1}, 0x0) socket$kcm(0x2b, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f00000008c0)=r7) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) 16:47:36 executing program 4: 16:47:36 executing program 3: r0 = open(&(0x7f0000000040)='./file0\x00', 0x3fc, 0x0) flock(r0, 0x6) 16:47:36 executing program 2: 16:47:36 executing program 4: 16:47:36 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000240)=0x1000, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:36 executing program 4: [ 321.462474][T11558] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 321.552512][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 321.672509][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 321.682168][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 321.712471][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 321.722231][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 321.733115][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 321.742156][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.756070][T11558] usb 2-1: config 0 descriptor?? [ 321.796040][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 321.821118][T11558] scsi host1: usb-storage 2-1:0.0 [ 321.999156][ T4957] usb 2-1: USB disconnect, device number 17 16:47:38 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:38 executing program 3: 16:47:38 executing program 2: 16:47:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000200)) 16:47:38 executing program 4: 16:47:38 executing program 5: 16:47:38 executing program 3: 16:47:38 executing program 2: 16:47:38 executing program 5: 16:47:38 executing program 4: 16:47:38 executing program 3: 16:47:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000200)) [ 322.922389][T11558] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 323.032753][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 323.172599][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 323.182261][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 323.203418][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 323.213601][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 323.223614][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 323.234050][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.243203][T11558] usb 2-1: config 0 descriptor?? [ 323.296892][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 323.304403][T11558] scsi host1: usb-storage 2-1:0.0 [ 323.496750][ T5289] usb 2-1: USB disconnect, device number 18 16:47:39 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, 0x0) 16:47:39 executing program 2: 16:47:39 executing program 4: 16:47:39 executing program 3: 16:47:39 executing program 5: 16:47:39 executing program 4: 16:47:39 executing program 2: 16:47:39 executing program 5: unshare(0x40000000) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090001007866726d000000000c00028008000100040000000a000300aa"], 0x48}}, 0x0) 16:47:39 executing program 0: 16:47:39 executing program 3: 16:47:39 executing program 2: [ 324.236371][T13276] IPVS: ftp: loaded support on port[0] = 21 [ 324.357771][T13276] IPVS: ftp: loaded support on port[0] = 21 [ 324.612275][ T29] tipc: TX() has been purged, node left! 16:47:40 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:40 executing program 4: 16:47:40 executing program 3: 16:47:40 executing program 0: 16:47:40 executing program 2: 16:47:40 executing program 5: unshare(0x40000000) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090001007866726d000000000c00028008000100040000000a000300aa"], 0x48}}, 0x0) 16:47:40 executing program 2: 16:47:40 executing program 0: 16:47:40 executing program 4: 16:47:40 executing program 3: [ 324.785765][T13338] IPVS: ftp: loaded support on port[0] = 21 16:47:40 executing program 2: 16:47:40 executing program 4: 16:47:40 executing program 2: 16:47:40 executing program 3: 16:47:40 executing program 0: 16:47:40 executing program 1: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:47:40 executing program 4: 16:47:40 executing program 5: 16:47:41 executing program 0: 16:47:41 executing program 3: 16:47:41 executing program 2: 16:47:41 executing program 4: 16:47:41 executing program 5: 16:47:41 executing program 3: 16:47:41 executing program 0: 16:47:41 executing program 2: 16:47:41 executing program 5: 16:47:41 executing program 1: r0 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:41 executing program 4: 16:47:41 executing program 0: 16:47:41 executing program 3: 16:47:41 executing program 5: 16:47:41 executing program 2: 16:47:41 executing program 0: 16:47:41 executing program 5: 16:47:41 executing program 3: 16:47:41 executing program 2: 16:47:41 executing program 4: 16:47:41 executing program 5: 16:47:42 executing program 1: r0 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:42 executing program 0: 16:47:42 executing program 3: 16:47:42 executing program 2: 16:47:42 executing program 5: 16:47:42 executing program 4: 16:47:42 executing program 0: [ 326.682134][ T29] tipc: TX() has been purged, node left! 16:47:42 executing program 2: 16:47:42 executing program 5: 16:47:42 executing program 0: 16:47:42 executing program 4: 16:47:42 executing program 3: [ 326.852106][ T29] tipc: TX() has been purged, node left! 16:47:42 executing program 1: r0 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:42 executing program 2: 16:47:42 executing program 5: 16:47:42 executing program 3: 16:47:42 executing program 4: 16:47:42 executing program 0: 16:47:43 executing program 0: 16:47:43 executing program 5: 16:47:43 executing program 3: 16:47:43 executing program 2: 16:47:43 executing program 4: 16:47:43 executing program 5: 16:47:43 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:43 executing program 0: 16:47:43 executing program 3: 16:47:43 executing program 2: 16:47:43 executing program 4: 16:47:43 executing program 5: 16:47:43 executing program 0: 16:47:43 executing program 4: 16:47:43 executing program 3: 16:47:43 executing program 5: 16:47:43 executing program 2: 16:47:43 executing program 0: [ 328.432050][ T4143] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 328.614856][ T4143] usb 2-1: device descriptor read/8, error -61 [ 328.892269][ T4143] usb 2-1: device descriptor read/8, error -61 [ 329.162017][ T4143] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 329.332295][ T4143] usb 2-1: device descriptor read/8, error -61 [ 329.602028][ T4143] usb 2-1: device descriptor read/8, error -61 [ 329.721993][ T4143] usb usb2-port1: attempt power cycle [ 330.431933][ T4143] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 330.701913][ T4143] usb 2-1: device descriptor read/64, error 18 16:47:46 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:46 executing program 4: 16:47:46 executing program 2: 16:47:46 executing program 5: 16:47:46 executing program 3: 16:47:46 executing program 0: [ 331.091891][ T4143] usb 2-1: device descriptor read/64, error 18 16:47:46 executing program 4: 16:47:46 executing program 0: 16:47:46 executing program 5: 16:47:46 executing program 3: 16:47:46 executing program 2: 16:47:47 executing program 4: [ 331.661973][ T4143] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 331.931855][ T4143] usb 2-1: device descriptor read/64, error 18 [ 332.321805][ T4143] usb 2-1: device descriptor read/64, error 18 [ 332.441892][ T4143] usb usb2-port1: unable to enumerate USB device 16:47:49 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:49 executing program 0: 16:47:49 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) 16:47:49 executing program 3: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x2000000}]}]}}, &(0x7f0000000340)=""/142, 0x32, 0x8e, 0x8}, 0x20) 16:47:49 executing program 2: 16:47:49 executing program 4: [ 334.323729][T13504] BPF: (invalid-name-offset) type_id=0 bitfield_size=0 bits_offset=0 [ 334.338607][T13506] BPF: (invalid-name-offset) type_id=0 bitfield_size=0 bits_offset=0 [ 334.355078][T13504] BPF: [ 334.360145][T13504] BPF:Invalid member name_offset:33554432 [ 334.367094][T13506] BPF: 16:47:50 executing program 4: 16:47:50 executing program 2: 16:47:50 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 334.379662][T13506] BPF:Invalid member name_offset:33554432 [ 334.396075][T13504] BPF: [ 334.396075][T13504] 16:47:50 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9f, 0x2, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x400}, 0x0, 0xffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$unix(0x1, 0x801, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$FS_IOC_GETVERSION(r2, 0x80047601, &(0x7f0000000080)) connect(r0, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4) bind$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x21c, 0x5, 0x118, 0x3e020000, 0x0, 0x118, 0x188, 0x1d0, 0x1d0, 0x188, 0x1d0, 0x3, 0x0, {[{{@ip={@multicast1=0xe0005100, @local, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0xb0, 0xd0, 0x0, {}, [@common=@unspec=@connlimit={{0x40, 'connlimit\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x278) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$addseals(0xffffffffffffffff, 0x409, 0x8) perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000580)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000043fe0000070600000ee60000bf050000000000001f650000000000006507000002000000270700004c0000001f75000000000000bf5400000000000007040000f0fff8ffad430100000000009500000000000000050000000000000095000000000000001c0a7900009d3c2792432a4fa650c512aee994a5642cb064ecd5615f3196e3359aceb768637e60bd5d2e4b5992de991371274fdff6e79fc722e25659a7c85615c1b88bc894123cfe2314e887efecdcb7381ef4932cb0dcebea6d90e9c1677fbefd35893d883a2c559b7a34db461b1974af360eace66cec40d92706d0bbcc5bf6fec345ae9606c3c1a348f9b395592c1018e5e4b41b13000c94df1f2db24c67d4c7ba9ec035883e2791a9e9dff3e8bfc7d1be000000820102b19000000000000000009095601e3a3412086dee84efd375f0645f3301f55d3b9efdfbed9b430bcf0418e100bdff1c8bcfc0c229874bc3d2418bab997c8bef9aa55841caa572ddff9220c67c9e17bee524c3dc747445763ecb0a7c2cd12bc34b0fc0271124cfb5279195f7062351edf77c71294bbfd85878726c49eb89085967722da6cb884d1afe82f7f722e38397996271700241094d272dd8b754b2dd36d44f92991a7817450bc7921dd372e621dd447b86e7ffd1bdc198deb495cac0995ca3ef6c1affb693ae366b0f11db6ee4830db4713e5ce6cac6a27e29f171b8e9f172c3db24558d77b8bf18be45c50b3fc005fa7b134dfc948f6015e0389d7f34cb9c02cf517c8ed7a9b6159c1446ef1c2ccff2bde95aa860ed9b836d6b8fcab7663d9bd8415e6f90fdb007b8f3e078e3a638c4fdb8562eb85173720c1df1147c9f5013c82fc98604bd70cd56609a6b73943748a90002d9cf81bcb1d262845762f6b0a284cc463b42492bab0f7b25895cc3ba8bf0b5e0fc018463d03a73faa13d0dd35092250bbce4f618cad2375a34c7f15c3096f300009a7031ca2ae9d00a696c9a60aad445d24374ffb060d5b8a4044f503207f98954023c06f18136fea45bcb28cf192922b70f2bb3965f30fa8686624d3a2b072f10969a978c9aa81076d85f9911136f5e4fe99e3634aa5b893100a68e8805b1f933aa86"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1}, 0x48) 16:47:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4020}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, 0x0, 0x124d207021cf01f6) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="61128c000000000061138c0000000000bf2000000000000015000000080000002d0301000000000095000000000000006916000000000000bf67000000000000350600000fff07086706000002000000070300000ee60060bf050000000000004f650000000000006507f9ff01000000070700004c0000005f75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000000500000000000000950000000000000032ed3c5be9525db67754bb12fe3054ac69a5864e764f9914953170d2d7ffffff8ecf264e0f84f9f17d3c30e3c7bdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703d6c4f6f3be4b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546c087431d7700000006e7c955cfa1f6ab689fde4de4e63ede20271a51445dc8da39e5b0ab70100010000000000d048cd6002d4519af619e3cca4d69e0dee5eb106774a8f3e6916df85aaf34c4756ad3a6d74ec88158f0200000000c8fb735fd552bdc206004aeb0743eb2dc819b6cf5c8ac86d8a297dff0445a13d0045fb3cda32a673a6bb55d8c85f21dce431e56723888fb126a163f16fb2ad9bc1172ba7cbebe174aba210d702a018f9bbec63222d0ccecac4d03723f1c932b3a6aa57f1ad2e99e0e67a993716dbf580469f62ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000004000000000000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d022cf74686e9fbe2562671cd47840a7afaab43176e65ec1118d46d1e827f3472f4445d253887a5ad103649afa17690884f8d2001e03a651bb96589a7eab04871bc47287cd313f00000000000000407d00000000000000000000c59050647802cf86f10000005f37d83f84e98a52fbbecd106425563d80bd0d0d703f37ca363f601ae899a53f6715a0a62a34b0c94cce699452050000000000000026a0f6a5480a55c22fe394ac000000000000000000000000000000437d57defb79ea6a58bc3eeed729a2f95e1d6a1fc3857ff51b1e3ee00000000000000090867f577cdde2144d9d7a3b9bc43717188cb8426286fc55fc57cc3c6de4aa67babf350709e282a4f2bf59f46e20465eae865dbfd533b1cb2d540d0490cd5248715c74b6bd0248a9a0b417bbdfb5351defc6e34a961f35939204"], &(0x7f0000000100)='GPL\x00'}, 0x48) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000480)}, {&(0x7f0000000540)="41b320344cdbaeef1679b3e0df303a6f75883804cecaf15f1bc961c408dc0895d191aa59abc8b10ddcc0b28b11162969d86c90beee97f160e60d74bc749938b1ebe2abfa482718fc889f4d332380103f5c5ca956f08ebf70f89ce98a5ad01a09b1bb1e104a1e", 0x66}], 0x2, 0x0) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(0xffffffffffffffff, 0x0, r1) r2 = dup(r0) write$cgroup_int(r2, &(0x7f0000000380), 0xffffff8d) write$P9_RSTAT(r2, 0x0, 0x47) [ 334.431298][T13506] BPF: [ 334.431298][T13506] 16:47:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/dev_snmp6\x00') fchdir(r0) syz_read_part_table(0x0, 0x0, 0x0) [ 334.614631][T13528] debugfs: Directory 'vcpu0' with parent '13524-6' already present! [ 334.691852][ T4957] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 334.904207][ T4957] usb 2-1: device descriptor read/8, error -61 [ 335.201992][ T4957] usb 2-1: device descriptor read/8, error -61 [ 335.481653][ T4957] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 335.651656][ T4957] usb 2-1: device descriptor read/8, error -61 [ 335.931659][ T4957] usb 2-1: device descriptor read/8, error -61 [ 336.051677][ T4957] usb usb2-port1: attempt power cycle [ 336.761631][ T4957] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 337.031641][ T4957] usb 2-1: device descriptor read/64, error 18 16:47:52 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:52 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:52 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0xfffffffd}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000002a00)={{0x0, 0x0, 0x80}, "ccb634842fdb71a749dc009609c90db53b2833a9609751c7d64333e5a1bf6604ab61561b356fb85ccc433fa9b8bdc8de3ce8cd2c900ca92288e8eb9483a9adb0cb7e8aed69fc63b3ab2bc00571b9ebdb5358d0a59e8950302e09c3f3ac184def6cc06288465960a729379098bda21ae44e26c66d5ae28e67c70dc506246df0cd6f4f461b7cc5ee7ca18b1bdd3e3d7ea890f6693e10fbe3e8301d173e62d088520acd2522996efa7a2b8177b8cf5c2363b3b90e0134c9f5411c21d43a2aaa7ba87fdab298f465ce8a4c32b493c9e1df097d16759701d04d6f4d9e7c5430c104489e00c3c86f21c0b3d0643fc6c04350c91f080645471c0a1cc4bbc9082f1415122cd43d6232e400000000582a33382f1466275eaad78c02e805f898507b595b857d218b5cb46e5ee0cc6d1d134faa131ed914ee80ace47092151dac778b34ebccfbbc6f87b293948e3a830b83d8e4ccc02f2885fdda6b2c098809d97c0a7ba9d8dfdd911d0e078812cb0b00000000743e119ec24db90ee2e652f6f54fd2e9ba28b48a8bc349141601b49bb7a7cb9f36894f44d2a6515679e17a645c311f0b9d175291fac8fc892e809ddfb67abfcff53edf20a5b92a596303a85043b269705109acb24d784ba4687660d022cdeae8bae3c3ef2a646c498fbc67ba7d05f6de4fa1eafa0ce8e267754ea2a8cc41a9575cef7125e3614c45b9111b3c80858baacb41ce577445a77187cd3c01fd9af18eb4fbd2823bf6ee4f35d03915cc4bd200991f1d840aaa0f13646eb216f1e720cda466895cbc19462cf1b2f95b356f2afadc39bedc311bc08818549f4de62cfe5159efb3e2a286c1bf6b84d3314a6ede0fee987664adb5d84c1275e6899fe2451830e4001386f2b460ce5e56fef0fcb26271209f67baf7bd716bae2a929fae0c9bc8f61082b61bd0f2379ee9a02f305078500108da323ca2b509240d3a69ceea0ae6f170223799514cb95d8960d363920cbe62fe42a8ec138b008c3a38e9005504559f30731fa75ad90c308325d7473bdab62933090aa6295ae231478397bb437587e09854381ce3c550a56bbae62e1232aa66bd96477ccf47c0e49392f450e2ae0d7efbdc59a90e9db3a4ee103c27446c3634d5851b2f5cbdda8202eea9962cb1091635921c0c7b5d82b20d2e6a21a9241643674d252b3b07e0c2163822f6b37ac4fb42c4227938cba5dc0f69561640146485c4f145d46b33ea68ab2b5c7ea70d2454bfd50e8541db34186d7fda1a3ca19dae068b6f3b6112419bcb74113fa6c5814b348de867dc2d0380ccd60a2be2f867c4b3800968af64817221f52308141c38802a8dd70da7cfbf922de6b6744993e2c5ce024045a1da5f8468e354cfd0074ad000c19061faf57153823087bbea0fad092abb3669bc71dac0cc30cca2e67264056e05b05cfca23b5c96a4b4b6c6e08dd971921c35a61245ed852234a6fd08708a87635072d5334a6835d6455ec133b8ba314854a44e7714147411de270ffe50fa2400e98794eb79413d7ff4a0757c53f310417afe74f0ab255bd96f1479051487684aae7271f418fcfe97beada17ebc9253b60acaebc098e1de0d0347a4f50f3708ffe83323a103247e72772e7e402d41d9ca801e98a64ae62f5f66fae8e107270bc2a5b66753c53af701e43b3a82ff3f2766a9a8eff582a3ceb303097d3ce71ba75507cb281be854a36c64013803b4afe4d742af59ba44a61bcdc9fc8c7a78e3d855f4f4a67038b68258df06314127ea37bbb94dd366a49ce522de9456b205bd8ce1d6075cf30fc361fc601c1b36736cdfa041531206c7489700729fc1add1fdfca82c6d825f6fce4e5885c7b3bc6a6fcc2f4f63fdd5bf85a01ed69ae316d3e82d50f0af7d5aa798394c581a02c52883032fa713e1761dc1c4d43b3715fc5ceb47495e5ec3c49616df41078246246cd21eafc67eb931d9ab8ff3e7a05caefdb86eac6018679f6587f11b3547b4db29e5bc232e44f0fd2306132708a4e0875663d4f5d6fb7b1b5957159a810f1ffe246e7431eee0bd4815db731af797b6ff7e41044adfe27494d1920c24c9431de2c1ac0dec2972ff12838d8000ea0b0f3c587485f35d848b8ed3b225f5e8069e29297f6f48905607e70b042b949885ccb38c5c782022957bd7e77173f04ec08cbd77b83e964a866bdd6531b98404753953b79dfab7ade922d198f42f4e74bc32a4739f003ceecd47e1e4d7b2a22855cefe8d6b305c914a586f2842b528d9c0a99020fea364baac21581b73c806ee3f8c66cb9688b48ba4b51dd3b365798b0218a2d6ce7e647e047008b11c3914e8058ab7aef3356e229cb103990e81d451a8d414692e00c350ae8f7bb3da98cf42454605d54ee5a6aac3306a3f618607c77d20337b66a54ff34aec2740b43085affa1534868cb923a35fd5d544147331c798167391d1f80e14cba30c75b0a00f6c6e382d19c9abf5204d1303370100f82e684b3c7e313f0511f62bd57502118cf0d0e7a650354214fef7a9cd22030610d0d208cbf2b4c222c9118afd7bb52576f9ccfd74d91e0e456172a15432099d1d861d79ee039b753c6707a36777b4c1f94a0136ab874cf4f531953d8098673092a85a96f5e8c526e9a965b0fd0b0e6593bd3073af4eacdf7a6b16a0301c7c7029230975ffd3ab37ca079eaa7d666ab3d8184cafe9a0d276aad10064e0d70075bedb9bc2f4267a2285d21f7171893a2c586f34bea7fc977ff173ce093713ed26f1e9450b6f88d97d8cb98b3a4d2b0435c13fdd7a7d1fc3b003adb70f833e20f63807f61f8106a53c7fa15d91ae81d3075ad22447142b007e58277b6a089467ccd557214a6212d6edda3a114a37094a29089c0fefa1a0532616018d11842c8a9d939c10cf0b14c56630f5bb40bfa8961dfda786d2860df7fea2053da65c9087daefb917aebe20e60a38b8618525e2b30987289659d163898ed3c1f29677199da9aaffe92b5f2af694844b397d4985c3fbc818750d235261e5487f243c976e7ffeb3544aeeea688c422a00d7f30562d500749f5c5d2d9dcd62e5b3296f427195b828944bf12288a10e657719e248b88aa29d13aa994f5f57d7b4cf2b8f9ab43e63061918c5dfa69ffb3a9d942724abdcf3153075abd606118d09306fa80d01917dc1c35780504b9d272e081ec0c19f7735de3e91adcd743c145e1b52612abc03a85902a638b1432bc4ce07b6f71de22c370f1a9e2620b1f77d979d6b7b8a989052f186bd426b0845a21a60eeb452385d0f4c8eb1445698cee80a90cb9184d31bc7e596bef964570505126da8491c0d3097475ef244c788ccdc2b85cc64bd26e2ab38f074d2d802a28fa0c9ecc70b792b299a7ae78f7c946d0b927cf5069f4c8bd3cb9b2040ffd71483ae5a0a22b74d94f5f78051bec70976d2a49ca12b260ffff28791184a61c8130ac9ed5790e7f6338f0329caf6786e7d963ffab59a7bb0e81c4bf7aaa081148540801a80289ba819d120378dc8138b851967503ec543a01b06161fa6757e823ddb94a7daec0e77b469950d72412022c247f82f6cff98c1143511790085d44897c1e67e8dc4ea65e95b178ec14e3548c31d389d10ed0a0a081e2054250eaff92e843723d7b9a78ece5192ce013a622eb84850d27071f2732f951642ad324bfbd54e896721791258db769a09ded32464d65e2c8ed8b0de83da06ef68a855569e76a6173cd0036e0750ea4747e015732b29b8912edb70f49516bec6aa4af3a441fb9d014ebcb4ae3569897b526da74df7d6b789eb0067b33f2783af0e2e10dfae14ae8a0622c60dd918871b1debe9adea57e6cbbc83cea984a0dd8eec542a216f0302e27877fe203eacb034c004cdf2e3facec0a55618971aa7cd266b257830a0ceaf1a3f44442719a18fa5134ce5238fbe171d5ea430dcfee0fe95cac13127bf1212b5b72264b249bb1250e52b1f4c91110d277828c9f0753054a0f5d544fdbbccc43598e7fe1e4f9600fc14c08738b4a6cce4ba390b8f14ea4e5185ff55e7516f92311169a90dd3a8f07aa6870f3469dcc84c361500357941428f175029a465e385f6930bbae9208e8fc8064e1b0d4382b85a9cfe5a4171048a4b1eb8ce44197fe22ea951a5634c77eea08b722a052ecce04188cafd4e203a4cd1ff53fde92531351c75e4d76ee1a153f699ab8a3f34566adfedef8451778ff0c4ec4f79f8afb7838e48d5ae3b58767bd0bf8e7a967ed77e174aac12784c550104a50767a828cbc80e652b0f9f4d7729ed81a672734cbc6b6a53270b2921bebdde9c2656af10e64efe1492333306c9d77704475871e28235e7659f3fb0a9f35c94656b6ca0661139a8d091faea2803f8672c7aefab4ef99108d6b3ed143df50c7e7e529c1be08f93db5c6ea3a09d872b6f7448464e17bd6e2af2259fbb86d42dc4c33e48f6b2f7a0b2b2207117c43a9077d7da6d614276d190009c29db3d469c3ec235d252301a3b60e86a50ec0f723fec79d7011e1689f1d4a2d8e7bca5f9aa399c60c0b46c4f46f29963419857ff0e7136d5b12978fde213a04feac7d789f7a9940f51a17c055ad9e73ddacc9857a563f015080a268b2878245f9374e5a3691f12bb2c7be43b8c2d4db3368ecab9fc4ffb7cbef09329327c4e8daebeae7c88099c9555fd796e8378436cae27460da76ac9f40d216b93b5f883b570c2205af4f8e607493aea9972cdcc11507471aec14e775f392c46bd2ad1c2775e21554d7b2807fb2a09eb923db92178439287bac91fcb63752bd9f7adf17f8c4ba1819c1df531a66f05602a73254d57d7e877992513efe28ada07c01f18db7b11e74818db854d1cd8282e07ab6a78ffba78723d42b0ff4a6d87f9fcfff599f4fa64d65ec4c4ebcebf528ea9bb023e4be6ba64967450c1ac942a90349c7d089999bad99a8e25c26079170dfdf3761e5b380b556752fdf8b01c95243460f6d8417f4cd023a3c41bbe5a218a08bad2c9cac2e0ecd444f4923cc05a48c57c14f84b0256c8178bfba3f865e322c946a86025fc9060017221b526d58a54e44e7068c8bd26b637d294ba43edbdd9ef22fecd32f0c8389c2bb487619ec81269b1bc79de8a9cc972b36755de0862f80fcc90fdd216ac997f3bfccf7a6e6cc556fd90e02da16550459966462112851228f6c284b3c0516a5813213d8917917a0eb7d9c58c0781dcd32d8b7f5b82f0eb4169efaad56539ea418008003cc72621c00f821e6514f76e7ebcc1029b664d168cd75c643c9597ec02cd390c321cd610fcd4ad27dd076c8f925a378e09a2472131e74e9e7ab15ef56a1166ff2fc1bc8ede8ef41248377652f1a51532cb034db05f944861282e8ebe0f101c9b1ddd71ab7bdd5caab08668da960de05552f02daa8eb7157839e35a55d688c2d05522dde105dde7f74bedd41957ab073006c8518faebe35ae4394567e5c9ac2aac34e13480167465d61a6d66ca1bc3d6fb3dd83049e97fe70b06d5456c6c2aee314cf9c8c2a8b1a1dac91c4282188d7922577e8e548cf41fc8e54e873f8af625a53427e19c8207977f47600ac5f50fa2986c4012becdb84ea1600782f9e22a5ebb888c9ad16122c6709f6ba87656987032a45b3b95f7930fa61f89bb2389d872578c73f44c47e57e9b0de16330af8fedf7c387d0083222204ffc67e06b5a5491a19e4aa07414ac2caaf61f976d0ef5e82d858f0c33a4906f3ccc1a9b494a2a45fa052fc49af552e3d5b8d05ed83d4fbeb5a6f6b1a667d1ca8906beafe4fe7ce8dea7c8161470bc0af12f4bdf4e4fc4a224a6c00", "7bfb423057423b6c54a3b74d9bec86efa596762e8f65792120b68104e5d81c02d33010204293aab0964e7a300e254880b28f4a7306366ce1c265a749f8f165d2d3ec40193cf1c69b423dfe67b0cccc34b93709bab50b1f468c6aa648101b6d3bc6eeac68bdae7dd713d75bc84fd66adda8556275b2caeae2067784f31b80d879a610fe7eb58f3ac362390272a10b09b6ef5a5e9bc749e04b9ee4a938fdda683b86030aaa01486e462c3588f60eb28cb85ce8ae0c80a351344024a59d09cfeb7131f4982fe84b3af7d9f09b4aff7ab0d3bc676c07c42f277156a540c5ed6889210cba6ad2f37907babce12e08317f68ef14a5faaffdfb7c598676d82f329eb34995a93a6070e928064bfb7ae407fb0f6ac98e4479a6a934e082876ebb9a4b4c1b3807bea5bc4e75893dbbd35f759054fa5e7ee196891c29b890eca06a5db9b300962bc92dcd5c0cf4a393baca27d9f642b9ca372ded564971a27344c6b93f7b8a69687b9e113367b909362df45b581dd4812450523e29503915828b384b537402db1905d0ca0890ac91ea8c538fa7ab6394c3bc8f43deb1c29af45f795b8754d8f8ece8b2833b4190aef937ebb616a388b4fdf7808baea8bf4155bc4cf83a9e683c47feaf84b04173d92cdd2d66b7e6fe9d98fe8eea70b1a47fdd1be0fdb8d92904b7c964a37768c5f97b1d0805322c0878f56a49e82683ffb89b5e668631038a1119a4c02d03b022a2a18fbcd93adffe0b5f599b5ae7ba1865cdd4d3d4ca365871bd5b05225b3dd785e127c1b8e4fba14975624baaa9d14985291642cb90f7d216070f4c81886b10871ed71decbf00bfc0463dbdebc241083fc6dd27fb03ae723efcfa8f7028c29d155ac1dfb23f2f2021e0960a038b5488708a3b13cd785bf105924592e6e9d9e7878fb2995e93d42791258c0c0636ea521239338445f57a7e4fd4ddf8810979f400995c0f4628bb0e1001a79ebda281cefb5441470723526a776166b42f0886bb979c1e0b22631747be9fbcb0796f9248eb5e1ff9ad3e308c0e9c17b31e243313de8150bcec076fc983625290ae84c206a9a2b31be36d6db30b83a06c91576daf3540926c1912ea5f72bf2525647f37f147483e988cc5ab10f2a38f42e795de93080018d34e849ef2bfddc51f344acc947cc6a714294106075cb44855c4b2648d2bb43147c2337f0c7710b60d47fde1f2865f4d09bb9f089669faa7ada713c88c04baaae5220a6d77008276a038a409442584155c2bfe5b6828df8553587915924443eab0a32272ba6fe629ceae0fa16ad428fa105212946b525b535969122b8ee5cc045b5e3c3734488702cb4eca7b1c68445f164fc1b325768ba0b8d1255c8a0529499da024f8d48ec7b4a5de80429b3d22d5695f9765f361c36f86b90a1c243278b1afa159a2c54fca2b5a92d0e7ce083efbab4440df68b56c14d6ccef157100e08d6a3286f622b102042b1b3a16ae05f18d8ba6b87a26a7716fa9d5a6f2111d2475a44f73c348a9f03279b2983a5d7123e1158c28aea2a9884268969c0fc60f9acfad4756497efdc6fd307c48b11d29891bb779c5bd90251cd1e411f8208493151c27449b9e13f6c3960295612b2e59d98d7eb05863de345b8799fc767c8f264c45cd4027a0a5de8a2a2ffd2ac29abb5a86b5409bf489c17f32aa561a1f2888ab45e6cf53d154b28f193f1baa1b6a54c3f3ff5e0cae7631431672f411689076292412557fe2d4050d95a44326adcc15403c1615fb15fd66d3599a8eb768ca2af0bb33fd34bef719edd075bda35d2e5d65fcf7a41bd7f1992dc3ad640bc4e767654d41d3004ff0695c0ad2794ebe10c54228948d84f06e8317b73434a1f5ad4a23fdafeebdff38c56322e81968eede6f3c1e23e380ffd2e4c0a4519ee5ac19dec1e0cd1dfcf13204fc19f0ed59a3b968c3b5b21bb50a55029d338f87e9f8e75ebbf634c9632530504b42356349e967ccd1aea9edefab90b685057e9773f5332e71acdc034e4b22bcf97bbce3c80af855ce616f0f472ffd5926e0efe161b7ee4feca248e8bfa76c9a788d7aa8370ca688d6b50186d7e93b4f593dc052e4362025fea81509cb84aff8a7e44f17fd568d148c855011b1e70ab38b61ee1d58b9f10ffff1e03988b685e390a108a92f223df225000e4591a010536c473988e83243fa61c05b33dc5020799cf81177df272c2bc67b9d028625c57b0a15dcf8d6d8c43a0edfc8b986587f3537bc96b5773c33cf208d5c4654b160fc34eadbf2358c205621ebbf7c85454e9d101a362185b3b557d96c250efc64a79f19d3e6e002caa399f62de73812d8bb5806c94ec99e98fed8eb469cec4489cca2bff418db565a068c4176fe1cb0385581e9ffb717d2d1665710873904b1f0f5abfe621259f38e1a93247ca8c559c62dc357565c38937fe0786aa41b0ea650cc886b5c9e72c8bba0bca5fef99c24eadffee65bd2217e128ff9b27d586e6caab80a8040e0c5938d7dd9595ac677b256c595debb5e18e0f3754c96b5317b2d117705163af822c958aae8380bd06217e652a06cac63e3a4538606ed601f67e2528163900fec23e06f9e5650d9d11ce45a2bd311ae5803a5a2ee047625f5c4ce83bf538fd24b4d1d4167248b538b91054bca4ecdaaa77f5063e986531890db5376df7c60be7e42e66c1a1aa51a3f255dedce04aaeb4c349e1390e5c18bbb6b29805bd2103bfef0bf4be322d69b355aec7c4f30c4a70e80c934c943aa64597f1c831d15263a9d9cc3ebb02737dda435f5e4f4f2c5ef506bfcacf7dd48d7975ed0aec8cbf7e7de46307bdd9c6e9e6d7e33d7a017cba1c0e75b3087726b4eebe948b5a1650364f34616b24101a68e80a7b98f66b2863c24a8cf8ce34b3bc8690da6afb0eb75cd9dc0d0ce4262eedf9df12399acf09290e32f2f6fe0809e3992a74b5236abde2cff4819c47885af036aeaeb914a2847df26ea796d842adca0eb8203ee0eb634ffcbb1bc97b2eef5575f7d7a54674ff5977b7b6f5a348c249a981d31159e379506328fb1935d4b47ae4c6c2c74f07c7472355e6a1298e195421dc64b2368d81986e4220d624e9fc58a4441c4a9b6938fa6f0752cf21b03af32e1890b4c79841aa09a430dea8beb2f6ae1dec56b202e305d5c2350794389935ceca1999c830ec5abcf5236a046ed0a3010a9368b06cf9446b17cde2e53c8e30b8ab10800795f0ce37d164162bcc9e8696b9c219d378a64bb7bc5177d095188df933297ae3b641498951737e91f08c7e48ec2d3d4730841d205313fb146ac0609ed4441f022174c3003abebcf2c857e98d6b7922b511c06b04e7d5aa9be2b020871d794a49ccb6927a4ba77f647de84a2189dd9c883ec719318aba431e348a327d28c8ff1597e89edba44d31a436c98f5fcaf0483b60be3f8ead6e2389a4bab66162fbeadd7808b619515ce0869e9bb675e012077f77986728a89c5fb67c4c5ba4e13c583fc4565dbf40db69416a7563bc4e6d5d69a462ec120eaa6f670df04bf453555a5e780ecaf9f42906b93e8a4d2824a8e67a12df912df6e66c6860878c69c392a925e170a923670c7c15029631865762e57303e071b63474b0ba6662e42e9871f3fb35dc502573fb1c7a4412f2d1488178ca00054640392c42ec768df5f425e719c9f6aef201936ac1d4db44b7488211be107edb90d175edb734197d469811f6d34905581f9f765309bab65ba83af2a67fb5622078dd074465b4182a6eeb0bf4c89b4f9ba0f54e87ae694d1274118f6253be2eb0f6c1de9b4b39ae2a62b9c48023a2e9537e240049b5bbd494e165001c109d61f5fb14b0e8352324589a6e962f02e2d2b795223462077e95d1b2438c8682dd2f1dde1566468eb213b41ee58f5fc740d304c6051d17d0442b78d502c71a945215bf3220d0955294c292ac298cd6df640bab4de35ecd1b4654c92bd0860e3e026eebdfa086362e3c4005c45a271c3a7db4adea25e7031d7f7d6d00f21aef23f6de3ba2126a8b8f451379e1bcead259a9a66ac23b739330a1cd298ef0878ea786b33b1a19cf76500e531c0d6259022954114d0362359c1983c2a014005a3bca4bff410fcbf0ee23aed33444db647d9a2606bbb9da5075e6663096635b18493c091f6ccbf409399c0939ada158559e648532f1c121808b8e039197a7de22f7353563546865f9bae5a86c052bfeee5a55dd43f46036bc304ca30b7e8a243c32b741b9fbf91fdc77804c08d84eeb0c8bac1ab5cdf9826297eab58ba303e9e5c78b37ff02937373409174fee1da380ea1f80c6acbd8838db11be12089189c3b9446470c62c3f67fae838792a06e0d1cde3df268cc9b108bff7798a1b3c202c77485eee0a0cfe8c0567a1b6fb9616457653d9c059935963b6134cdcf60a20655c15c6c894788c911e00ba1295983429320b488f76c6e71264b9b52a4949254d54e852d3482f347e6f6568fe6b6ceac725e2700184f7673c70d5867b1c6159d5cdd37aa3b4d0be30693625ce4368a9942221322b8116e5f6ecb0e675de0e6337a13bed350d3c3470f47cfa780d83fc9c4f6303a8d72f3dec903759bf404302ea55e0fc80dbcd1778b21f464dd7a59861904cdf6dd5ae137978ae0cd5e8ce9ce4d6039cadbac8fc81dadd198dffe5cd87a097a748b7d26a3bd28fc7619d046ea541f3f5a0255e0997bb2e44039cae7bebb4e87290ea194f858872d295954e3fa839fbb5d1046d1f1570aa19b4cc0a941628eb558e3a6a5dd00a09a958444cc288eebc7535b37ba063b8e0607607b8a3eed35355817d72ad7962d36506a552a0940c1331374c70ce4a75477eb6868eec9710fcc49cb2eb8ea5af475c3ecf7b8e98ba644f53bca51d0ff46427be19382f07fb686de04fd788f8637452f7673271227e9b8c66dc23b2dd5bec961736b434f459367d020643608e328cb824794d899f59f422f8b8d4ee4bceca258d038dfa4ac3f840673b79721fd6188250b40d561df450ded53995efa7123942a7b0fe53f6ca1e57cbcacce10539bb1632087cc8fcfaf4eddd8e3d3206ea2c1587b45df2534b9ec835e729cacc9c865efbeb3ef23e17280312507b1717fe8d335f1984ff0763faa611b09c9349931c02d3e50ba8f18fdc6a46b872a292da22599776e7ccada86f8322f23cb37c7576f26807907c5d3338c41caebcdaa8619b4d8f0d85246e78ec39bd00fe798e42eed299f2a7ba63df6feacea9b077930d50fd57d4e6c005ec9425a9e61609d42340401dc83a9d8c1cc2310259db69a7f81d87e7909b5ca42dc72a032cc43517961116e0615c0189ddab0ac5323ac1cff39a8b24916315ae82c9f5a7f020105e21554541ee5d63c81d3e9bf538faa9db56fbe6c5b95da1793e267b60ec1f8bdb58f9af20b51335f431b8536407fe3dd581343324b60419185ffe9dc50ccb29c23d43ec56cbb7474834471fa402fea17dece3d336a1849f828af696d8c163f58fc60b621b2db668d50bffa861daad1d6e26adaa01b9b29249883624211822ae7421a184f69ce48c0da19e0fa880fbd46faab97a8f16827c3045a5c9ae35fe42631b3331e2de4c2e5d692ebe3d2a2013e9385ba39ea387bee34f35fd25390681829db6a941a4976faec161c9d9248779c1b483b748d66c2870e07243af740755cc7a5e242c3a313069b75efe7774fb0faa5e15c89d6e4df31285a148bcb1c0e0711650d95b9f1ffcd013d21db24c0d3005c249135f791d645e318b1febccc0f30d50a8f34df82a802014cb8c58849ffce7c7ee11e5d5ea088f2baebb59"}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'bridge_slave_0\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x25, 0x0, 0x0, "78dee316d528"}}) clock_gettime(0x0, &(0x7f0000000080)) 16:47:52 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) socket(0x0, 0x0, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f0000006240)=[{{&(0x7f0000000180)={0xa, 0x4e20, 0x0, @remote}, 0x1c, 0x0}}], 0x1, 0x0) 16:47:52 executing program 3: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:52 executing program 2: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@var={0x1}]}, {0x0, [0x61]}}, &(0x7f0000004600)=""/210, 0x2b, 0xd2, 0x8}, 0x20) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x1) [ 337.421503][ T4957] usb 2-1: device descriptor read/64, error 18 [ 337.438084][T13569] BPF:[1] VAR a [ 337.451746][T13569] BPF:type_id=0 linkage=0 [ 337.466451][T13577] BPF:[1] VAR a [ 337.473664][T13569] BPF: [ 337.492088][T13569] BPF:Invalid type_id [ 337.496518][T13577] BPF:type_id=0 linkage=0 [ 337.512472][T13569] BPF: [ 337.512472][T13569] 16:47:53 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) [ 337.525697][T13577] BPF: 16:47:53 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000000)={0x1, 0x0, [{0x1}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000002a00)={{0x0, 0x0, 0x80}, "ccb634842fdb71a749dc009609c90db53b2833a9609751c7d64333e5a1bf6604ab61561b356fb85ccc433fa9b8bdc8de3ce8cd2c900ca92288e8eb9483a9adb0cb7e8aed69fc63b3ab2bc00571b9ebdb5358d0a59e8950302e09c3f3ac184def6cc06288465960a729379098bda21ae44e26c66d5ae28e67c70dc506246df0cd6f4f461b7cc5ee7ca18b1bdd3e3d7ea890f6693e10fbe3e8301d173e62d088520acd2522996efa7a2b8177b8cf5c2363b3b90e0134c9f5411c21d43a2aaa7ba87fdab298f465ce8a4c32b493c9e1df097d16759701d04d6f4d9e7c5430c104489e00c3c86f21c0b3d0643fc6c04350c91f080645471c0a1cc4bbc9082f1415122cd43d6232e400000000582a33382f1466275eaad78c02e805f898507b595b857d218b5cb46e5ee0cc6d1d134faa131ed914ee80ace47092151dac778b34ebccfbbc6f87b293948e3a830b83d8e4ccc02f2885fdda6b2c098809d97c0a7ba9d8dfdd911d0e078812cb0b00000000743e119ec24db90ee2e652f6f54fd2e9ba28b48a8bc349141601b49bb7a7cb9f36894f44d2a6515679e17a645c311f0b9d175291fac8fc892e809ddfb67abfcff53edf20a5b92a596303a85043b269705109acb24d784ba4687660d022cdeae8bae3c3ef2a646c498fbc67ba7d05f6de4fa1eafa0ce8e267754ea2a8cc41a9575cef7125e3614c45b9111b3c80858baacb41ce577445a77187cd3c01fd9af18eb4fbd2823bf6ee4f35d03915cc4bd200991f1d840aaa0f13646eb216f1e720cda466895cbc19462cf1b2f95b356f2afadc39bedc311bc08818549f4de62cfe5159efb3e2a286c1bf6b84d3314a6ede0fee987664adb5d84c1275e6899fe2451830e4001386f2b460ce5e56fef0fcb26271209f67baf7bd716bae2a929fae0c9bc8f61082b61bd0f2379ee9a02f305078500108da323ca2b509240d3a69ceea0ae6f170223799514cb95d8960d363920cbe62fe42a8ec138b008c3a38e9005504559f30731fa75ad90c308325d7473bdab62933090aa6295ae231478397bb437587e09854381ce3c550a56bbae62e1232aa66bd96477ccf47c0e49392f450e2ae0d7efbdc59a90e9db3a4ee103c27446c3634d5851b2f5cbdda8202eea9962cb1091635921c0c7b5d82b20d2e6a21a9241643674d252b3b07e0c2163822f6b37ac4fb42c4227938cba5dc0f69561640146485c4f145d46b33ea68ab2b5c7ea70d2454bfd50e8541db34186d7fda1a3ca19dae068b6f3b6112419bcb74113fa6c5814b348de867dc2d0380ccd60a2be2f867c4b3800968af64817221f52308141c38802a8dd70da7cfbf922de6b6744993e2c5ce024045a1da5f8468e354cfd0074ad000c19061faf57153823087bbea0fad092abb3669bc71dac0cc30cca2e67264056e05b05cfca23b5c96a4b4b6c6e08dd971921c35a61245ed852234a6fd08708a87635072d5334a6835d6455ec133b8ba314854a44e7714147411de270ffe50fa2400e98794eb79413d7ff4a0757c53f310417afe74f0ab255bd96f1479051487684aae7271f418fcfe97beada17ebc9253b60acaebc098e1de0d0347a4f50f3708ffe83323a103247e72772e7e402d41d9ca801e98a64ae62f5f66fae8e107270bc2a5b66753c53af701e43b3a82ff3f2766a9a8eff582a3ceb303097d3ce71ba75507cb281be854a36c64013803b4afe4d742af59ba44a61bcdc9fc8c7a78e3d855f4f4a67038b68258df06314127ea37bbb94dd366a49ce522de9456b205bd8ce1d6075cf30fc361fc601c1b36736cdfa041531206c7489700729fc1add1fdfca82c6d825f6fce4e5885c7b3bc6a6fcc2f4f63fdd5bf85a01ed69ae316d3e82d50f0af7d5aa798394c581a02c52883032fa713e1761dc1c4d43b3715fc5ceb47495e5ec3c49616df41078246246cd21eafc67eb931d9ab8ff3e7a05caefdb86eac6018679f6587f11b3547b4db29e5bc232e44f0fd2306132708a4e0875663d4f5d6fb7b1b5957159a810f1ffe246e7431eee0bd4815db731af797b6ff7e41044adfe27494d1920c24c9431de2c1ac0dec2972ff12838d8000ea0b0f3c587485f35d848b8ed3b225f5e8069e29297f6f48905607e70b042b949885ccb38c5c782022957bd7e77173f04ec08cbd77b83e964a866bdd6531b98404753953b79dfab7ade922d198f42f4e74bc32a4739f003ceecd47e1e4d7b2a22855cefe8d6b305c914a586f2842b528d9c0a99020fea364baac21581b73c806ee3f8c66cb9688b48ba4b51dd3b365798b0218a2d6ce7e647e047008b11c3914e8058ab7aef3356e229cb103990e81d451a8d414692e00c350ae8f7bb3da98cf42454605d54ee5a6aac3306a3f618607c77d20337b66a54ff34aec2740b43085affa1534868cb923a35fd5d544147331c798167391d1f80e14cba30c75b0a00f6c6e382d19c9abf5204d1303370100f82e684b3c7e313f0511f62bd57502118cf0d0e7a650354214fef7a9cd22030610d0d208cbf2b4c222c9118afd7bb52576f9ccfd74d91e0e456172a15432099d1d861d79ee039b753c6707a36777b4c1f94a0136ab874cf4f531953d8098673092a85a96f5e8c526e9a965b0fd0b0e6593bd3073af4eacdf7a6b16a0301c7c7029230975ffd3ab37ca079eaa7d666ab3d8184cafe9a0d276aad10064e0d70075bedb9bc2f4267a2285d21f7171893a2c586f34bea7fc977ff173ce093713ed26f1e9450b6f88d97d8cb98b3a4d2b0435c13fdd7a7d1fc3b003adb70f833e20f63807f61f8106a53c7fa15d91ae81d3075ad22447142b007e58277b6a089467ccd557214a6212d6edda3a114a37094a29089c0fefa1a0532616018d11842c8a9d939c10cf0b14c56630f5bb40bfa8961dfda786d2860df7fea2053da65c9087daefb917aebe20e60a38b8618525e2b30987289659d163898ed3c1f29677199da9aaffe92b5f2af694844b397d4985c3fbc818750d235261e5487f243c976e7ffeb3544aeeea688c422a00d7f30562d500749f5c5d2d9dcd62e5b3296f427195b828944bf12288a10e657719e248b88aa29d13aa994f5f57d7b4cf2b8f9ab43e63061918c5dfa69ffb3a9d942724abdcf3153075abd606118d09306fa80d01917dc1c35780504b9d272e081ec0c19f7735de3e91adcd743c145e1b52612abc03a85902a638b1432bc4ce07b6f71de22c370f1a9e2620b1f77d979d6b7b8a989052f186bd426b0845a21a60eeb452385d0f4c8eb1445698cee80a90cb9184d31bc7e596bef964570505126da8491c0d3097475ef244c788ccdc2b85cc64bd26e2ab38f074d2d802a28fa0c9ecc70b792b299a7ae78f7c946d0b927cf5069f4c8bd3cb9b2040ffd71483ae5a0a22b74d94f5f78051bec70976d2a49ca12b260ffff28791184a61c8130ac9ed5790e7f6338f0329caf6786e7d963ffab59a7bb0e81c4bf7aaa081148540801a80289ba819d120378dc8138b851967503ec543a01b06161fa6757e823ddb94a7daec0e77b469950d72412022c247f82f6cff98c1143511790085d44897c1e67e8dc4ea65e95b178ec14e3548c31d389d10ed0a0a081e2054250eaff92e843723d7b9a78ece5192ce013a622eb84850d27071f2732f951642ad324bfbd54e896721791258db769a09ded32464d65e2c8ed8b0de83da06ef68a855569e76a6173cd0036e0750ea4747e015732b29b8912edb70f49516bec6aa4af3a441fb9d014ebcb4ae3569897b526da74df7d6b789eb0067b33f2783af0e2e10dfae14ae8a0622c60dd918871b1debe9adea57e6cbbc83cea984a0dd8eec542a216f0302e27877fe203eacb034c004cdf2e3facec0a55618971aa7cd266b257830a0ceaf1a3f44442719a18fa5134ce5238fbe171d5ea430dcfee0fe95cac13127bf1212b5b72264b249bb1250e52b1f4c91110d277828c9f0753054a0f5d544fdbbccc43598e7fe1e4f9600fc14c08738b4a6cce4ba390b8f14ea4e5185ff55e7516f92311169a90dd3a8f07aa6870f3469dcc84c361500357941428f175029a465e385f6930bbae9208e8fc8064e1b0d4382b85a9cfe5a4171048a4b1eb8ce44197fe22ea951a5634c77eea08b722a052ecce04188cafd4e203a4cd1ff53fde92531351c75e4d76ee1a153f699ab8a3f34566adfedef8451778ff0c4ec4f79f8afb7838e48d5ae3b58767bd0bf8e7a967ed77e174aac12784c550104a50767a828cbc80e652b0f9f4d7729ed81a672734cbc6b6a53270b2921bebdde9c2656af10e64efe1492333306c9d77704475871e28235e7659f3fb0a9f35c94656b6ca0661139a8d091faea2803f8672c7aefab4ef99108d6b3ed143df50c7e7e529c1be08f93db5c6ea3a09d872b6f7448464e17bd6e2af2259fbb86d42dc4c33e48f6b2f7a0b2b2207117c43a9077d7da6d614276d190009c29db3d469c3ec235d252301a3b60e86a50ec0f723fec79d7011e1689f1d4a2d8e7bca5f9aa399c60c0b46c4f46f29963419857ff0e7136d5b12978fde213a04feac7d789f7a9940f51a17c055ad9e73ddacc9857a563f015080a268b2878245f9374e5a3691f12bb2c7be43b8c2d4db3368ecab9fc4ffb7cbef09329327c4e8daebeae7c88099c9555fd796e8378436cae27460da76ac9f40d216b93b5f883b570c2205af4f8e607493aea9972cdcc11507471aec14e775f392c46bd2ad1c2775e21554d7b2807fb2a09eb923db92178439287bac91fcb63752bd9f7adf17f8c4ba1819c1df531a66f05602a73254d57d7e877992513efe28ada07c01f18db7b11e74818db854d1cd8282e07ab6a78ffba78723d42b0ff4a6d87f9fcfff599f4fa64d65ec4c4ebcebf528ea9bb023e4be6ba64967450c1ac942a90349c7d089999bad99a8e25c26079170dfdf3761e5b380b556752fdf8b01c95243460f6d8417f4cd023a3c41bbe5a218a08bad2c9cac2e0ecd444f4923cc05a48c57c14f84b0256c8178bfba3f865e322c946a86025fc9060017221b526d58a54e44e7068c8bd26b637d294ba43edbdd9ef22fecd32f0c8389c2bb487619ec81269b1bc79de8a9cc972b36755de0862f80fcc90fdd216ac997f3bfccf7a6e6cc556fd90e02da16550459966462112851228f6c284b3c0516a5813213d8917917a0eb7d9c58c0781dcd32d8b7f5b82f0eb4169efaad56539ea418008003cc72621c00f821e6514f76e7ebcc1029b664d168cd75c643c9597ec02cd390c321cd610fcd4ad27dd076c8f925a378e09a2472131e74e9e7ab15ef56a1166ff2fc1bc8ede8ef41248377652f1a51532cb034db05f944861282e8ebe0f101c9b1ddd71ab7bdd5caab08668da960de05552f02daa8eb7157839e35a55d688c2d05522dde105dde7f74bedd41957ab073006c8518faebe35ae4394567e5c9ac2aac34e13480167465d61a6d66ca1bc3d6fb3dd83049e97fe70b06d5456c6c2aee314cf9c8c2a8b1a1dac91c4282188d7922577e8e548cf41fc8e54e873f8af625a53427e19c8207977f47600ac5f50fa2986c4012becdb84ea1600782f9e22a5ebb888c9ad16122c6709f6ba87656987032a45b3b95f7930fa61f89bb2389d872578c73f44c47e57e9b0de16330af8fedf7c387d0083222204ffc67e06b5a5491a19e4aa07414ac2caaf61f976d0ef5e82d858f0c33a4906f3ccc1a9b494a2a45fa052fc49af552e3d5b8d05ed83d4fbeb5a6f6b1a667d1ca8906beafe4fe7ce8dea7c8161470bc0af12f4bdf4e4fc4a224a6c00", "7bfb423057423b6c54a3b74d9bec86efa596762e8f65792120b68104e5d81c02d33010204293aab0964e7a300e254880b28f4a7306366ce1c265a749f8f165d2d3ec40193cf1c69b423dfe67b0cccc34b93709bab50b1f468c6aa648101b6d3bc6eeac68bdae7dd713d75bc84fd66adda8556275b2caeae2067784f31b80d879a610fe7eb58f3ac362390272a10b09b6ef5a5e9bc749e04b9ee4a938fdda683b86030aaa01486e462c3588f60eb28cb85ce8ae0c80a351344024a59d09cfeb7131f4982fe84b3af7d9f09b4aff7ab0d3bc676c07c42f277156a540c5ed6889210cba6ad2f37907babce12e08317f68ef14a5faaffdfb7c598676d82f329eb34995a93a6070e928064bfb7ae407fb0f6ac98e4479a6a934e082876ebb9a4b4c1b3807bea5bc4e75893dbbd35f759054fa5e7ee196891c29b890eca06a5db9b300962bc92dcd5c0cf4a393baca27d9f642b9ca372ded564971a27344c6b93f7b8a69687b9e113367b909362df45b581dd4812450523e29503915828b384b537402db1905d0ca0890ac91ea8c538fa7ab6394c3bc8f43deb1c29af45f795b8754d8f8ece8b2833b4190aef937ebb616a388b4fdf7808baea8bf4155bc4cf83a9e683c47feaf84b04173d92cdd2d66b7e6fe9d98fe8eea70b1a47fdd1be0fdb8d92904b7c964a37768c5f97b1d0805322c0878f56a49e82683ffb89b5e668631038a1119a4c02d03b022a2a18fbcd93adffe0b5f599b5ae7ba1865cdd4d3d4ca365871bd5b05225b3dd785e127c1b8e4fba14975624baaa9d14985291642cb90f7d216070f4c81886b10871ed71decbf00bfc0463dbdebc241083fc6dd27fb03ae723efcfa8f7028c29d155ac1dfb23f2f2021e0960a038b5488708a3b13cd785bf105924592e6e9d9e7878fb2995e93d42791258c0c0636ea521239338445f57a7e4fd4ddf8810979f400995c0f4628bb0e1001a79ebda281cefb5441470723526a776166b42f0886bb979c1e0b22631747be9fbcb0796f9248eb5e1ff9ad3e308c0e9c17b31e243313de8150bcec076fc983625290ae84c206a9a2b31be36d6db30b83a06c91576daf3540926c1912ea5f72bf2525647f37f147483e988cc5ab10f2a38f42e795de93080018d34e849ef2bfddc51f344acc947cc6a714294106075cb44855c4b2648d2bb43147c2337f0c7710b60d47fde1f2865f4d09bb9f089669faa7ada713c88c04baaae5220a6d77008276a038a409442584155c2bfe5b6828df8553587915924443eab0a32272ba6fe629ceae0fa16ad428fa105212946b525b535969122b8ee5cc045b5e3c3734488702cb4eca7b1c68445f164fc1b325768ba0b8d1255c8a0529499da024f8d48ec7b4a5de80429b3d22d5695f9765f361c36f86b90a1c243278b1afa159a2c54fca2b5a92d0e7ce083efbab4440df68b56c14d6ccef157100e08d6a3286f622b102042b1b3a16ae05f18d8ba6b87a26a7716fa9d5a6f2111d2475a44f73c348a9f03279b2983a5d7123e1158c28aea2a9884268969c0fc60f9acfad4756497efdc6fd307c48b11d29891bb779c5bd90251cd1e411f8208493151c27449b9e13f6c3960295612b2e59d98d7eb05863de345b8799fc767c8f264c45cd4027a0a5de8a2a2ffd2ac29abb5a86b5409bf489c17f32aa561a1f2888ab45e6cf53d154b28f193f1baa1b6a54c3f3ff5e0cae7631431672f411689076292412557fe2d4050d95a44326adcc15403c1615fb15fd66d3599a8eb768ca2af0bb33fd34bef719edd075bda35d2e5d65fcf7a41bd7f1992dc3ad640bc4e767654d41d3004ff0695c0ad2794ebe10c54228948d84f06e8317b73434a1f5ad4a23fdafeebdff38c56322e81968eede6f3c1e23e380ffd2e4c0a4519ee5ac19dec1e0cd1dfcf13204fc19f0ed59a3b968c3b5b21bb50a55029d338f87e9f8e75ebbf634c9632530504b42356349e967ccd1aea9edefab90b685057e9773f5332e71acdc034e4b22bcf97bbce3c80af855ce616f0f472ffd5926e0efe161b7ee4feca248e8bfa76c9a788d7aa8370ca688d6b50186d7e93b4f593dc052e4362025fea81509cb84aff8a7e44f17fd568d148c855011b1e70ab38b61ee1d58b9f10ffff1e03988b685e390a108a92f223df225000e4591a010536c473988e83243fa61c05b33dc5020799cf81177df272c2bc67b9d028625c57b0a15dcf8d6d8c43a0edfc8b986587f3537bc96b5773c33cf208d5c4654b160fc34eadbf2358c205621ebbf7c85454e9d101a362185b3b557d96c250efc64a79f19d3e6e002caa399f62de73812d8bb5806c94ec99e98fed8eb469cec4489cca2bff418db565a068c4176fe1cb0385581e9ffb717d2d1665710873904b1f0f5abfe621259f38e1a93247ca8c559c62dc357565c38937fe0786aa41b0ea650cc886b5c9e72c8bba0bca5fef99c24eadffee65bd2217e128ff9b27d586e6caab80a8040e0c5938d7dd9595ac677b256c595debb5e18e0f3754c96b5317b2d117705163af822c958aae8380bd06217e652a06cac63e3a4538606ed601f67e2528163900fec23e06f9e5650d9d11ce45a2bd311ae5803a5a2ee047625f5c4ce83bf538fd24b4d1d4167248b538b91054bca4ecdaaa77f5063e986531890db5376df7c60be7e42e66c1a1aa51a3f255dedce04aaeb4c349e1390e5c18bbb6b29805bd2103bfef0bf4be322d69b355aec7c4f30c4a70e80c934c943aa64597f1c831d15263a9d9cc3ebb02737dda435f5e4f4f2c5ef506bfcacf7dd48d7975ed0aec8cbf7e7de46307bdd9c6e9e6d7e33d7a017cba1c0e75b3087726b4eebe948b5a1650364f34616b24101a68e80a7b98f66b2863c24a8cf8ce34b3bc8690da6afb0eb75cd9dc0d0ce4262eedf9df12399acf09290e32f2f6fe0809e3992a74b5236abde2cff4819c47885af036aeaeb914a2847df26ea796d842adca0eb8203ee0eb634ffcbb1bc97b2eef5575f7d7a54674ff5977b7b6f5a348c249a981d31159e379506328fb1935d4b47ae4c6c2c74f07c7472355e6a1298e195421dc64b2368d81986e4220d624e9fc58a4441c4a9b6938fa6f0752cf21b03af32e1890b4c79841aa09a430dea8beb2f6ae1dec56b202e305d5c2350794389935ceca1999c830ec5abcf5236a046ed0a3010a9368b06cf9446b17cde2e53c8e30b8ab10800795f0ce37d164162bcc9e8696b9c219d378a64bb7bc5177d095188df933297ae3b641498951737e91f08c7e48ec2d3d4730841d205313fb146ac0609ed4441f022174c3003abebcf2c857e98d6b7922b511c06b04e7d5aa9be2b020871d794a49ccb6927a4ba77f647de84a2189dd9c883ec719318aba431e348a327d28c8ff1597e89edba44d31a436c98f5fcaf0483b60be3f8ead6e2389a4bab66162fbeadd7808b619515ce0869e9bb675e012077f77986728a89c5fb67c4c5ba4e13c583fc4565dbf40db69416a7563bc4e6d5d69a462ec120eaa6f670df04bf453555a5e780ecaf9f42906b93e8a4d2824a8e67a12df912df6e66c6860878c69c392a925e170a923670c7c15029631865762e57303e071b63474b0ba6662e42e9871f3fb35dc502573fb1c7a4412f2d1488178ca00054640392c42ec768df5f425e719c9f6aef201936ac1d4db44b7488211be107edb90d175edb734197d469811f6d34905581f9f765309bab65ba83af2a67fb5622078dd074465b4182a6eeb0bf4c89b4f9ba0f54e87ae694d1274118f6253be2eb0f6c1de9b4b39ae2a62b9c48023a2e9537e240049b5bbd494e165001c109d61f5fb14b0e8352324589a6e962f02e2d2b795223462077e95d1b2438c8682dd2f1dde1566468eb213b41ee58f5fc740d304c6051d17d0442b78d502c71a945215bf3220d0955294c292ac298cd6df640bab4de35ecd1b4654c92bd0860e3e026eebdfa086362e3c4005c45a271c3a7db4adea25e7031d7f7d6d00f21aef23f6de3ba2126a8b8f451379e1bcead259a9a66ac23b739330a1cd298ef0878ea786b33b1a19cf76500e531c0d6259022954114d0362359c1983c2a014005a3bca4bff410fcbf0ee23aed33444db647d9a2606bbb9da5075e6663096635b18493c091f6ccbf409399c0939ada158559e648532f1c121808b8e039197a7de22f7353563546865f9bae5a86c052bfeee5a55dd43f46036bc304ca30b7e8a243c32b741b9fbf91fdc77804c08d84eeb0c8bac1ab5cdf9826297eab58ba303e9e5c78b37ff02937373409174fee1da380ea1f80c6acbd8838db11be12089189c3b9446470c62c3f67fae838792a06e0d1cde3df268cc9b108bff7798a1b3c202c77485eee0a0cfe8c0567a1b6fb9616457653d9c059935963b6134cdcf60a20655c15c6c894788c911e00ba1295983429320b488f76c6e71264b9b52a4949254d54e852d3482f347e6f6568fe6b6ceac725e2700184f7673c70d5867b1c6159d5cdd37aa3b4d0be30693625ce4368a9942221322b8116e5f6ecb0e675de0e6337a13bed350d3c3470f47cfa780d83fc9c4f6303a8d72f3dec903759bf404302ea55e0fc80dbcd1778b21f464dd7a59861904cdf6dd5ae137978ae0cd5e8ce9ce4d6039cadbac8fc81dadd198dffe5cd87a097a748b7d26a3bd28fc7619d046ea541f3f5a0255e0997bb2e44039cae7bebb4e87290ea194f858872d295954e3fa839fbb5d1046d1f1570aa19b4cc0a941628eb558e3a6a5dd00a09a958444cc288eebc7535b37ba063b8e0607607b8a3eed35355817d72ad7962d36506a552a0940c1331374c70ce4a75477eb6868eec9710fcc49cb2eb8ea5af475c3ecf7b8e98ba644f53bca51d0ff46427be19382f07fb686de04fd788f8637452f7673271227e9b8c66dc23b2dd5bec961736b434f459367d020643608e328cb824794d899f59f422f8b8d4ee4bceca258d038dfa4ac3f840673b79721fd6188250b40d561df450ded53995efa7123942a7b0fe53f6ca1e57cbcacce10539bb1632087cc8fcfaf4eddd8e3d3206ea2c1587b45df2534b9ec835e729cacc9c865efbeb3ef23e17280312507b1717fe8d335f1984ff0763faa611b09c9349931c02d3e50ba8f18fdc6a46b872a292da22599776e7ccada86f8322f23cb37c7576f26807907c5d3338c41caebcdaa8619b4d8f0d85246e78ec39bd00fe798e42eed299f2a7ba63df6feacea9b077930d50fd57d4e6c005ec9425a9e61609d42340401dc83a9d8c1cc2310259db69a7f81d87e7909b5ca42dc72a032cc43517961116e0615c0189ddab0ac5323ac1cff39a8b24916315ae82c9f5a7f020105e21554541ee5d63c81d3e9bf538faa9db56fbe6c5b95da1793e267b60ec1f8bdb58f9af20b51335f431b8536407fe3dd581343324b60419185ffe9dc50ccb29c23d43ec56cbb7474834471fa402fea17dece3d336a1849f828af696d8c163f58fc60b621b2db668d50bffa861daad1d6e26adaa01b9b29249883624211822ae7421a184f69ce48c0da19e0fa880fbd46faab97a8f16827c3045a5c9ae35fe42631b3331e2de4c2e5d692ebe3d2a2013e9385ba39ea387bee34f35fd25390681829db6a941a4976faec161c9d9248779c1b483b748d66c2870e07243af740755cc7a5e242c3a313069b75efe7774fb0faa5e15c89d6e4df31285a148bcb1c0e0711650d95b9f1ffcd013d21db24c0d3005c249135f791d645e318b1febccc0f30d50a8f34df82a802014cb8c58849ffce7c7ee11e5d5ea088f2baebb59"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:47:53 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 337.568384][T13577] BPF:Invalid type_id [ 337.573058][T13577] BPF: [ 337.573058][T13577] [ 337.594384][T13570] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 16:47:53 executing program 3: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:53 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:53 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 337.921953][ T4957] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 338.112098][T13623] blk_update_request: I/O error, dev loop0, sector 768 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 [ 338.221516][ T4957] usb 2-1: device descriptor read/64, error 18 [ 338.646802][ T4957] usb 2-1: device descriptor read/64, error 18 [ 338.781539][ T4957] usb usb2-port1: unable to enumerate USB device 16:47:56 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:56 executing program 2: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 4: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 3: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:56 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:56 executing program 2: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:47:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x22004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000002540)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) exit(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/udp6\x00') preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0) 16:47:56 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:56 executing program 2: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 340.891826][ T5289] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 341.094034][ T5289] usb 2-1: device descriptor read/8, error -61 [ 341.361673][ T5289] usb 2-1: device descriptor read/8, error -61 [ 341.631311][ T5289] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 341.811285][ T5289] usb 2-1: device descriptor read/8, error -61 [ 342.091316][ T5289] usb 2-1: device descriptor read/8, error -61 [ 342.211277][ T5289] usb usb2-port1: attempt power cycle [ 342.931248][ T5289] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 343.221178][ T5289] usb 2-1: device descriptor read/64, error 18 16:47:59 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:47:59 executing program 3: 16:47:59 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:59 executing program 2: 16:47:59 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) 16:47:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x22004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000002540)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) exit(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/udp6\x00') preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0) 16:47:59 executing program 2: 16:47:59 executing program 3: 16:47:59 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:47:59 executing program 3: 16:47:59 executing program 2: [ 343.793234][T13718] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 16:47:59 executing program 3: [ 344.131472][ T5289] usb 2-1: device descriptor read/64, error 18 [ 344.401152][ T5289] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 344.671165][ T5289] usb 2-1: device descriptor read/64, error 18 [ 345.061101][ T5289] usb 2-1: device descriptor read/64, error 18 [ 345.181087][ T5289] usb usb2-port1: unable to enumerate USB device 16:48:02 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a0102010000000109022400010000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:02 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:02 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) 16:48:02 executing program 2: 16:48:02 executing program 3: 16:48:02 executing program 4: 16:48:02 executing program 2: 16:48:02 executing program 4: 16:48:02 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:02 executing program 3: 16:48:02 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:02 executing program 2: [ 346.869584][T13761] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 [ 347.103482][ T5289] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 347.201006][ T5289] usb 2-1: Using ep0 maxpacket: 16 [ 347.333990][ T5289] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 347.348702][ T5289] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 347.371985][ T5289] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 347.393390][ T5289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.405398][ T5289] usb 2-1: config 0 descriptor?? 16:48:05 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a0102010000000109022400010000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:05 executing program 4: 16:48:05 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="2c050000000000f103010800010004010805020800010700000000000000c910fe880000000000000019d31ac5bf003a4e4b77b43e"], 0x30) 16:48:05 executing program 3: 16:48:05 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:05 executing program 2: [ 349.738146][ T4143] usb 2-1: USB disconnect, device number 31 16:48:05 executing program 2: 16:48:05 executing program 3: 16:48:05 executing program 4: 16:48:05 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:05 executing program 4: 16:48:05 executing program 2: [ 349.994756][T13806] blk_update_request: I/O error, dev loop0, sector 768 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 [ 350.293027][ T4143] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 350.381160][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 350.500833][ T4143] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 350.520778][ T4143] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 350.530197][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 350.540700][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.550194][ T4143] usb 2-1: config 0 descriptor?? 16:48:08 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a0102010000000109022400010000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:08 executing program 3: 16:48:08 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:08 executing program 2: 16:48:08 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:08 executing program 4: [ 352.839872][ T4143] usb 2-1: USB disconnect, device number 32 16:48:08 executing program 2: 16:48:08 executing program 3: 16:48:08 executing program 4: 16:48:08 executing program 2: 16:48:08 executing program 2: 16:48:08 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 353.105079][T13849] blk_update_request: I/O error, dev loop0, sector 768 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 [ 353.390636][ T4143] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 353.480933][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 353.610975][ T4143] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.627970][ T4143] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 353.648012][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 353.658045][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.676130][ T4143] usb 2-1: config 0 descriptor?? 16:48:11 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d0009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:11 executing program 4: 16:48:11 executing program 3: 16:48:11 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000100)=0x3) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:11 executing program 2: 16:48:11 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 355.947145][ T4957] usb 2-1: USB disconnect, device number 33 16:48:11 executing program 2: 16:48:11 executing program 4: 16:48:11 executing program 3: 16:48:11 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000100)=0x3) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:11 executing program 2: [ 356.192572][T13895] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 16:48:11 executing program 2: [ 356.480985][ T4957] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 356.572653][ T4957] usb 2-1: Using ep0 maxpacket: 16 [ 356.690908][ T4957] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 356.706458][ T4957] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 356.729408][ T4957] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 356.738529][ T4957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.747747][ T4957] usb 2-1: config 0 descriptor?? [ 356.791924][ T4957] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:14 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d0009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:14 executing program 2: 16:48:14 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:14 executing program 4: 16:48:14 executing program 3: 16:48:14 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000100)=0x3) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x60000, 0x0) [ 359.052736][T11558] usb 2-1: USB disconnect, device number 34 16:48:14 executing program 4: 16:48:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x0, @loopback}, {0x2, 0x0, @loopback}, {}, 0x27}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') fchdir(r0) r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0) write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0) r2 = inotify_init1(0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972) 16:48:14 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) [ 359.295304][T13943] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 16:48:15 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) 16:48:15 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000026009d59"], 0x24}}, 0x0) [ 359.640317][T11558] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 359.750404][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 359.870437][T11558] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.885425][T11558] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 359.919420][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 359.940297][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.960677][T11558] usb 2-1: config 0 descriptor?? [ 360.001443][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:17 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d0009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:17 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0x101, 0x0, 0x400000}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/2, 0x2}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 16:48:17 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:17 executing program 4: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="240000001e005f0214fffffffffffff8070000000000000000000000080008000d000000", 0x24) 16:48:17 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000000140)="24000000210099f0003b78753828190e020008160004000000ba0080080002", 0x1f) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xffffff54) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r4, 0x0, 0x4ffe0, 0x0) 16:48:17 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) [ 362.152578][ T5289] usb 2-1: USB disconnect, device number 35 [ 362.185883][T14002] mmap: syz-executor.2 (14002) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. 16:48:17 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$tun(r1, &(0x7f0000000200)={@void, @void, @eth={@multicast, @dev, @val, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c9b12e", 0x8, 0x3a, 0x0, @empty, @empty, {[], @echo_reply}}}}}}, 0x46) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10004, 0x0) 16:48:17 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x2000000000003, 0x2) setsockopt$inet_int(r2, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) 16:48:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r2, &(0x7f0000002440)=[{{0x0, 0x2a0, &(0x7f0000000180)=[{&(0x7f00000005c0)=""/4096, 0x13}], 0x1, 0x0, 0x0, 0xa00100}}], 0x4000000000001ba, 0x6, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="2400000026000102"], 0x24}}, 0x0) 16:48:18 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:18 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 362.721147][ T5289] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 362.810159][ T5289] usb 2-1: Using ep0 maxpacket: 16 [ 362.930235][ T5289] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 362.950193][ T5289] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 362.980133][ T5289] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 362.989355][ T5289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.040654][ T5289] usb 2-1: config 0 descriptor?? [ 363.081323][ T5289] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:20 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:20 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:20 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000000300), 0x64, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000000)=0x43fb, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100001080000d39c0000001480000c00", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x28}}, 0x0) 16:48:20 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:20 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000300)="6653070000053c27bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349f2f11e931e7d62ead037cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b100000000050000be5d2dd15b6210d53eed19bc0080000033270c6a98d91c22def1125d7b1e821039a85ad8b91cea336a1b57f45a0788e3aba04551e4a522e15c7ce71553059a", 0x10b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 16:48:20 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0x10}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x7, r0, 0x0, 0x0) [ 365.276348][T11558] usb 2-1: USB disconnect, device number 36 16:48:21 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000400)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349f2f11e931e7d62ead037cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48", 0xc2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 365.498070][T14093] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:48:21 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 365.543344][T14093] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 365.552610][T14093] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:48:21 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:21 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 365.709052][T14113] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 365.753550][T14113] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 365.770391][T14113] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 365.813974][T11558] usb 2-1: new high-speed USB device number 37 using dummy_hcd 16:48:21 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x6, 0x0, 0x400000000}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000002fc0)=[{{&(0x7f0000000a80)=@isdn, 0x80, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000007380)=""/4104, 0x1008}, {&(0x7f0000000340)=""/122, 0x7a}, {&(0x7f0000000b00)=""/212, 0xd4}, {&(0x7f0000000740)=""/5, 0x5}], 0x4}, 0x4009840}, {{&(0x7f0000001240)=@nfc, 0x80, &(0x7f0000002940)=[{&(0x7f00000025c0)=""/147, 0x93}, {&(0x7f0000002680)=""/219, 0xdb}, {&(0x7f0000001080)=""/119, 0x77}, {&(0x7f0000000d40)=""/156, 0x9c}, {&(0x7f00000004c0)=""/106, 0x6a}], 0x5, &(0x7f00000029c0)=""/234, 0xea}}, {{&(0x7f0000002ac0)=@phonet, 0x80, &(0x7f0000002c40), 0x0, &(0x7f0000000c80)=""/185, 0xb9}, 0x5}, {{&(0x7f0000002d40)=@l2tp={0x2, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000002f00)=""/130, 0x82}}], 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x1, 0x0, 0x0, 0x3}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3) sendto$inet(r4, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0xfffffef1) 16:48:21 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 365.920360][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 366.050483][T11558] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 366.082701][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 366.093137][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 366.103252][T11558] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 366.127957][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 366.152470][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.163674][T11558] usb 2-1: config 0 descriptor?? [ 366.201272][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:24 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:24 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:24 executing program 4: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RLOCK(r0, &(0x7f0000000040)={0x8}, 0x8) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r1 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f00000004c0)=ANY=[], 0x8) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, 0x0) r2 = creat(0x0, 0x0) fallocate(r2, 0x8, 0x0, 0x10005) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) close(0xffffffffffffffff) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x4000000000010046) bind(0xffffffffffffffff, 0x0, 0x0) 16:48:24 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:24 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000400)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349f2f11e931e7d62ead037cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc", 0xa4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 368.387769][T11558] usb 2-1: USB disconnect, device number 37 16:48:24 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) futex(&(0x7f0000000000)=0x1, 0x4e, 0x0, &(0x7f00000000c0), &(0x7f0000000100), 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="4c0000001000fff1fefefd956f76c9b724a6008000000000000000683440150024001b0000000000000000593ab782115ed9043d51d7e88dc62b2ca654a6613b6a080000001cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r1, &(0x7f00000017c0), 0x1e, 0x0) sendmsg$NFQNL_MSG_VERDICT(r1, 0x0, 0x8084) 16:48:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653070000053c27", 0x8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 16:48:24 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:24 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 368.723119][T14183] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 368.732926][T14183] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 16:48:24 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 368.846375][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 368.913993][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 368.930333][T11558] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 368.931537][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 369.052958][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 369.172618][T11558] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config 16:48:24 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 369.215625][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 369.242629][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 16:48:24 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 369.257718][T11558] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 369.279808][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 369.288873][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.302107][T11558] usb 2-1: config 0 descriptor?? [ 369.355735][T14183] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 369.371239][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 369.412111][T14183] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 369.467538][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 369.488451][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 369.498554][T14183] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:48:27 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:27 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x2) sendfile(r2, r0, 0x0, 0x6f0a77bd) 16:48:27 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:27 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r2, 0x0, 0x0) [ 371.474701][T11558] usb 2-1: USB disconnect, device number 38 16:48:27 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:27 executing program 2: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r0, 0x4200, 0x0) io_setup(0x1ff, &(0x7f00000004c0)) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[], 0x1) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x1) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffffb) 16:48:27 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x2) sendfile(r2, r0, 0x0, 0x6f0a77bd) [ 371.852678][ T27] audit: type=1804 audit(1588956507.461:7): pid=14258 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/147/bus" dev="sda1" ino=16312 res=1 16:48:27 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:27 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 371.949722][T11558] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 372.060024][T11558] usb 2-1: Using ep0 maxpacket: 16 16:48:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440), 0xfffffc41) syz_read_part_table(0x0, 0xb784, &(0x7f0000000040)=[{&(0x7f0000000000)="0201a6ffffff0a000000ff45ac00000000006300e931190000000000000680ffffffa5000000e100e2ff877700720030070081ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 372.179958][T11558] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 372.208870][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 372.218661][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 372.222532][ T27] audit: type=1804 audit(1588956507.831:8): pid=14246 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/125/bus" dev="sda1" ino=16318 res=1 [ 372.234976][T11558] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 372.294769][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 372.316393][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.343664][T11558] usb 2-1: config 0 descriptor?? [ 372.388664][ T27] audit: type=1804 audit(1588956507.861:9): pid=14247 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/125/bus" dev="sda1" ino=16318 res=1 [ 372.415293][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 372.953751][ T27] audit: type=1804 audit(1588956508.551:10): pid=14283 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/147/bus" dev="sda1" ino=16312 res=1 [ 373.210686][ T27] audit: type=1804 audit(1588956508.821:11): pid=14287 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/147/bus" dev="sda1" ino=16312 res=1 [ 373.236992][ T27] audit: type=1800 audit(1588956508.821:12): pid=14273 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="sda1" ino=16314 res=0 [ 373.277920][ T27] audit: type=1804 audit(1588956508.841:13): pid=14288 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir406668917/syzkaller.RY8Pkc/147/bus" dev="sda1" ino=16312 res=1 16:48:30 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:30 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:30 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r2, 0x0, 0x0) 16:48:30 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:30 executing program 4: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000001c0)=@filter={'filter\x00', 0x50, 0x4, 0x3c0, 0x0, 0x1f8, 0x1f8, 0xd0, 0x1f8, 0x2f0, 0x2f0, 0x2f0, 0x2f0, 0x2f0, 0x4, 0x0, {[{{@ipv6={@mcast1, @loopback, [], [], 'bond_slave_0\x00', 'syzkaller1\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@ipv6={@dev, @mcast1, [], [], 'dummy0\x00', 'veth0_to_bond\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30, 'frag\x00'}}, @common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@ipv6={@remote, @empty, [], [], 'ip6tnl0\x00', 'ip_vti0\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "1883"}}]}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x420) 16:48:30 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="7400000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="ed9ce2e9150000f11700128008000100767469"], 0x74}}, 0x0) [ 374.567895][T10199] usb 2-1: USB disconnect, device number 39 16:48:30 executing program 4: prlimit64(0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r0, 0x4200, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) lseek(0xffffffffffffffff, 0x800002, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x1) r3 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffffb) [ 374.649456][T14311] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.2'. [ 374.652430][T14310] ip6t_REJECT: ECHOREPLY is not supported [ 374.716071][T14311] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.2'. 16:48:30 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:30 executing program 2: timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0) r1 = getpid() ioctl$MON_IOCX_MFETCH(r0, 0x40189206, &(0x7f00000001c0)={0x0}) ioctl$MON_IOCX_MFETCH(r0, 0x80089203, &(0x7f00000000c0)={0x0}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x800000015) [ 374.884553][ T27] audit: type=1804 audit(1588956510.491:14): pid=14330 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir839325459/syzkaller.MxD4uA/141/bus" dev="sda1" ino=15736 res=1 16:48:30 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 375.069544][T10199] usb 2-1: new high-speed USB device number 40 using dummy_hcd 16:48:30 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:30 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) 16:48:30 executing program 2: timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0) r1 = getpid() ioctl$MON_IOCX_MFETCH(r0, 0x40189206, &(0x7f00000001c0)={0x0}) ioctl$MON_IOCX_MFETCH(r0, 0x9205, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x800000015) [ 375.199680][T10199] usb 2-1: Using ep0 maxpacket: 16 16:48:30 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 375.319837][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 375.352062][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 375.386026][T10199] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 375.426075][T10199] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 375.452621][T10199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.503420][T10199] usb 2-1: config 0 descriptor?? [ 375.528939][ T27] audit: type=1804 audit(1588956511.131:15): pid=14326 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/126/bus" dev="sda1" ino=16334 res=1 [ 375.572842][T10199] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 375.618529][ T27] audit: type=1804 audit(1588956511.131:16): pid=14327 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/126/bus" dev="sda1" ino=16334 res=1 16:48:31 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r2, 0x0, 0x0) 16:48:33 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:33 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:33 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x0, 0x3, 0x0, 0x0, 0x0, "00000100"}) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r3 = syz_open_pts(r1, 0x2) sendfile(r3, r0, 0x0, 0x6f0a77bd) 16:48:33 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) 16:48:33 executing program 4: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xdb, 0x66, 0xdb, 0x40, 0x7fd, 0x4, 0xaeef, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0x94, 0x38}}]}}]}}, 0x0) 16:48:33 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r2, 0x0, 0x0) [ 377.664717][ T12] usb 2-1: USB disconnect, device number 40 16:48:33 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:33 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) 16:48:33 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 378.019503][T11558] usb 5-1: new high-speed USB device number 5 using dummy_hcd 16:48:33 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x24000000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) 16:48:33 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:33 executing program 2: syz_usb_connect(0x0, 0x48, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xc, 0xf5, 0x8f, 0x8, 0x413c, 0x81a3, 0xb44e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x8a, 0x80, 0xf6, 0x0, [], [{{0x9, 0x5, 0x0, 0x3, 0x20}}, {{0x9, 0x5, 0x0, 0x13, 0x10}}, {{0x9, 0x5, 0x0, 0x2, 0x200}}, {{0x9, 0x5, 0x0, 0x0, 0x3ff}}]}}]}}]}}, 0x0) [ 378.179381][ T12] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 378.260189][T11558] usb 5-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=ae.ef [ 378.279720][ T12] usb 2-1: Using ep0 maxpacket: 16 [ 378.280496][T11558] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.312661][T11558] usb 5-1: config 0 descriptor?? [ 378.362851][T11558] usb 5-1: Waiting for MOTU Microbook II to boot up... [ 378.375343][T11558] usb 5-1: failed setting the sample rate for Motu MicroBook II: -22 [ 378.392573][T11558] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 378.399734][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 378.414841][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 378.414858][ T27] audit: type=1804 audit(1588956514.021:22): pid=14402 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/128/bus" dev="sda1" ino=16350 res=1 [ 378.419177][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 378.421514][ T27] audit: type=1804 audit(1588956514.031:23): pid=14403 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/128/bus" dev="sda1" ino=16350 res=1 [ 378.485832][ T12] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 378.509442][T10199] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 378.521409][ T12] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 378.540549][ T12] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.561375][ T12] usb 2-1: config 0 descriptor?? [ 378.563958][T11558] usb 5-1: USB disconnect, device number 5 [ 378.600135][T10199] usb 3-1: Using ep0 maxpacket: 8 [ 378.610824][ T12] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 378.722464][T10199] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 378.742106][T10199] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 378.769355][T10199] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 378.789353][T10199] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 378.994428][T10199] usb 3-1: New USB device found, idVendor=413c, idProduct=81a3, bcdDevice=b4.4e [ 379.039349][T10199] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.047366][T10199] usb 3-1: Product: syz [ 379.057870][T10199] usb 3-1: Manufacturer: syz [ 379.067860][T10199] usb 3-1: SerialNumber: syz [ 379.073977][T10199] usb 3-1: config 0 descriptor?? [ 379.313648][T10199] usb 3-1: USB disconnect, device number 5 [ 379.359407][ T49] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 379.569359][ T49] usb 5-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=ae.ef [ 379.578522][ T49] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.588687][ T49] usb 5-1: config 0 descriptor?? [ 379.633187][ T49] usb 5-1: Waiting for MOTU Microbook II to boot up... [ 379.640210][ T49] usb 5-1: failed setting the sample rate for Motu MicroBook II: -22 [ 379.648297][ T49] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 379.839415][T10199] usb 5-1: USB disconnect, device number 6 [ 380.089301][ T49] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 380.179940][ T49] usb 3-1: Using ep0 maxpacket: 8 [ 380.299302][ T49] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 380.312011][ T49] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 380.323353][ T49] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 380.334235][ T49] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 380.499284][ T49] usb 3-1: New USB device found, idVendor=413c, idProduct=81a3, bcdDevice=b4.4e [ 380.508433][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.517169][ T49] usb 3-1: Product: syz [ 380.521694][ T49] usb 3-1: Manufacturer: syz [ 380.526270][ T49] usb 3-1: SerialNumber: syz [ 380.532564][ T49] usb 3-1: config 0 descriptor?? 16:48:36 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:36 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 380.761000][ T49] usb 2-1: USB disconnect, device number 41 16:48:36 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:36 executing program 4: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xdb, 0x66, 0xdb, 0x40, 0x7fd, 0x4, 0xaeef, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0x94, 0x38}}]}}]}}, 0x0) 16:48:36 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x24000000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) 16:48:36 executing program 2: [ 380.806873][T11558] usb 3-1: USB disconnect, device number 6 16:48:36 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:36 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x24000000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) 16:48:36 executing program 2: 16:48:36 executing program 2: 16:48:36 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:36 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 381.179263][T10199] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 381.301510][ T49] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 381.400037][T10199] usb 5-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=ae.ef [ 381.401767][ T49] usb 2-1: Using ep0 maxpacket: 16 [ 381.409113][T10199] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.423381][T10199] usb 5-1: config 0 descriptor?? [ 381.428456][ T27] audit: type=1804 audit(1588956517.041:24): pid=14500 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/129/bus" dev="sda1" ino=16362 res=1 [ 381.462733][T10199] usb 5-1: Waiting for MOTU Microbook II to boot up... [ 381.479647][T10199] usb 5-1: failed setting the sample rate for Motu MicroBook II: -22 [ 381.487752][T10199] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 381.520539][ T27] audit: type=1804 audit(1588956517.051:25): pid=14502 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/129/bus" dev="sda1" ino=16362 res=1 [ 381.602378][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 381.625895][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 381.651335][ T49] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 381.697731][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 381.712404][T10199] usb 5-1: USB disconnect, device number 7 [ 381.719247][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.738201][ T49] usb 2-1: config 0 descriptor?? [ 381.800355][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:39 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:39 executing program 2: 16:48:39 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:39 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:39 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:39 executing program 4: [ 383.843906][ T4143] usb 2-1: USB disconnect, device number 42 16:48:39 executing program 2: 16:48:39 executing program 4: 16:48:39 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:39 executing program 2: 16:48:39 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:39 executing program 2: [ 384.421571][ T4143] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 384.520888][ T27] audit: type=1804 audit(1588956520.131:26): pid=14566 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/130/bus" dev="sda1" ino=16384 res=1 [ 384.529084][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 384.563363][ T27] audit: type=1804 audit(1588956520.161:27): pid=14567 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/130/bus" dev="sda1" ino=16384 res=1 [ 384.699176][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 384.717787][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 384.747394][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 384.777703][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 384.796619][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.815031][ T4143] usb 2-1: config 0 descriptor?? [ 384.870423][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:42 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:42 executing program 4: 16:48:42 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:42 executing program 2: 16:48:42 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:42 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 386.965811][T11558] usb 2-1: USB disconnect, device number 43 16:48:42 executing program 2: 16:48:42 executing program 4: 16:48:42 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:43 executing program 4: 16:48:43 executing program 2: 16:48:43 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 387.472513][ T27] audit: type=1804 audit(1588956523.081:28): pid=14618 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/131/bus" dev="sda1" ino=16367 res=1 [ 387.496485][T11558] usb 2-1: new high-speed USB device number 44 using dummy_hcd 16:48:43 executing program 4: 16:48:43 executing program 2: [ 387.536914][ T27] audit: type=1804 audit(1588956523.101:29): pid=14619 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/131/bus" dev="sda1" ino=16367 res=1 16:48:43 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 387.621784][T11558] usb 2-1: Using ep0 maxpacket: 16 16:48:43 executing program 4: [ 387.749799][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 387.761084][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 387.779659][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 387.817429][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 387.835106][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.849820][T11558] usb 2-1: config 0 descriptor?? [ 387.890237][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:45 executing program 2: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="5c00000010000104080000c6d5611a6f9e3fe6e6", @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100766c616e000020001c0002800600010004000080040003800c000200100000001300000008000500", @ANYRES32=r1], 0x5c}}, 0x0) r2 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x40000000000022d, 0x0) 16:48:45 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:45 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:45 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000000)={@random="8b474fc30be2", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dcc400", 0x30, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x6, 0x0, 0x0, 0x0, [], {0x0, 0x6, "011700", 0x0, 0x0, 0x0, @mcast1, @empty}}}}}}}, 0x0) 16:48:45 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:45 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000280)={0x4c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 390.058207][T11558] usb 2-1: USB disconnect, device number 44 16:48:45 executing program 4: setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000100)={0x0, {{0x2, 0x0, @multicast2}}}, 0x88) write$binfmt_script(0xffffffffffffffff, 0x0, 0x208e24b) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x24000061) r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r0, 0x1f00000000000000, 0xd2, &(0x7f0000000040)=0xfffffffd, 0x4) [ 390.181881][T14678] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 390.265293][T14688] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 16:48:45 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:46 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:46 executing program 2: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r0, &(0x7f00000000c0)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}}, 0x1c) 16:48:46 executing program 4: setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000100)={0x0, {{0x2, 0x0, @multicast2}}}, 0x88) write$binfmt_script(0xffffffffffffffff, 0x0, 0x208e24b) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x24000061) r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r0, 0x1f00000000000000, 0xd2, &(0x7f0000000040)=0xfffffffd, 0x4) 16:48:46 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 390.638818][T11558] usb 2-1: new high-speed USB device number 45 using dummy_hcd 16:48:46 executing program 2: 16:48:46 executing program 4: [ 390.739092][T11558] usb 2-1: Using ep0 maxpacket: 16 16:48:46 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:46 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 390.899144][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 390.924425][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 390.957867][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 390.979397][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 391.014011][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.047915][T11558] usb 2-1: config 0 descriptor?? [ 391.120095][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected 16:48:48 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:48:48 executing program 4: socket$packet(0x11, 0xa, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @dev, @void, {@ipv4={0x800, @gre={{0x6, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @rand_addr=0x64010102, {[@lsrr={0x83, 0x3}]}}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x8864}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}}}}}}, 0x0) 16:48:48 executing program 2: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @multicast2, @broadcast}, {0x12, 0x0, 0x0, @multicast1}}}}}, 0x0) 16:48:48 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:48 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:48:48 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 393.190662][T11558] usb 2-1: USB disconnect, device number 45 16:48:48 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:49 executing program 2: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x22004853, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) 16:48:49 executing program 4: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x0, 0x0) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000080)=""/82, 0x52}], 0x1) 16:48:49 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:49 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:48:49 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000002400e50d00"/20, @ANYRES32, @ANYBLOB="00000000ffffffff0000000008000100686866000c0002"], 0x3}}, 0x0) splice(r0, 0x0, r1, 0x0, 0x11fffffff, 0x0) [ 393.761279][T11558] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 393.869090][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 393.988689][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 394.008645][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 394.028648][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 394.048633][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 394.068693][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 394.078090][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.087979][T11558] usb 2-1: config 0 descriptor?? [ 394.129941][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 394.137708][T11558] scsi host1: usb-storage 2-1:0.0 [ 394.336775][T10199] usb 2-1: USB disconnect, device number 46 16:48:50 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:50 executing program 4: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000000)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) 16:48:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000507000000000000000000000002", @ANYRES32=r3, @ANYBLOB="0000400000000002280012000c00010076657468"], 0x48}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@ipv4_newaddr={0x20, 0x14, 0x121, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r5, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@ipv4_deladdr={0x18, 0x15, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r3}}, 0x18}}, 0x0) 16:48:50 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:48:50 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:50 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 394.908751][T14826] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 16:48:50 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x4c, 0xa, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_LINENO={0x8}]}]}, 0x4c}}, 0x0) 16:48:50 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x80003, 0x6b) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) [ 395.174136][T14826] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 16:48:50 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000000)='./bus\x00', 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) fchown(0xffffffffffffffff, r3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setfsgid(r5) fchown(0xffffffffffffffff, r3, r5) mq_open(&(0x7f0000000100)='[-:/\x00', 0x80, 0x2, &(0x7f0000000180)={0x3f, 0x880, 0x10001, 0xb9b}) getgid() r6 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac', 0x4) lseek(r7, 0xfffffffffffffffd, 0x4) 16:48:50 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 395.308896][ T5] usb 2-1: new high-speed USB device number 47 using dummy_hcd 16:48:51 executing program 2: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@loopback, 0x0, 0x0, 0x2, 0x1, 0x0, 0x81}, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket$inet6(0xa, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local}, 0x20) [ 395.411286][ T5] usb 2-1: Using ep0 maxpacket: 16 16:48:51 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x80003, 0x6b) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) [ 395.467750][ T27] audit: type=1804 audit(1588956531.072:30): pid=14837 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/135/bus" dev="sda1" ino=16372 res=1 [ 395.558935][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 16:48:51 executing program 4: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)={0x28, 0x3, 0x8, 0x3, 0x0, 0x0, {}, [@CTA_TIMEOUT_L4PROTO={0x5}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @icmp}, @CTA_TIMEOUT_L3PROTO={0x6}]}, 0x28}}, 0x0) [ 395.602974][ T27] audit: type=1804 audit(1588956531.072:31): pid=14842 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/135/bus" dev="sda1" ino=16372 res=1 [ 395.627172][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 16:48:51 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000200)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 395.702997][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 16:48:51 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:51 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x80003, 0x6b) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) [ 395.768846][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 16:48:51 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 395.832781][ T5] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 395.865673][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.903488][ T5] usb 2-1: config 0 descriptor?? [ 395.959884][ T5] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 396.017437][ T5] scsi host1: usb-storage 2-1:0.0 [ 396.163668][T11558] usb 2-1: USB disconnect, device number 47 [ 396.351759][ T27] audit: type=1804 audit(1588956531.962:32): pid=14903 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/136/bus" dev="sda1" ino=16273 res=1 [ 396.378922][ T27] audit: type=1804 audit(1588956531.962:33): pid=14908 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/136/bus" dev="sda1" ino=16273 res=1 16:48:52 executing program 1: syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x3d) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:48:52 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x19, &(0x7f0000000000)=r1, 0x4) 16:48:52 executing program 5: listen(0xffffffffffffffff, 0xffff) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:48:52 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) 16:48:52 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:52 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x5421, &(0x7f0000000040)) 16:48:52 executing program 2: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x8, 0x0) 16:48:52 executing program 4: syz_emit_ethernet(0x32, &(0x7f0000001880)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x30}}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 16:48:52 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) 16:48:52 executing program 5: listen(0xffffffffffffffff, 0xffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 397.098521][T10199] usb 2-1: new high-speed USB device number 48 using dummy_hcd 16:48:52 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000080)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$NFNL_MSG_ACCT_DEL(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x15) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "b6d1542b0de65078", "8de21dbd4b8f2206ed163ac07f6bac81", "c0c17e84", "b900888794d5ad95"}, 0x28) 16:48:52 executing program 4: syz_emit_ethernet(0x32, &(0x7f0000001880)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x30}}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) [ 397.219196][T10199] usb 2-1: Using ep0 maxpacket: 16 [ 397.348839][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 397.363229][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 397.384101][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 397.406137][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 397.416934][T10199] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 397.427150][T10199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.437520][T10199] usb 2-1: config 0 descriptor?? [ 397.452641][ T27] audit: type=1804 audit(1588956533.062:34): pid=14936 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/137/bus" dev="sda1" ino=16374 res=1 [ 397.483557][ T27] audit: type=1804 audit(1588956533.062:35): pid=14941 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/137/bus" dev="sda1" ino=16374 res=1 [ 397.509513][T10199] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 397.530730][T10199] scsi host1: usb-storage 2-1:0.0 [ 397.713449][T10199] usb 2-1: USB disconnect, device number 48 16:48:53 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:53 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) 16:48:53 executing program 5: listen(0xffffffffffffffff, 0xffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:53 executing program 4: r0 = socket$inet6(0x10, 0x2, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto$inet(r1, 0x0, 0x0, 0x200007fc, &(0x7f0000e68000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) sendto$inet6(r0, &(0x7f00000001c0)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323456536005ad94a461cdbfee9bdb9423523598451d1ec0cffc8792cd80000ff", 0x4c, 0x0, 0x0, 0x0) 16:48:53 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:54 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:54 executing program 4: r0 = socket$inet6(0x10, 0x2, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto$inet(r1, 0x0, 0x0, 0x200007fc, &(0x7f0000e68000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) sendto$inet6(r0, &(0x7f00000001c0)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323456536005ad94a461cdbfee9bdb9423523598451d1ec0cffc8792cd80000ff", 0x4c, 0x0, 0x0, 0x0) [ 398.433782][ T27] audit: type=1804 audit(1588956534.042:36): pid=15005 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/138/bus" dev="sda1" ino=16383 res=1 16:48:54 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) [ 398.513830][ T27] audit: type=1804 audit(1588956534.072:37): pid=15008 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/138/bus" dev="sda1" ino=16383 res=1 16:48:54 executing program 5: listen(0xffffffffffffffff, 0xffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:54 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 398.703733][ T27] audit: type=1804 audit(1588956534.272:38): pid=15017 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/139/bus" dev="sda1" ino=15810 res=1 [ 398.708492][ T4143] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 398.835793][ T27] audit: type=1804 audit(1588956534.282:39): pid=15017 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/139/bus" dev="sda1" ino=15810 res=1 [ 398.908695][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 399.028647][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 399.048422][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 399.058054][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 399.078408][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 399.088166][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 399.168388][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.188687][ T4143] usb 2-1: config 0 descriptor?? [ 399.249428][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 399.286357][ T4143] scsi host1: usb-storage 2-1:0.0 16:48:55 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) sendmsg$inet(r0, &(0x7f0000002500)={0x0, 0x0, 0x0}, 0x0) 16:48:55 executing program 4: r0 = epoll_create1(0x0) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) setsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0) [ 400.309277][ T911] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 400.324686][ T911] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 400.349441][ T911] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 400.369070][T11558] usb 2-1: USB disconnect, device number 49 [ 400.375679][ T911] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 400.389858][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 400.406813][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 400.413147][ T256] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 400.423045][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 400.442127][ T256] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 400.457818][ T256] sd 1:0:0:1: [sdc] Write Protect is off [ 400.484605][ T256] sd 1:0:0:1: [sdc] Asking for cache data failed [ 400.492836][ T256] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 400.581257][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 400.638382][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 400.651191][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:48:56 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:56 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:56 executing program 3: write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:56 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:56 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) creat(0x0, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x5452, &(0x7f00000000c0)={'batadv_slave_0\x00', {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}) 16:48:56 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000002900)='/dev/ptmx\x00', 0x0, 0x0) dup3(r1, r0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 16:48:56 executing program 3: write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:56 executing program 0: r0 = socket(0x2, 0x2, 0x80000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000eff4)) r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x3) splice(r4, 0x0, r3, 0x0, 0x60000, 0x0) 16:48:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={r0, 0x11, 0x0, 0x0, 0x0}, 0x20) 16:48:56 executing program 4: socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) close(r2) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x5452, &(0x7f0000000000)) recvmsg$kcm(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0) recvmsg$kcm(r3, &(0x7f0000000340)={&(0x7f0000000080)=@x25={0x9, @remote}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000140)=""/173, 0xad}], 0x1, &(0x7f0000000240)=""/98, 0x62}, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x7f, 0xff, 0x8, 0x80, 0x0, 0x0, 0x420, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100), 0xfffffffffffffec6) socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f2, &(0x7f0000000000)='ip6gre0\x00') 16:48:56 executing program 3: write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:56 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 401.368307][T11558] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 401.468304][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 401.588467][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 401.608279][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 401.617919][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 401.628833][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 401.639441][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 401.649183][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.658176][T11558] usb 2-1: config 0 descriptor?? [ 401.709587][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 401.717154][T11558] scsi host1: usb-storage 2-1:0.0 [ 402.799020][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 402.809176][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 402.821418][ T256] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 402.829149][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 402.839162][ T12] usb 2-1: USB disconnect, device number 50 [ 402.860093][ T7] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 402.876133][ T7] sd 1:0:0:1: [sdc] Sense not available. [ 402.891349][ T7] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 402.911293][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 402.917892][ T7] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 402.933851][ T7] sd 1:0:0:1: [sdc] Write Protect is off [ 402.988313][ T7] sd 1:0:0:1: [sdc] Asking for cache data failed [ 402.994671][ T7] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 403.098500][ T7] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 403.118697][ T7] sd 1:0:0:1: [sdc] Sense not available. [ 403.148430][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:48:58 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:48:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r0, 0x6, 0xd, &(0x7f0000000200), 0x4) 16:48:58 executing program 0: socket(0x2, 0x2, 0x80000) epoll_create1(0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:48:58 executing program 3: r0 = open(0x0, 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:58 executing program 4: gettid() r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000001740)=""/102400}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syz_tun\x00', 0x100}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000080)) socket$kcm(0xa, 0x2, 0x11) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000001740)={0x0, 0x64, 0x0}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000100)=r2, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) 16:48:58 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:59 executing program 3: r0 = open(0x0, 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:59 executing program 0: socket(0x2, 0x2, 0x80000) epoll_create1(0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:48:59 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:48:59 executing program 3: r0 = open(0x0, 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:48:59 executing program 4: gettid() r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000001740)=""/102400}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syz_tun\x00', 0x100}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000080)) socket$kcm(0xa, 0x2, 0x11) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000001740)={0x0, 0x64, 0x0}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000100)=r2, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) 16:48:59 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 403.768203][ T12] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 403.868219][ T12] usb 2-1: Using ep0 maxpacket: 16 [ 403.988309][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 403.997978][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 404.009058][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 404.019520][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 404.030221][ T12] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 404.039985][ T12] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.049725][ T12] usb 2-1: config 0 descriptor?? [ 404.092218][ T12] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 404.099633][ T12] scsi host1: usb-storage 2-1:0.0 [ 405.108885][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 405.118717][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 405.133375][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 405.141938][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 405.149043][ T49] usb 2-1: USB disconnect, device number 51 [ 405.171105][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 405.194683][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 405.210398][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 405.227711][ T256] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 405.253422][ T256] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 405.264533][ T256] sd 1:0:0:1: [sdc] Write Protect is off [ 405.300411][ T256] sd 1:0:0:1: [sdc] Asking for cache data failed [ 405.330200][ T256] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 405.418329][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 405.443248][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 405.476431][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:01 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:01 executing program 2: socketpair(0x1e, 0x0, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x400c00) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x17, 0x9, 0x0, 0x0, 0x441, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x5, 0x5}, 0x40) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d9e3b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1d176bf9bb4dde984510c82dc2b93007db4cba8667e230a0c4906b29e010dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7d2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c0007af316bd8ed42f70300a208e4efd9d4ed88b37ab8d7674c644dca2f460b4e6284"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141429e0", 0x0, 0x10, 0x0, 0x3f000000}, 0x28) 16:49:01 executing program 0: socket(0x2, 0x2, 0x80000) epoll_create1(0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:49:01 executing program 5: perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:01 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000cacbf0b9c4b88449c3a926042512e17ea67ae330584734691f1946f7071a463143fb42c20e017feec42107f2e6ddbe1150296c6a6db4afa7c81bb8f788d231d4168f72dd748af53f734eda889a174c066e08e267f2ccabe50567a5ce35475c49d29e934a49d909e45376060f502d438f18257ff87bb1b4c6f15be97ea13bb2195438b43ade9b84bb9ac3bbdbbfc4668559ffdc25076687ed7c40842fae1b4e49520f48c28a66493f408e0b6580fdfbe0533397884333f795bc4b9d332108fe9073cc9ba6ad842c6a2f44380e352f391ce14dcbb11679ec237adb866eb8c0735f167607777a8e018488174ca40f03974daefd0f291ab7158de2d60eded18369d5cfc287d54721dcd12815a540107799bd1bb47a6a65200301feba0eee252c71b3824bc77f48e59890b2d4f5763db36d366631e77825a1fc802ba31c82b46937aafb835efaaa4eb29da89b3c2933defdad597648edf2815a22e1c1e7e958bf02708a4c76f7fd4cc1cb807e09d8f0d5174901ee"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x300}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xe000000, &(0x7f00000000c0)="b9ff030000ffffff7f9e14f005051fffffff000a4000630677fbac1414330200000162079f4b4d2f87e5feca6aab840413f2325f1a390101050a01000a0000000000df74e30d7eabe773afef6f6e4798ab117e9f84fa406b913de8ad827a022e1faee50887dc302819a8a3d0cde36b67f337ce8eee124e061f8fea8ab95f1e8f99c7edea980697449b78569ea293c3eed3b28fc3205db63b2c65e77f19ab28c632cc80d9f2f37f9ba67174fffcb5244b0c909eb8e12116bebc47cf97d2ea8acadfb34ca580b64df7c800113e53bae401cd22f50072deabf93dd4d3e626", 0x0, 0x9, 0x0, 0x296, 0x0, &(0x7f0000000000), &(0x7f0000000040)}, 0x28) 16:49:01 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:01 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:01 executing program 5: perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:01 executing program 0: r0 = socket(0x2, 0x2, 0x80000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) 16:49:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000cacbf0b9c4b88449c3a926042512e17ea67ae330584734691f1946f7071a463143fb42c20e017feec42107f2e6ddbe1150296c6a6db4afa7c81bb8f788d231d4168f72dd748af53f734eda889a174c066e08e267f2ccabe50567a5ce35475c49d29e934a49d909e45376060f502d438f18257ff87bb1b4c6f15be97ea13bb2195438b43ade9b84bb9ac3bbdbbfc4668559ffdc25076687ed7c40842fae1b4e49520f48c28a66493f408e0b6580fdfbe0533397884333f795bc4b9d332108fe9073cc9ba6ad842c6a2f44380e352f391ce14dcbb11679ec237adb866eb8c0735f167607777a8e018488174ca40f03974daefd0f291ab7158de2d60eded18369d5cfc287d54721dcd12815a540107799bd1bb47a6a65200301feba0eee252c71b3824bc77f48e59890b2d4f5763db36d366631e77825a1fc802ba31c82b46937aafb835efaaa4eb29da89b3c2933defdad597648edf2815a22e1c1e7e958bf02708a4c76f7fd4cc1cb807e09d8f0d5174901ee"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x300}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xe000000, &(0x7f00000000c0)="b9ff030000ffffff7f9e14f005051fffffff000a4000630677fbac1414330200000162079f4b4d2f87e5feca6aab840413f2325f1a390101050a01000a0000000000df74e30d7eabe773afef6f6e4798ab117e9f84fa406b913de8ad827a022e1faee50887dc302819a8a3d0cde36b67f337ce8eee124e061f8fea8ab95f1e8f99c7edea980697449b78569ea293c3eed3b28fc3205db63b2c65e77f19ab28c632cc80d9f2f37f9ba67174fffcb5244b0c909eb8e12116bebc47cf97d2ea8acadfb34ca580b64df7c800113e53bae401cd22f50072deabf93dd4d3e626", 0x0, 0x9, 0x0, 0x296, 0x0, &(0x7f0000000000), &(0x7f0000000040)}, 0x28) [ 406.006632][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 406.006652][ T27] audit: type=1804 audit(1588956541.612:42): pid=15373 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/150/bus" dev="sda1" ino=16366 res=1 16:49:01 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000cacbf0b9c4b88449c3a926042512e17ea67ae330584734691f1946f7071a463143fb42c20e017feec42107f2e6ddbe1150296c6a6db4afa7c81bb8f788d231d4168f72dd748af53f734eda889a174c066e08e267f2ccabe50567a5ce35475c49d29e934a49d909e45376060f502d438f18257ff87bb1b4c6f15be97ea13bb2195438b43ade9b84bb9ac3bbdbbfc4668559ffdc25076687ed7c40842fae1b4e49520f48c28a66493f408e0b6580fdfbe0533397884333f795bc4b9d332108fe9073cc9ba6ad842c6a2f44380e352f391ce14dcbb11679ec237adb866eb8c0735f167607777a8e018488174ca40f03974daefd0f291ab7158de2d60eded18369d5cfc287d54721dcd12815a540107799bd1bb47a6a65200301feba0eee252c71b3824bc77f48e59890b2d4f5763db36d366631e77825a1fc802ba31c82b46937aafb835efaaa4eb29da89b3c2933defdad597648edf2815a22e1c1e7e958bf02708a4c76f7fd4cc1cb807e09d8f0d5174901ee"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x300}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xe000000, &(0x7f00000000c0)="b9ff030000ffffff7f9e14f005051fffffff000a4000630677fbac1414330200000162079f4b4d2f87e5feca6aab840413f2325f1a390101050a01000a000e720000df74e30d7eabe773afef6f6e4798ab117e9f84fa406b913de8ad827a022e1faee50887dc302819a8a3d0cde36b67f337ce8eee124e061f8fea8ab95f1e8f99c7edea980697449b78569ea293c3eed3b28fc3205db63b2c65e77f19ab28c632cc80d9f2f37f9ba67174fffcb5244b0c909eb8e12116bebc47cf97d2ea8acadfb34ca580b64df7c800113e53bae401cd22f50072deabf93dd4d3e626", 0x0, 0x9, 0x0, 0x296, 0x0, &(0x7f0000000000), &(0x7f0000000040)}, 0x28) [ 406.168114][ T49] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 406.195433][ T27] audit: type=1804 audit(1588956541.652:43): pid=15375 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/150/bus" dev="sda1" ino=16366 res=1 [ 406.258235][ T49] usb 2-1: Using ep0 maxpacket: 16 [ 406.378496][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 406.395740][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 406.418201][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 406.437924][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 406.451811][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 406.461188][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.470507][ T49] usb 2-1: config 0 descriptor?? [ 406.509425][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 406.517254][ T49] scsi host1: usb-storage 2-1:0.0 [ 407.589232][ T256] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 407.599583][ T256] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 407.612807][ T256] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 407.622382][ T256] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 407.639155][T11558] usb 2-1: USB disconnect, device number 52 [ 407.671415][ T911] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 407.682334][ T911] sd 1:0:0:1: [sdc] Sense not available. [ 407.690749][ T911] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 407.697809][ T911] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 407.712132][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 407.722945][ T911] sd 1:0:0:1: [sdc] Write Protect is off [ 407.741007][ T911] sd 1:0:0:1: [sdc] Asking for cache data failed [ 407.778044][ T911] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 407.870221][ T911] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 407.913634][ T911] sd 1:0:0:1: [sdc] Sense not available. [ 407.936117][ T911] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:03 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:03 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:03 executing program 5: perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:03 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe20000000850000000d000000b7000000000000009500000000000000e36fe530cb7d7f933eda02baad181867514fe60077d4dd90123d3ee7cf43548ee8582ef11dcfe80b21a029a4ce6be614c2c794f72ebf5fe5178947df499a7ae31702c9c2d5a9db90c8c48258f8dbe82e16cf8db95f5b068a9e0000000000000000000000000000000000000000000000000000000000000018287ba7d8807c0ee93ea1bb7f00a15deb269d0a91985602763e4d70d404da006a3d6eef8fb7fcdd82eb1e48410d30c03e8f8808a3d32e488c90f3c3e459663575afe03e5593bf2b070053bb29a521b97d504cdfacd8215fb7a1dd3dbd500fac5cbf2d62655484b4f36998690bb70c377421654ea5ea9e8b2593eca3be6d1fd9167c2167d681226c903fdb7f9576d4621f682695b5d66ceab5ee2e9280548c6f1d621222de8af0aeba09c7a7a803fcd96c22197752d9caaf1d567b2be5322746c96b03144aff5a76eee81ef590959f3c3778f0208ea4831d980f75fc5366dd002122a38542a8e5e158fff3007a767d194dc5cfb64ccf45f6f35e519ea7f2baea242a4392233622f9999c392251c0ebc6f0f1d7ae8b841137f87aa3169e62be6f27ed5fc1f1355943ed35135fd9ced30472cc4cbaccc865d32941ba271ea3dee3bfecca2e2f871db20fc9394440a467de41da88c0b0635c93454a462cd94f9e30324f7570637b46a1fb9d6f7e3a404074"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r0, 0x8001a0, 0xe80, 0x5ac484bb51fa106a, &(0x7f0000000380)="4d50b441e692763513ef874588a8ffffffff00000000122e25d386dd", 0x0, 0x3b, 0x0, 0x22d}, 0x28) 16:49:03 executing program 0: r0 = socket(0x2, 0x2, 0x80000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r3, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x3) splice(r3, 0x0, r2, 0x0, 0x60000, 0x0) 16:49:03 executing program 2: 16:49:03 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 408.283563][ T27] audit: type=1804 audit(1588956543.892:44): pid=15476 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/151/bus" dev="sda1" ino=16366 res=1 16:49:03 executing program 2: 16:49:04 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f000000eff4)) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:49:04 executing program 2: 16:49:04 executing program 3: open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:04 executing program 4: [ 408.393295][ T27] audit: type=1804 audit(1588956543.892:45): pid=15476 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/151/bus" dev="sda1" ino=16366 res=1 [ 408.627996][T11558] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 408.631322][ T27] audit: type=1804 audit(1588956544.242:46): pid=15500 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/152/bus" dev="sda1" ino=16376 res=1 [ 408.718239][T11558] usb 2-1: Using ep0 maxpacket: 16 [ 408.837978][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 408.847673][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 408.877964][T11558] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 408.887785][T11558] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 408.897898][T11558] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 408.907148][T11558] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.916427][T11558] usb 2-1: config 0 descriptor?? [ 408.959196][T11558] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 408.980306][T11558] scsi host1: usb-storage 2-1:0.0 [ 409.988865][ T911] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 409.998689][ T911] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 410.010161][ T911] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 410.023414][ T911] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 410.030732][ T5] usb 2-1: USB disconnect, device number 53 [ 410.048291][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 410.064020][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 410.079591][ T256] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 410.088584][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 410.112584][ T256] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 410.133867][ T256] sd 1:0:0:1: [sdc] Write Protect is off [ 410.155386][ T256] sd 1:0:0:1: [sdc] Asking for cache data failed [ 410.177764][ T256] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 410.273257][ T256] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 410.296218][ T256] sd 1:0:0:1: [sdc] Sense not available. [ 410.316734][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:06 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:06 executing program 2: 16:49:06 executing program 4: 16:49:06 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:06 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:06 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:49:06 executing program 4: 16:49:06 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 410.625045][ T27] audit: type=1804 audit(1588956546.232:47): pid=15587 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/153/bus" dev="sda1" ino=16370 res=1 16:49:06 executing program 2: 16:49:06 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x0, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) [ 410.741051][ T27] audit: type=1804 audit(1588956546.262:48): pid=15587 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/153/bus" dev="sda1" ino=16370 res=1 16:49:06 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:06 executing program 4: [ 410.970368][ T5] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 411.068157][ T5] usb 2-1: Using ep0 maxpacket: 16 [ 411.198486][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 411.210611][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 411.220330][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 411.232431][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 411.244041][ T5] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 411.256369][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.266108][ T5] usb 2-1: config 0 descriptor?? [ 411.328959][ T5] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 411.343373][ T5] scsi host1: usb-storage 2-1:0.0 [ 412.388496][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 412.398247][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 412.412161][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 412.421422][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 412.442459][T10199] usb 2-1: USB disconnect, device number 54 [ 412.472010][ T21] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 412.497714][ T21] sd 1:0:0:1: [sdc] Sense not available. [ 412.510050][ T256] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 412.529832][ T21] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 412.597906][ T21] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 412.637808][ T21] sd 1:0:0:1: [sdc] Write Protect is off [ 412.659021][ T21] sd 1:0:0:1: [sdc] Asking for cache data failed [ 412.665363][ T21] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 412.740516][ T21] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 412.751541][ T21] sd 1:0:0:1: [sdc] Sense not available. [ 412.757365][ T21] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:08 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x0, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:08 executing program 2: 16:49:08 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:08 executing program 4: 16:49:08 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r2, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r2, 0x5421, &(0x7f0000000100)=0x3) splice(r2, 0x0, r1, 0x0, 0x60000, 0x0) 16:49:08 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:08 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:08 executing program 2: [ 413.059459][ T27] audit: type=1804 audit(1588956548.673:49): pid=15704 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/155/bus" dev="sda1" ino=16361 res=1 16:49:08 executing program 4: 16:49:08 executing program 2: 16:49:08 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:08 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 413.480287][T10199] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 413.607997][T10199] usb 2-1: Using ep0 maxpacket: 16 [ 413.751129][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 413.772427][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 413.786033][ T27] audit: type=1804 audit(1588956549.393:50): pid=15722 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/156/bus" dev="sda1" ino=16354 res=1 [ 413.811844][T10199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 413.823139][ T27] audit: type=1804 audit(1588956549.393:51): pid=15720 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/156/bus" dev="sda1" ino=16354 res=1 [ 413.848765][T10199] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 413.860803][T10199] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 413.871531][T10199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.883829][T10199] usb 2-1: config 0 descriptor?? [ 413.941410][T10199] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 413.985495][T10199] scsi host1: usb-storage 2-1:0.0 [ 415.028545][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 415.038346][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 415.050309][ T21] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 415.060386][ T21] scsi 1:0:0:1: Attached scsi generic sg2 type 0 [ 415.297757][ T5] usb 2-1: USB disconnect, device number 55 [ 415.310468][ T256] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 415.370805][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:11 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x0, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:11 executing program 4: 16:49:11 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="080db5055e0bcfe8479071") epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:11 executing program 2: 16:49:11 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:11 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:11 executing program 4: 16:49:11 executing program 2: 16:49:11 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:11 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:11 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:11 executing program 2: [ 416.197624][ T49] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 416.287766][ T49] usb 2-1: Using ep0 maxpacket: 16 [ 416.407946][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 416.427786][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 416.454479][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 416.478593][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 416.509141][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 416.528111][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.546415][ T49] usb 2-1: config 0 descriptor?? [ 416.585898][ T27] audit: type=1804 audit(1588956552.193:52): pid=15835 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/157/bus" dev="sda1" ino=16361 res=1 [ 416.612922][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 416.623758][ T27] audit: type=1804 audit(1588956552.193:53): pid=15842 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/157/bus" dev="sda1" ino=16361 res=1 [ 416.652594][ T49] scsi host1: usb-storage 2-1:0.0 [ 417.668168][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 417.678202][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 417.689269][ T29] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 417.700370][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 417.928476][ T5] usb 2-1: USB disconnect, device number 56 [ 417.945799][ T256] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 417.982654][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:14 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x0, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:14 executing program 4: 16:49:14 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x3) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) 16:49:14 executing program 2: 16:49:14 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:14 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:14 executing program 4: 16:49:14 executing program 2: 16:49:14 executing program 2: 16:49:14 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x3) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) 16:49:14 executing program 2: r0 = memfd_create(&(0x7f0000000180)='\xb3', 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) syz_mount_image$vfat(&(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0xaaaaaaaaaaaab9c, &(0x7f0000000180), 0x0, 0x0) 16:49:14 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 418.847532][ T49] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 418.967830][ T49] usb 2-1: Using ep0 maxpacket: 16 [ 419.087976][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 419.104529][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 419.114708][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 419.124847][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 419.136118][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 419.146589][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.162858][ T49] usb 2-1: config 0 descriptor?? [ 419.208552][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 419.260398][ T49] scsi host1: usb-storage 2-1:0.0 [ 419.315117][ T27] audit: type=1804 audit(1588956554.923:54): pid=15965 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/158/bus" dev="sda1" ino=16368 res=1 [ 419.384088][ T27] audit: type=1804 audit(1588956554.953:55): pid=15970 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/158/bus" dev="sda1" ino=16368 res=1 [ 420.310171][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 420.319929][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 420.332914][ T29] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 420.346404][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 420.568611][ T12] usb 2-1: USB disconnect, device number 57 [ 420.587827][ T7] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 420.632453][ T256] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:16 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x3) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x60000, 0x0) 16:49:16 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, 0x0, 0x68) 16:49:16 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfff, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:16 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(0x0, 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:16 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:16 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 16:49:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1, &(0x7f0000000100)=[{&(0x7f00000002c0)="a2eb5dd575fca5bbff0f715ac5b986b339de02335b480e871ce5dd0c504489d1c3835ab25a18f6546bed2a03580126639ce2d48ae4179da0ffa5e1cad13776576ec56b8d08aa3fc855a1e8b939d967ebf4bf80d1131c871228b1ecea2a4467f7ef57bd90d55505e423ea9272b27ab6667c14bdb49e1c17741124269a49f1facfe4a6d1719b08c4e5b372aef51098c2049c066c71150693db22fde2c48918f92707f198fed194037d9f604d56b35ae30091bcadd3642241f9a19221f44a8c6aa7ec3ff9ba11cfdbc7761827fd64ecd7c50654da5414f9808cd1f52a39bce4185845d5992124b79bc637b32c4ad6fd3e403f0e6ea78ca7b02c66bf0349525cca137c9a9d71a0ca419195cf073f983f9b702aa7bb6a7dabe8de4a124d955a3c61681c614ea2595cbcffe06472e2c56332599ced2d377f9f4a1e469cf4f9a204a4103006ab097f4dede6db1db7c30b0c8459a1b0ad2471b385346823207e6ea93b32f502d2e18a2bfd5147b09ba2ab52e9a3bd5f4c25e4c80cb9b39969164aab30e74c885e4b8c1942dc6b2d4b86f34b2f32144f70cca63d48bb68faa33de4ecdf38827fb39db8f78c043cf886065986762905a0828c6d3b7a23991f93d57c64d85d5962396cfacb0eef1a73b30296f0d7c2851b5e8bb1369896e0433884c46ea8319db3fa7e095b94040b817897154fb4a82201d3ef3f3f8737e2", 0x1f9, 0x7}], 0x8000, 0x0) 16:49:16 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x4000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/dev_mcast\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x0) 16:49:17 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 421.457457][ T49] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 421.549928][ T49] usb 2-1: Using ep0 maxpacket: 16 16:49:17 executing program 4: timer_create(0x2, 0x0, &(0x7f00000011c0)) timer_delete(0x0) 16:49:17 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 421.670426][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 421.685791][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 421.698577][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 421.710394][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 16:49:17 executing program 2: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="240000002e0007031dfffd946fa283002020020009000000001d85680c1ba3a20400ff6e280000005e00ff39e38e0d0857aa99b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15ab", 0x4c}], 0x1}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x401}) recvmmsg(r0, &(0x7f00000064c0), 0x36, 0x2, 0x0) [ 421.721699][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 421.735571][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.752358][ T49] usb 2-1: config 0 descriptor?? 16:49:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "05000000000000000000000000000000000100"}) r4 = syz_open_pts(r3, 0x0) dup3(r4, r3, 0x0) r5 = dup(r4) syz_kvm_setup_cpu$x86(r5, r2, &(0x7f0000fe1000/0x18000)=nil, 0x0, 0x55, 0x0, 0x0, 0x0) 16:49:17 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 421.798583][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 421.826670][ T49] scsi host1: usb-storage 2-1:0.0 16:49:17 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(0x0, 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) [ 422.867925][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 422.880773][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 422.919340][ T21] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 422.968445][ T21] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 423.158817][ T5] usb 2-1: USB disconnect, device number 58 [ 423.180303][ T7] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 423.209271][ T911] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:19 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:19 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:19 executing program 2: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="240000002e0007031dfffd946fa283002020020009000000001d85680c1ba3a20400ff6e280000005e00ff39e38e0d0857aa99b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15ab", 0x4c}], 0x1}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x401}) recvmmsg(r0, &(0x7f00000064c0), 0x36, 0x2, 0x0) 16:49:19 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffff7, 0x11, r2, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r3, &(0x7f0000001980), 0x5c9, 0x2000f760) 16:49:19 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(0x0, 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) 16:49:19 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffff7, 0x11, r2, 0x0) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f00000000c0)) 16:49:19 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e, 0x0, 0x42}}, 0x50) write$FUSE_ENTRY(r0, &(0x7f0000002840)={0x90, 0x0, 0x2}, 0x90) [ 423.954696][T16290] debugfs: Directory '16290-4' with parent 'kvm' already present! 16:49:19 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:19 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002840)={0x90, 0x0, 0x2}, 0x90) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0xfffffffffffffff5, 0x3}, 0x90) [ 424.067612][ T5] usb 2-1: new high-speed USB device number 59 using dummy_hcd 16:49:19 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 424.177535][ T5] usb 2-1: Using ep0 maxpacket: 16 [ 424.310715][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 424.328624][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 424.358246][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 424.371586][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 424.383025][ T5] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 424.407253][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.427877][ T5] usb 2-1: config 0 descriptor?? [ 424.468686][ T5] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 424.476416][ T5] scsi host1: usb-storage 2-1:0.0 [ 425.508116][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 425.518048][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 425.530106][ T29] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 425.545249][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 425.767906][ T5289] usb 2-1: USB disconnect, device number 59 [ 425.797305][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 425.829645][T16203] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:21 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:49:21 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:21 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:21 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(0x0, 0x141042, 0x0) 16:49:21 executing program 2: syz_emit_ethernet(0x4a, &(0x7f00000003c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a4f206", 0x14, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x60]}, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @loopback}}}}}}, 0x0) 16:49:21 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002840)={0x90, 0x0, 0x2}, 0x90) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0xfffffffffffffff5, 0x3}, 0x90) 16:49:22 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:22 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:22 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) [ 426.637300][ T12] usb 2-1: new high-speed USB device number 60 using dummy_hcd 16:49:22 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 426.738087][ T12] usb 2-1: Using ep0 maxpacket: 16 [ 426.856655][ T27] audit: type=1804 audit(1588956562.463:56): pid=16428 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/162/bus" dev="sda1" ino=16350 res=1 [ 426.879841][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 16:49:22 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r1, r1, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) 16:49:22 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 426.898358][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 426.943788][ T12] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 426.977515][ T12] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 427.009465][ T12] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 427.039565][ T12] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.069176][ T12] usb 2-1: config 0 descriptor?? [ 427.138504][ T12] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 427.159920][ T12] scsi host1: usb-storage 2-1:0.0 [ 428.227704][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 428.238327][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 428.250092][ T29] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 428.270806][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 428.498771][ T12] usb 2-1: USB disconnect, device number 60 [ 428.517113][ T911] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 428.559116][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:24 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:49:24 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:24 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:24 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff7000/0x4000)=nil, 0x0, 0x0, r0}, 0x87e9b1a5bf03cec0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x0) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, 0x0, 0x0) 16:49:24 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(0x0, 0x141042, 0x0) 16:49:24 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:24 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.sockprotoname\x00', &(0x7f0000000540)=""/245, 0xf5) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3}, 0x90) 16:49:24 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:24 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 429.437177][ T49] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 429.537357][ T49] usb 2-1: Using ep0 maxpacket: 16 16:49:25 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 429.631718][ T27] audit: type=1804 audit(1588956565.243:57): pid=16569 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/163/bus" dev="sda1" ino=16356 res=1 [ 429.657414][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 429.671706][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 429.692715][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 429.712299][ T49] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 16:49:25 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 429.734584][ T49] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 429.763629][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.776096][ T49] usb 2-1: config 0 descriptor?? [ 429.829089][ T49] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 429.868158][ T49] scsi host1: usb-storage 2-1:0.0 16:49:25 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) [ 430.947747][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 430.957771][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 430.970736][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 430.984029][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 431.208055][ T49] usb 2-1: USB disconnect, device number 61 [ 431.227139][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 431.299684][ T911] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:27 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:49:27 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(0x0, 0x141042, 0x0) 16:49:27 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:27 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:27 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.sockprotoname\x00', &(0x7f0000000540)=""/245, 0xf5) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3}, 0x90) 16:49:27 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:27 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:27 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40003022, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 432.162163][ T4143] usb 2-1: new high-speed USB device number 62 using dummy_hcd 16:49:27 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 432.277516][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 432.293579][ T27] audit: type=1804 audit(1588956567.903:58): pid=16721 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/164/bus" dev="sda1" ino=16352 res=1 16:49:28 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 432.437194][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 432.450990][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 432.464073][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 16:49:28 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, 0x0, 0x0) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 432.508849][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 432.534942][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 432.544882][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.595782][ T4143] usb 2-1: config 0 descriptor?? 16:49:28 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) [ 432.638073][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 432.717447][ T4143] scsi host1: usb-storage 2-1:0.0 [ 433.747408][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 433.757944][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 433.770658][ T21] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 433.785020][ T21] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 434.007817][ T5] usb 2-1: USB disconnect, device number 62 [ 434.029214][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 434.073305][ T911] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:30 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x3d) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 16:49:30 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000280)=0x1c, 0x80000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x2000805, 0x0) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) r2 = dup(r1) ioctl$UI_SET_SWBIT(r2, 0x4004556d, 0x0) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80386433, &(0x7f0000000340)=""/4096) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, &(0x7f00000002c0), &(0x7f0000000300)=0x8) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, {}, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe00, 0x0, 0x622b}) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x3, 0x21, [], 0x1, &(0x7f0000000000)=[{}], &(0x7f00000000c0)=""/33}, &(0x7f0000000180)=0x78) 16:49:30 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, 0x0, 0x0) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:30 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) 16:49:30 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:30 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) [ 434.621496][T16859] input: syz1 as /devices/virtual/input/input7 16:49:30 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, 0x0, 0x0) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:30 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) [ 434.727606][T16874] input: syz1 as /devices/virtual/input/input8 16:49:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) write$tun(r0, &(0x7f00000008c0)={@void, @val, @mpls={[], @ipv4=@gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x6558}, {}, {}, {0x8, 0x88be, 0x88caffff}}}}}, 0x62) 16:49:30 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 434.857501][ T5] usb 2-1: new high-speed USB device number 63 using dummy_hcd 16:49:30 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) [ 434.967095][ T5] usb 2-1: Using ep0 maxpacket: 16 16:49:30 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 435.089543][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 435.134195][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 435.185738][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 435.211326][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 435.235491][ T5] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 435.254219][ T27] audit: type=1804 audit(1588956570.863:59): pid=16866 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/165/bus" dev="sda1" ino=16349 res=1 [ 435.296911][ T27] audit: type=1804 audit(1588956570.863:60): pid=16870 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/165/bus" dev="sda1" ino=16349 res=1 [ 435.306781][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.369980][ T5] usb 2-1: config 0 descriptor?? [ 435.428080][ T5] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 435.480229][ T5] scsi host1: usb-storage 2-1:0.0 [ 436.547572][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 436.557503][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 436.569641][ T7] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 436.583572][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 436.811010][ T5289] usb 2-1: USB disconnect, device number 63 [ 436.832053][ T21] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 436.879540][ T911] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:32 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 16:49:32 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:32 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:32 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:32 executing program 4: 16:49:32 executing program 3: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r0, &(0x7f00000001c0), 0xffffff7f) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) 16:49:33 executing program 4: 16:49:33 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:33 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:33 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:33 executing program 4: 16:49:33 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(0x0, 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 437.727354][ T5289] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 437.819734][ T5289] usb 2-1: Using ep0 maxpacket: 16 [ 437.939540][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 437.959210][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 437.978958][ T5289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 438.006716][ T5289] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 438.016490][ T5289] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 438.033808][ T27] audit: type=1804 audit(1588956573.644:61): pid=17014 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/166/bus" dev="sda1" ino=16349 res=1 [ 438.079071][ T5289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.097436][ T27] audit: type=1804 audit(1588956573.644:62): pid=17015 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir070477935/syzkaller.bQ9lOx/166/bus" dev="sda1" ino=16349 res=1 [ 438.100553][ T5289] usb 2-1: config 0 descriptor?? [ 438.177916][ T5289] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 438.210987][ T5289] scsi host1: usb-storage 2-1:0.0 [ 439.267372][ T911] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 439.277285][ T911] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 439.292412][ T911] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 439.305765][ T911] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 439.529714][ T4143] usb 2-1: USB disconnect, device number 64 [ 439.552184][ T7] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 439.599003][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:35 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 16:49:35 executing program 4: 16:49:35 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:35 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:35 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:35 executing program 3: 16:49:35 executing program 4: 16:49:35 executing program 3: 16:49:35 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:35 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:35 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:36 executing program 4: [ 440.466657][ T4143] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 440.566870][ T4143] usb 2-1: Using ep0 maxpacket: 16 [ 440.686632][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 440.698879][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 440.710817][ T4143] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 440.721499][ T4143] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 440.744256][ T4143] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 440.765387][ T4143] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.779331][ T4143] usb 2-1: config 0 descriptor?? [ 440.817820][ T4143] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 440.839380][ T4143] scsi host1: usb-storage 2-1:0.0 [ 441.907315][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 441.917192][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 441.931494][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 441.940111][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 442.167891][T11558] usb 2-1: USB disconnect, device number 65 [ 442.186808][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 442.239906][ T21] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:38 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 16:49:38 executing program 3: 16:49:38 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:38 executing program 4: 16:49:38 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1c31a471c76fcd44961d295561c906c7f45fb3d2197e86aa42fa237e4880e1c43f22ef649b1e31f8eac87aef5fd0dc37827e4d4c83a4b80dcc5b6d97b441cbfc8", 0x81}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:38 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:38 executing program 3: 16:49:38 executing program 4: 16:49:38 executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000000c0)=0x17, 0x4) 16:49:38 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:38 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:38 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, 0x0, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 443.098974][ T4957] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 443.206750][ T4957] usb 2-1: Using ep0 maxpacket: 16 [ 443.326773][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 443.338823][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 443.349691][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 443.366483][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 443.389191][ T4957] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 443.408185][ T4957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.423466][ T4957] usb 2-1: config 0 descriptor?? [ 443.467694][ T4957] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 443.482846][ T4957] scsi host1: usb-storage 2-1:0.0 [ 444.546974][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 444.557457][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 444.568484][ T7] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 444.580062][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 444.807622][T10199] usb 2-1: USB disconnect, device number 66 [ 444.829137][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 444.878787][ T21] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:40 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) 16:49:40 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pselect6(0x2e, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, &(0x7f0000000080), 0x0) 16:49:40 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x705, 0x0, 0x25dfdbff, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r3}, @IFLA_HSR_SLAVE1={0x8, 0x1, r6}]}}}]}, 0x40}, 0x1, 0xf0}, 0x0) socket(0x0, 0x803, 0x0) 16:49:40 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:40 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:40 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, 0x0, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:41 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, 0x0, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:41 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:41 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:41 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="8e0ee8679b7129f69b334a", 0x2000000b}], 0x1) r1 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r1, 0x0) 16:49:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x705, 0x0, 0x25dfdbff, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r3}, @IFLA_HSR_SLAVE1={0x8, 0x1, r6}]}}}]}, 0x40}, 0x1, 0xf0}, 0x0) socket(0x0, 0x803, 0x0) [ 445.696359][ T4957] usb 2-1: new high-speed USB device number 67 using dummy_hcd 16:49:41 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, 0x0}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 445.796748][ T4957] usb 2-1: Using ep0 maxpacket: 16 [ 445.916586][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 445.938777][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 445.957898][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 445.988163][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 446.009743][ T4957] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 446.022132][ T4957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.032267][ T4957] usb 2-1: config 0 descriptor?? [ 446.079735][ T4957] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 446.123678][ T4957] scsi host1: usb-storage 2-1:0.0 [ 447.187045][ T21] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 447.197144][ T21] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 447.208886][ T21] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 447.221117][ T21] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 447.447280][ T4143] usb 2-1: USB disconnect, device number 67 [ 447.477714][ T7] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 447.508656][ T29] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:43 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) 16:49:43 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:43 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="8e0ee8679b7129f69b3341", 0x2000000b}], 0x1) r1 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r1, 0x0) 16:49:43 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:43 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, 0x0}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:43 executing program 3: syz_read_part_table(0x0, 0x2, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}, {&(0x7f0000001480)="2df75309e4df391d4376a6514bcc6ebf9f11cf1e59c3d25dd663d5bfc5ee3e1ce4bbf8f849177bf8e64b56ff1b37a08ef0d047158bf7bbcd92120c376977d81480d40c9bdc29fc62c56a6ac6b270a2adc28b35e8371d2bf999cf77c212542972279269f9e1b64d5a39ec8d764ecfcb06618ae104631a4ed170825c2d937e6927bf9500f69b2ba82a102134f0713bdd45cd8a1e27c1e748c2f5fa315c97a9ad0498dc3df368016f0fe8809007dedd5d4152e55fe98e9fe2e5f53612f6ee23244f8d32f9a23dc362d58ebbddd6bc7c738312f7c2e3af1a9d8cff9c58eeb0a43fb9f458116f6ecfa3adf94a31923e4cc3ade717b130133c5ad627905404f2ec2b96239abb0fbab13f0b8ea0685ba80752784137de47d7197d9089302ddfbc7757c36bf02ae633cadc24259ad881978706eadd0817085d890fde48dc2f7efbe34c57b809912cdf9e96d5a2de0e10d1d47318435a2c411d53ef7a8d672b3f0558a9b38e059136665e174495500fdd6a1bb2bf3e9c891734f3180ea4c3780adb548715730154665ba5d8d78b4ded68e91c9667d83b1c2adf23ea50b3de867d0a43e2b2a411392d933e1cc8b803403c508e0933a94837c9d578af7a2bff1f27a1a704dee265882252a11b8413cb200952ae6c6a7958529f6cd9b5c5", 0x1d8, 0x8}]) 16:49:43 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:43 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, 0x0}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:43 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x5c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x7f499eb2ae778c31}) dup3(r0, r2, 0x0) 16:49:43 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:43 executing program 3: syz_read_part_table(0x0, 0x2, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}, {&(0x7f0000001480)="2df75309e4df391d4376a6514bcc6ebf9f11cf1e59c3d25dd663d5bfc5ee3e1ce4bbf8f849177bf8e64b56ff1b37a08ef0d047158bf7bbcd92120c376977d81480d40c9bdc29fc62c56a6ac6b270a2adc28b35e8371d2bf999cf77c212542972279269f9e1b64d5a39ec8d764ecfcb06618ae104631a4ed170825c2d937e6927bf9500f69b2ba82a102134f0713bdd45cd8a1e27c1e748c2f5fa315c97a9ad0498dc3df368016f0fe8809007dedd5d4152e55fe98e9fe2e5f53612f6ee23244f8d32f9a23dc362d58ebbddd6bc7c738312f7c2e3af1a9d8cff9c58eeb0a43fb9f458116f6ecfa3adf94a31923e4cc3ade717b130133c5ad627905404f2ec2b96239abb0fbab13f0b8ea0685ba80752784137de47d7197d9089302ddfbc7757c36bf02ae633cadc24259ad881978706eadd0817085d890fde48dc2f7efbe34c57b809912cdf9e96d5a2de0e10d1d47318435a2c411d53ef7a8d672b3f0558a9b38e059136665e174495500fdd6a1bb2bf3e9c891734f3180ea4c3780adb548715730154665ba5d8d78b4ded68e91c9667d83b1c2adf23ea50b3de867d0a43e2b2a411392d933e1cc8b803403c508e0933a94837c9d578af7a2bff1f27a1a704dee265882252a11b8413cb200952ae6c6a7958529f6cd9b5c5", 0x1d8, 0x8}]) 16:49:43 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) [ 448.376420][ T4957] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 448.476514][ T4957] usb 2-1: Using ep0 maxpacket: 16 [ 448.609136][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 448.618983][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 448.632150][ T4957] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 448.642638][ T4957] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 448.655570][ T4957] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 448.665420][ T4957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.680184][ T4957] usb 2-1: config 0 descriptor?? [ 448.729073][ T4957] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 448.751315][ T4957] scsi host1: usb-storage 2-1:0.0 [ 449.836891][ T29] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 449.846661][ T29] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 449.858397][ T29] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 449.872024][ T29] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 450.107135][ T4957] usb 2-1: USB disconnect, device number 68 [ 450.121837][T16203] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 450.158561][ T7] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:46 executing program 1: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100006ff94610b4070a010201000000010902240001000000000904000002a6db5d000905091e000000000009058f02"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x3d) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) 16:49:46 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}], 0x1}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:46 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$setstatus(r0, 0x4, 0x6f5d070cab72df51) 16:49:46 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:46 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:46 executing program 3: syz_read_part_table(0x0, 0x2, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}, {&(0x7f0000001480)="2df75309e4df391d4376a6514bcc6ebf9f11cf1e59c3d25dd663d5bfc5ee3e1ce4bbf8f849177bf8e64b56ff1b37a08ef0d047158bf7bbcd92120c376977d81480d40c9bdc29fc62c56a6ac6b270a2adc28b35e8371d2bf999cf77c212542972279269f9e1b64d5a39ec8d764ecfcb06618ae104631a4ed170825c2d937e6927bf9500f69b2ba82a102134f0713bdd45cd8a1e27c1e748c2f5fa315c97a9ad0498dc3df368016f0fe8809007dedd5d4152e55fe98e9fe2e5f53612f6ee23244f8d32f9a23dc362d58ebbddd6bc7c738312f7c2e3af1a9d8cff9c58eeb0a43fb9f458116f6ecfa3adf94a31923e4cc3ade717b130133c5ad627905404f2ec2b96239abb0fbab13f0b8ea0685ba80752784137de47d7197d9089302ddfbc7757c36bf02ae633cadc24259ad881978706eadd0817085d890fde48dc2f7efbe34c57b809912cdf9e96d5a2de0e10d1d47318435a2c411d53ef7a8d672b3f0558a9b38e059136665e174495500fdd6a1bb2bf3e9c891734f3180ea4c3780adb548715730154665ba5d8d78b4ded68e91c9667d83b1c2adf23ea50b3de867d0a43e2b2a411392d933e1cc8b803403c508e0933a94837c9d578af7a2bff1f27a1a704dee265882252a11b8413cb200952ae6c6a7958529f6cd9b5c5", 0x1d8, 0x8}]) 16:49:46 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10121, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:49:46 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:46 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}], 0x1}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:46 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, 0x0, 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:46 executing program 3: syz_read_part_table(0x0, 0x2, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}, {&(0x7f0000001480)="2df75309e4df391d4376a6514bcc6ebf9f11cf1e59c3d25dd663d5bfc5ee3e1ce4bbf8f849177bf8e64b56ff1b37a08ef0d047158bf7bbcd92120c376977d81480d40c9bdc29fc62c56a6ac6b270a2adc28b35e8371d2bf999cf77c212542972279269f9e1b64d5a39ec8d764ecfcb06618ae104631a4ed170825c2d937e6927bf9500f69b2ba82a102134f0713bdd45cd8a1e27c1e748c2f5fa315c97a9ad0498dc3df368016f0fe8809007dedd5d4152e55fe98e9fe2e5f53612f6ee23244f8d32f9a23dc362d58ebbddd6bc7c738312f7c2e3af1a9d8cff9c58eeb0a43fb9f458116f6ecfa3adf94a31923e4cc3ade717b130133c5ad627905404f2ec2b96239abb0fbab13f0b8ea0685ba80752784137de47d7197d9089302ddfbc7757c36bf02ae633cadc24259ad881978706eadd0817085d890fde48dc2f7efbe34c57b809912cdf9e96d5a2de0e10d1d47318435a2c411d53ef7a8d672b3f0558a9b38e059136665e174495500fdd6a1bb2bf3e9c891734f3180ea4c3780adb548715730154665ba5d8d78b4ded68e91c9667d83b1c2adf23ea50b3de867d0a43e2b2a411392d933e1cc8b803403c508e0933a94837c9d578af7a2bff1f27a1a704dee265882252a11b8413cb200952ae6c6a7958529f6cd9b5c5", 0x1d8, 0x8}]) 16:49:46 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) [ 450.996169][ T5] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 451.096335][ T5] usb 2-1: Using ep0 maxpacket: 16 [ 451.226234][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 451.238838][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 451.249826][ T5] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 451.265206][ T5] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 0 [ 451.289506][ T5] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 451.308602][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.324900][ T5] usb 2-1: config 0 descriptor?? [ 451.369749][ T5] ums-alauda 2-1:0.0: USB Mass Storage device detected [ 451.377718][ T5] scsi host1: usb-storage 2-1:0.0 [ 452.396703][ T7] scsi 1:0:0:0: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 452.407219][ T7] scsi 1:0:0:1: Direct-Access Olympus MAUSB-10 (Alauda 0102 PQ: 0 ANSI: 0 CCS [ 452.419603][ T7] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 452.435636][ T7] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 452.668711][ T4143] usb 2-1: USB disconnect, device number 69 [ 452.696499][ T29] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 452.757171][T16203] sd 1:0:0:1: [sdc] Attached SCSI removable disk 16:49:48 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}], 0x1}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:48 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, 0x0, 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:48 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x9, &(0x7f0000000080)=[{&(0x7f0000000040)="2300000025000511d25a80648c63940d0424fc60040018000a001100022f000037153e", 0x23}], 0x1}, 0x0) socket$kcm(0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, 0x0, 0x0) 16:49:48 executing program 3: syz_read_part_table(0x0, 0x0, 0x0) 16:49:48 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:48 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="8e0ee8679b5d", 0x6}], 0x1) open(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 453.350771][T17779] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 453.385717][T17779] CPU: 0 PID: 17779 Comm: syz-executor.4 Not tainted 5.7.0-rc1-syzkaller #0 [ 453.394429][T17779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 453.394434][T17779] Call Trace: [ 453.394461][T17779] dump_stack+0x11d/0x187 [ 453.394485][T17779] sysfs_warn_dup.cold+0x1c/0x3d [ 453.394532][T17779] sysfs_do_create_link_sd.isra.0+0x115/0x120 [ 453.394552][T17779] sysfs_create_link+0x56/0x90 [ 453.394568][T17779] device_add+0x4f1/0x10b0 [ 453.394591][T17779] ? ieee80211_set_bitrate_flags+0xde/0x420 [ 453.394611][T17779] wiphy_register+0x1317/0x1820 [ 453.394633][T17779] ? ieee80211_register_hw+0x76d/0x1d70 [ 453.394698][T17779] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 453.394745][T17779] ieee80211_register_hw+0xc82/0x1d70 [ 453.394820][T17779] ? hrtimer_init+0x56/0x150 [ 453.464885][T17779] mac80211_hwsim_new_radio+0x12ff/0x1ad0 [ 453.464918][T17779] ? kasprintf+0x74/0xa0 [ 453.464940][T17779] hwsim_new_radio_nl+0x61f/0x860 [ 453.464974][T17779] genl_rcv_msg+0x409/0x8c0 [ 453.484456][T17779] netlink_rcv_skb+0xaf/0x260 [ 453.484475][T17779] ? genl_family_rcv_msg_attrs_parse+0x200/0x200 [ 453.484494][T17779] genl_rcv+0x2e/0x40 [ 453.484605][T17779] netlink_unicast+0x390/0x4c0 [ 453.504252][T17779] netlink_sendmsg+0x4cf/0x8a0 [ 453.509037][T17779] ? netlink_unicast+0x4c0/0x4c0 [ 453.513990][T17779] sock_sendmsg+0x98/0xc0 [ 453.518360][T17779] ____sys_sendmsg+0x493/0x4c0 [ 453.523221][T17779] ___sys_sendmsg+0xb5/0x100 [ 453.527827][T17779] ? __fget_files+0xa2/0x1c0 [ 453.532485][T17779] ? __fget_light+0xc0/0x1a0 [ 453.537083][T17779] ? __fdget+0x29/0x30 [ 453.541157][T17779] ? sockfd_lookup_light+0xa5/0x100 [ 453.546414][T17779] __sys_sendmsg+0x9b/0x150 [ 453.550971][T17779] __x64_sys_sendmsg+0x4c/0x60 [ 453.555828][T17779] do_syscall_64+0xc7/0x3b0 [ 453.560374][T17779] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 453.566269][T17779] RIP: 0033:0x45c829 [ 453.570203][T17779] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 453.589829][T17779] RSP: 002b:00007feedda60c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 16:49:49 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x9, &(0x7f0000000080)=[{&(0x7f0000000040)="2300000025000511d25a80648c63940d0424fc60040018000a001100022f000037153e", 0x23}], 0x1}, 0x0) socket$kcm(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40305829, 0x0) 16:49:49 executing program 3: syz_read_part_table(0x0, 0x0, 0x0) 16:49:49 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {0x0}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 453.598249][T17779] RAX: ffffffffffffffda RBX: 0000000000500b20 RCX: 000000000045c829 [ 453.606227][T17779] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 453.614206][T17779] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 453.622194][T17779] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 453.630189][T17779] R13: 00000000000009fd R14: 00000000004ccb59 R15: 00007feedda616d4 16:49:49 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {0x0}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 453.747232][T17816] debugfs: Directory '!' with parent 'ieee80211' already present! [ 453.793772][T17816] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 453.825613][T17816] CPU: 0 PID: 17816 Comm: syz-executor.1 Not tainted 5.7.0-rc1-syzkaller #0 [ 453.834478][T17816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 453.844528][T17816] Call Trace: [ 453.847829][T17816] dump_stack+0x11d/0x187 [ 453.852168][T17816] sysfs_warn_dup.cold+0x1c/0x3d [ 453.858674][T17816] sysfs_do_create_link_sd.isra.0+0x115/0x120 [ 453.864743][T17816] sysfs_create_link+0x56/0x90 [ 453.869509][T17816] device_add+0x4f1/0x10b0 [ 453.874035][T17816] ? ieee80211_set_bitrate_flags+0xde/0x420 [ 453.879932][T17816] wiphy_register+0x1317/0x1820 [ 453.884792][T17816] ? ieee80211_register_hw+0x76d/0x1d70 [ 453.890352][T17816] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 453.896253][T17816] ieee80211_register_hw+0xc82/0x1d70 [ 453.901631][T17816] ? hrtimer_init+0x56/0x150 [ 453.906225][T17816] mac80211_hwsim_new_radio+0x12ff/0x1ad0 [ 453.911941][T17816] ? kasprintf+0x74/0xa0 [ 453.916189][T17816] hwsim_new_radio_nl+0x61f/0x860 [ 453.921207][T17816] genl_rcv_msg+0x409/0x8c0 [ 453.925704][T17816] netlink_rcv_skb+0xaf/0x260 [ 453.930363][T17816] ? genl_family_rcv_msg_attrs_parse+0x200/0x200 [ 453.936681][T17816] genl_rcv+0x2e/0x40 [ 453.940652][T17816] netlink_unicast+0x390/0x4c0 [ 453.945399][T17816] netlink_sendmsg+0x4cf/0x8a0 [ 453.950147][T17816] ? netlink_unicast+0x4c0/0x4c0 [ 453.955077][T17816] sock_sendmsg+0x98/0xc0 [ 453.959393][T17816] ____sys_sendmsg+0x493/0x4c0 [ 453.964157][T17816] ___sys_sendmsg+0xb5/0x100 [ 453.968748][T17816] ? __fget_files+0xa2/0x1c0 [ 453.973318][T17816] ? __fget_light+0xc0/0x1a0 [ 453.977898][T17816] ? __fdget+0x29/0x30 [ 453.981953][T17816] ? sockfd_lookup_light+0xa5/0x100 [ 453.987232][T17816] __sys_sendmsg+0x9b/0x150 [ 453.991728][T17816] __x64_sys_sendmsg+0x4c/0x60 [ 453.996486][T17816] do_syscall_64+0xc7/0x3b0 [ 454.000994][T17816] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 454.006877][T17816] RIP: 0033:0x45c829 [ 454.010753][T17816] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 454.030628][T17816] RSP: 002b:00007fabb34f2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 16:49:49 executing program 3: syz_read_part_table(0x0, 0x0, 0x0) 16:49:49 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:49 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x9, &(0x7f0000000080)=[{&(0x7f0000000040)="2300000025000511d25a80648c63940d0424fc60040018000a001100022f000037153e", 0x23}], 0x1}, 0x0) socket$kcm(0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, 0x0, 0x0) [ 454.039034][T17816] RAX: ffffffffffffffda RBX: 0000000000500b20 RCX: 000000000045c829 [ 454.046984][T17816] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 454.054933][T17816] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 454.062882][T17816] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 454.070839][T17816] R13: 00000000000009fd R14: 00000000004ccb59 R15: 00007fabb34f36d4 16:49:49 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, 0x0, 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:49 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x9, &(0x7f0000000080)=[{&(0x7f0000000040)="2300000025000511d25a80648c63940d0424fc60040018000a001100022f000037153e", 0x23}], 0x1}, 0x0) socket$kcm(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40305829, 0x0) [ 454.184794][T17859] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 454.227960][T17859] CPU: 0 PID: 17859 Comm: syz-executor.4 Not tainted 5.7.0-rc1-syzkaller #0 [ 454.236647][T17859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 454.246695][T17859] Call Trace: [ 454.249993][T17859] dump_stack+0x11d/0x187 [ 454.254413][T17859] sysfs_warn_dup.cold+0x1c/0x3d [ 454.259366][T17859] sysfs_do_create_link_sd.isra.0+0x115/0x120 [ 454.265437][T17859] sysfs_create_link+0x56/0x90 [ 454.270295][T17859] device_add+0x4f1/0x10b0 16:49:49 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {0x0}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) [ 454.274693][T17859] ? ieee80211_set_bitrate_flags+0xde/0x420 [ 454.280578][T17859] wiphy_register+0x1317/0x1820 [ 454.285440][T17859] ? ieee80211_register_hw+0x76d/0x1d70 [ 454.291035][T17859] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 454.297016][T17859] ieee80211_register_hw+0xc82/0x1d70 [ 454.302385][T17859] ? hrtimer_init+0x56/0x150 [ 454.307028][T17859] mac80211_hwsim_new_radio+0x12ff/0x1ad0 [ 454.312813][T17859] ? kasprintf+0x74/0xa0 [ 454.317104][T17859] hwsim_new_radio_nl+0x61f/0x860 [ 454.322143][T17859] genl_rcv_msg+0x409/0x8c0 [ 454.326659][T17859] netlink_rcv_skb+0xaf/0x260 [ 454.331361][T17859] ? genl_family_rcv_msg_attrs_parse+0x200/0x200 [ 454.337666][T17859] genl_rcv+0x2e/0x40 [ 454.341630][T17859] netlink_unicast+0x390/0x4c0 [ 454.346413][T17859] netlink_sendmsg+0x4cf/0x8a0 [ 454.351169][T17859] ? netlink_unicast+0x4c0/0x4c0 [ 454.356171][T17859] sock_sendmsg+0x98/0xc0 [ 454.360503][T17859] ____sys_sendmsg+0x493/0x4c0 [ 454.365409][T17859] ___sys_sendmsg+0xb5/0x100 [ 454.369998][T17859] ? __fget_files+0xa2/0x1c0 [ 454.374583][T17859] ? __fget_light+0xc0/0x1a0 [ 454.379216][T17859] ? __fdget+0x29/0x30 [ 454.383326][T17859] ? sockfd_lookup_light+0xa5/0x100 [ 454.388533][T17859] __sys_sendmsg+0x9b/0x150 [ 454.393022][T17859] __x64_sys_sendmsg+0x4c/0x60 [ 454.397853][T17859] do_syscall_64+0xc7/0x3b0 [ 454.402339][T17859] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 454.408235][T17859] RIP: 0033:0x45c829 [ 454.412133][T17859] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 454.431714][T17859] RSP: 002b:00007feedda60c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 454.440537][T17859] RAX: ffffffffffffffda RBX: 0000000000500b20 RCX: 000000000045c829 [ 454.448488][T17859] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 454.456451][T17859] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 454.464413][T17859] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 454.472364][T17859] R13: 00000000000009fd R14: 00000000004ccb59 R15: 00007feedda616d4 [ 454.496450][T17865] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 454.504339][T17865] CPU: 1 PID: 17865 Comm: syz-executor.1 Not tainted 5.7.0-rc1-syzkaller #0 [ 454.513002][T17865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 454.523042][T17865] Call Trace: [ 454.526375][T17865] dump_stack+0x11d/0x187 [ 454.530692][T17865] sysfs_warn_dup.cold+0x1c/0x3d [ 454.535721][T17865] sysfs_do_create_link_sd.isra.0+0x115/0x120 [ 454.541780][T17865] sysfs_create_link+0x56/0x90 [ 454.546672][T17865] device_add+0x4f1/0x10b0 [ 454.551072][T17865] ? ieee80211_set_bitrate_flags+0xde/0x420 [ 454.556945][T17865] wiphy_register+0x1317/0x1820 [ 454.561802][T17865] ? ieee80211_register_hw+0x76d/0x1d70 [ 454.567331][T17865] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 454.573206][T17865] ieee80211_register_hw+0xc82/0x1d70 [ 454.578662][T17865] ? hrtimer_init+0x56/0x150 [ 454.583238][T17865] mac80211_hwsim_new_radio+0x12ff/0x1ad0 [ 454.588938][T17865] ? kasprintf+0x74/0xa0 [ 454.593206][T17865] hwsim_new_radio_nl+0x61f/0x860 [ 454.598341][T17865] genl_rcv_msg+0x409/0x8c0 [ 454.602851][T17865] netlink_rcv_skb+0xaf/0x260 [ 454.607650][T17865] ? genl_family_rcv_msg_attrs_parse+0x200/0x200 [ 454.614045][T17865] genl_rcv+0x2e/0x40 [ 454.618140][T17865] netlink_unicast+0x390/0x4c0 [ 454.622911][T17865] netlink_sendmsg+0x4cf/0x8a0 [ 454.627669][T17865] ? netlink_unicast+0x4c0/0x4c0 [ 454.632600][T17865] sock_sendmsg+0x98/0xc0 [ 454.636919][T17865] ____sys_sendmsg+0x493/0x4c0 [ 454.641687][T17865] ___sys_sendmsg+0xb5/0x100 [ 454.646346][T17865] ? __fget_files+0xa2/0x1c0 [ 454.650981][T17865] ? __fget_light+0xc0/0x1a0 [ 454.655694][T17865] ? __fdget+0x29/0x30 [ 454.659852][T17865] ? sockfd_lookup_light+0xa5/0x100 [ 454.665052][T17865] __sys_sendmsg+0x9b/0x150 [ 454.669553][T17865] __x64_sys_sendmsg+0x4c/0x60 [ 454.674305][T17865] do_syscall_64+0xc7/0x3b0 [ 454.678955][T17865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 454.684931][T17865] RIP: 0033:0x45c829 [ 454.688807][T17865] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 454.708408][T17865] RSP: 002b:00007fabb34f2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 454.716827][T17865] RAX: ffffffffffffffda RBX: 0000000000500b20 RCX: 000000000045c829 [ 454.725057][T17865] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 454.734065][T17865] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 454.742020][T17865] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 454.750153][T17865] R13: 00000000000009fd R14: 00000000004ccb59 R15: 00007fabb34f36d4 16:49:50 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:50 executing program 3: syz_read_part_table(0x0, 0x1, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}]) 16:49:50 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f00000000c0)={0xb, 0x10, 0xfa00, {0x0}}, 0x18) 16:49:50 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:50 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340), 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:50 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000080), 0x12) 16:49:50 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:50 executing program 1: creat(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000340)='/dev/null\x00', 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) linkat(r1, &(0x7f0000000100)='./file0\x00', r0, &(0x7f0000000140)='./file1\x00', 0x0) 16:49:50 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:50 executing program 3: syz_read_part_table(0x0, 0x1, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}]) 16:49:50 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:50 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340), 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:51 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="8e0ee8679b4a", 0x6}], 0x1) 16:49:51 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x400c00) 16:49:51 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:51 executing program 3: syz_read_part_table(0x0, 0x1, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}]) 16:49:51 executing program 0: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) bind$xdp(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendmsg$sock(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000b80)=[{0x0}, {&(0x7f0000000780)="1f11c391ebb0498200c347e9bd47244fd3a5c023544bcb8aa2529d374448452e2f7b27efda85e330dc9220b9081ef4e1f31c0e632cad4fc988caf71b479bc6c8e1", 0x41}], 0x2}, 0x4004045) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x3) splice(r1, 0x0, r0, 0x0, 0x60000, 0x0) 16:49:51 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340), 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:51 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="8e0ee8679b4a", 0x6}], 0x1) 16:49:51 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) fremovexattr(0xffffffffffffffff, &(0x7f00000001c0)=@known='trusted.overlay.upper\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f00000000c0)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) syz_genetlink_get_family_id$smc(0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) sendmmsg(r4, &(0x7f0000001980), 0x5c9, 0x2000f760) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000140)={0x7, 0x2, 0xde61, 0x100000000, 0x800000, 0x6}) write$binfmt_elf64(r3, &(0x7f0000000280)=ANY=[@ANYRES32=r3], 0x100000530) 16:49:51 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getsockname$packet(r6, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x705, 0x0, 0x25dfdbff, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r4}, @IFLA_HSR_SLAVE1={0x8, 0x1, r7}]}}}]}, 0x40}, 0x1, 0xf0}, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f0000000780)={0x0, 0x6, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYBLOB, @ANYBLOB='\x00'], 0x48}, 0x1, 0x0, 0x0, 0x4004040}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x581, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40421}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8}, @IFLA_HSR_SLAVE1={0x8, 0x1, r9}]}}}]}, 0x40}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000440)={0x2c8, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [{{0x8, 0x1, r4}, {0x4}}, {{0x8}, {0x4}}, {{0x8, 0x1, r4}, {0x120, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x24}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x8f0a}}}]}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x200}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x5}, {0xc, 0x4, [{0x7fff, 0xd6, 0x0, 0x3}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}]}}]}, 0x2c8}}, 0x20008000) 16:49:51 executing program 3: syz_read_part_table(0x0, 0x2, &(0x7f0000002580)=[{0x0, 0x0, 0x10001}, {0x0, 0x0, 0x8}]) 16:49:51 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9002, 0x0, 0x0, 0x0, 0x5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{0x0}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:49:51 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) r2 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f00000000c0)=ANY=[], 0xfffffecc) splice(r3, 0x0, r1, 0x0, 0x10000, 0x0) close(r2) socket(0x1000000010, 0x80002, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffdc, 0x0) [ 455.983926][T17984] ================================================================== [ 455.992055][T17984] BUG: KCSAN: data-race in vm_area_dup / vma_interval_tree_insert [ 455.999846][T17984] [ 456.002173][T17984] write to 0xffff888093154448 of 8 bytes by task 17990 on cpu 1: [ 456.009890][T17984] vma_interval_tree_insert+0x15d/0x220 [ 456.015450][T17984] __vma_adjust+0x645/0x1190 [ 456.020033][T17984] __split_vma+0x1fe/0x340 [ 456.024454][T17984] split_vma+0x69/0x90 [ 456.028520][T17984] mprotect_fixup+0x45d/0x530 [ 456.033193][T17984] do_mprotect_pkey+0x3da/0x640 [ 456.038040][T17984] __x64_sys_mprotect+0x4d/0x60 [ 456.042894][T17984] do_syscall_64+0xc7/0x3b0 [ 456.047391][T17984] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 456.053273][T17984] [ 456.055602][T17984] read to 0xffff8880931543e8 of 200 bytes by task 17984 on cpu 0: [ 456.063402][T17984] vm_area_dup+0x71/0x110 [ 456.067899][T17984] __split_vma+0x83/0x340 [ 456.072218][T17984] split_vma+0x69/0x90 [ 456.076284][T17984] mprotect_fixup+0x45d/0x530 [ 456.080956][T17984] do_mprotect_pkey+0x3da/0x640 [ 456.085899][T17984] __x64_sys_mprotect+0x4d/0x60 [ 456.090738][T17984] do_syscall_64+0xc7/0x3b0 [ 456.095217][T17984] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 456.101134][T17984] [ 456.103437][T17984] Reported by Kernel Concurrency Sanitizer on: [ 456.109573][T17984] CPU: 0 PID: 17984 Comm: modprobe Not tainted 5.7.0-rc1-syzkaller #0 [ 456.117701][T17984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 456.127749][T17984] ================================================================== [ 456.135794][T17984] Kernel panic - not syncing: panic_on_warn set ... [ 456.142360][T17984] CPU: 0 PID: 17984 Comm: modprobe Not tainted 5.7.0-rc1-syzkaller #0 [ 456.150481][T17984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 456.160526][T17984] Call Trace: [ 456.163811][T17984] dump_stack+0x11d/0x187 [ 456.168142][T17984] panic+0x210/0x640 [ 456.172043][T17984] ? vprintk_func+0x89/0x13a [ 456.176631][T17984] kcsan_report.cold+0xc/0x1a [ 456.181317][T17984] kcsan_setup_watchpoint+0x3fb/0x440 [ 456.186686][T17984] vm_area_dup+0x71/0x110 [ 456.191008][T17984] __split_vma+0x83/0x340 [ 456.195337][T17984] split_vma+0x69/0x90 [ 456.199428][T17984] mprotect_fixup+0x45d/0x530 [ 456.204108][T17984] do_mprotect_pkey+0x3da/0x640 [ 456.208957][T17984] __x64_sys_mprotect+0x4d/0x60 [ 456.213802][T17984] do_syscall_64+0xc7/0x3b0 [ 456.218306][T17984] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 456.224188][T17984] RIP: 0033:0x7fe10db093a7 [ 456.228692][T17984] Code: ff 66 90 b8 0b 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 8d 0d 89 bd 20 00 f7 d8 89 01 48 83 c8 ff c3 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 69 bd 20 00 f7 d8 89 01 48 83 [ 456.248281][T17984] RSP: 002b:00007ffee25579d8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a [ 456.256817][T17984] RAX: ffffffffffffffda RBX: 00007fe10dd149d8 RCX: 00007fe10db093a7 [ 456.265650][T17984] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007fe10dd13000 [ 456.273615][T17984] RBP: 00007ffee2557b10 R08: 0000000000000000 R09: 00007fe10d757b98 [ 456.281579][T17984] R10: 00007fe10dd14030 R11: 0000000000000206 R12: 00007fe10dd149d8 [ 456.289546][T17984] R13: 0000000000000007 R14: 00007fe10daf0000 R15: 00007fe10daf0438 [ 456.299132][T17984] Kernel Offset: disabled [ 456.303475][T17984] Rebooting in 86400 seconds..