last executing test programs: 8m6.382248865s ago: executing program 3 (id=1820): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) unshare(0x2040400) r2 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/wakeup_count', 0x42, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r2}, 0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e21, @loopback}}, 0x2, 0x8}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000240)={r3, 0x9}, &(0x7f00000002c0)=0x8) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000300)={0x4, 0xc, 0x7, 0x1, 0x3}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000340), 0x104081, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x80402) pwrite64(r4, 0x0, 0x0, 0x9) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) dup(0xffffffffffffffff) open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 8m2.528248162s ago: executing program 3 (id=1839): syz_emit_ethernet(0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008004500002c0000fffd001190780054760d870000000017"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="a03700002d00010026bd7000fcdbdf250400000005", @ANYRES32=r0, @ANYBLOB="81120c"], 0x37a0}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 8m2.380241141s ago: executing program 3 (id=1841): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000000c0)={'bond0\x00', @ifru_names='bond0\x00'}) r1 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x9, 0xb}}}}]}, 0x40}}, 0x44080) r4 = syz_open_dev$swradio(&(0x7f0000000440), 0x0, 0x2) ioctl$VIDIOC_G_FMT(r4, 0xc0d05604, &(0x7f0000000980)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) (async) listxattr(&(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './cgroup\x00'}) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xee8b6eeceab1b2aa}}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x100, 0x0, 0x0, {0x7, 0x0, 0x4}, @NFT_OBJECT_SECMARK=@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELSET={0x12c, 0xb, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_EXPRESSIONS={0x118, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}, {0x14, 0x1, 0x0, 0x1, @connlimit={{0xe}, @void}}, {0x4c, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_LOG_PREFIX={0x6, 0x2, 0x1, 0x0, '$\x00'}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x18}, @NFTA_LOG_PREFIX={0x9, 0x2, 0x1, 0x0, '.!^!\x00'}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x11}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x30}, @NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0xe29c}]}}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0x48, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x9}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SYNPROXY_MSS={0x6, 0x1, 0x1, 0x0, 0x39d0}, @NFTA_SYNPROXY_MSS={0x6, 0x1, 0x1, 0x0, 0x6}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x12}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x19}]}}}, {0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}, {0x38, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x13}]}}}]}]}, @NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWTABLE={0x2c, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELSET={0xbc, 0xb, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x19}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x9}, @NFTA_SET_USERDATA={0x72, 0xd, 0x1, 0x0, "7d433653a5947883f77710082fe3894b8e4ca43b338e8ab9653a29309f43d1d6e1e568ec5c29cb680c3c52577e79e9593e45a7339ace758e4dda6bbb8769933ace8336d314409cc5e598f9ede3bcb1f362a3ed096a82b1a1fc8724b462627eebb8ee7da47d15a12b6f42d3bfe5b2"}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x324}, 0x1, 0x0, 0x0, 0x40841}, 0x4040000) 8m2.130324828s ago: executing program 3 (id=1844): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) ioctl$DMA_BUF_IOCTL_SYNC(r5, 0x40086200, &(0x7f0000000080)=0x7) 8m0.652098665s ago: executing program 3 (id=1849): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001000000000000000000000000000000000002000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef) 8m0.350804154s ago: executing program 3 (id=1852): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xeeef0000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000100)=0x2000000e) r4 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r4, &(0x7f0000000300)="7db09f16", 0x4) ioctl$SNDRV_PCM_IOCTL_REWIND(r4, 0x40084146, &(0x7f0000000140)=0xfff) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000580)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) recvmmsg$unix(r8, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000040)={0x1c0000, 0x0, {[0x800, 0xff, 0x5, 0xf5f6, 0x0, 0x4, 0x3, 0xc15]}}) 8m0.073053593s ago: executing program 32 (id=1852): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xeeef0000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000100)=0x2000000e) r4 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r4, &(0x7f0000000300)="7db09f16", 0x4) ioctl$SNDRV_PCM_IOCTL_REWIND(r4, 0x40084146, &(0x7f0000000140)=0xfff) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000580)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) recvmmsg$unix(r8, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000040)={0x1c0000, 0x0, {[0x800, 0xff, 0x5, 0xf5f6, 0x0, 0x4, 0x3, 0xc15]}}) 9.850245668s ago: executing program 2 (id=3689): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfffffffffffffffd, 0x4, &(0x7f0000006680)) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) getitimer(0x0, &(0x7f0000000040)) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000000000090581034000000000090582"], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x4004550d, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001900)=[{{0x0, 0x0, &(0x7f0000004100)=[{&(0x7f0000004a40)="312908101225e7604aa5cabb", 0xc}], 0x1, &(0x7f0000000900)=ANY=[], 0x440}}], 0x1, 0x50) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) 8.393624133s ago: executing program 4 (id=3694): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x4b3, &(0x7f00000001c0)={0x0, 0x80086e1, 0x2, 0x8, 0x1}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000040)=[{0x0}, {&(0x7f0000000100)=""/154, 0x9a}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) getitimer(0x0, &(0x7f0000000040)) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000280)={0x2, 0x4e26, @multicast1}, 0x10) sendmmsg(r6, &(0x7f0000001900)=[{{0x0, 0x0, &(0x7f0000004100)=[{&(0x7f0000004a40)="312908101225e7604aa5cabb", 0xc}], 0x1, &(0x7f0000000900)=ANY=[], 0x440}}], 0x1, 0x50) sendmsg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0xc0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r8, 0x10e, 0x5, &(0x7f0000000000)=0x9, 0x4) syz_usb_control_io(r7, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 7.302097227s ago: executing program 1 (id=3699): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x3}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (rerun: 32) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f00000001c0)=0x4) (async) socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r2, @ANYRES16=r2, @ANYRESHEX], 0x0) (async, rerun: 64) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 64) io_setup(0x202, &(0x7f0000000200)=0x0) (async, rerun: 64) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 64) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_type(r5, &(0x7f0000000280), 0x2, 0x0) write$cgroup_type(r6, &(0x7f0000000180), 0x9) (async) io_submit(r4, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x8, 0x1, 0x0, r3, 0x0}]) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000200)={&(0x7f0000000000), 0x0, 0x0, 0x0, 0x2, r0}, 0x38) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000040)={0x1, 0x1, "ca935e33d919cd4e14870e7fe8dd1f1c4855b762502ed3d075f9f73ed75fafe7dac6f6a9f59f6c73552516a9b55a6efeefce1f2bec354378840683ab10d9d0e1f659b90254b0cc376dff9c1de8c0ba181be7841b64f65e29b82d30544fe2a10e67cef07f798d2453cd4db1dc7afe5d226454ab16882a671b5e6b5321e43b40e79aed014800e29145a3205a11d8df03d4a00161e803c7c3fbbdcdecb542c17c55acac9c7b74e9c09c13219bf9711d956614c73ce28e6103a86b0f45150a2a5a22658f22c5c9739b43adf3547e24a21e455f202256aa0c2e3a5cd75839ceab498e74a4e782a79583e229443d3075c3745855055031e4d6e35c892837983f8bc774"}) 6.541899334s ago: executing program 1 (id=3703): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) r2 = socket$inet(0x2, 0x3, 0x9) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0xffffffff, 0x6, 0x0) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000000)=0x8, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) fsopen(0x0, 0x0) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0xd0, r6, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0x9a, 0xa8, @random="516dcbb462a1efbdedbcfa9231b4bfa849ff387b7ff6176c733de694ba7da71bb827d0e9dae145bd433f6f72683d9e6ae880d516b4f23bc03e7da167a52136c8e532762740a44907cd0d83bf0a83f901b2ba4c603965bd57a712b460d12fde51e7bb2c21ee04168a44b4e96910398b1199f9bc99a5dfed8697878731a041fa10720387e54886cc566244c5af899ef6a80541a4c300cf"}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0xe0, r6, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x8}, @handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x100000007}, @DEVLINK_ATTR_RATE_NODE_NAME={0x6e, 0xa8, @random="85672b1a4bd849b6f9920873653650e8e03e20a0ad9d0f29e8ff049d7cc3b24699feef13340a761430d4511969b2016c60b967104fa3c18c33dbcc6f0778c0e34b7cd24110260f7634319e34e224e7d6fa1018b1974adcb0add9157a7c956f665dc995e53f678945abf1"}]}, 0xe0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) r7 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000040)={[{0x2b, 'cpuset'}]}, 0x8) syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x70202) socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$audio(0xffffffffffffff9c, &(0x7f0000000580), 0x80802, 0x0) 6.115291515s ago: executing program 2 (id=3704): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000005c0), 0x10) recvmmsg(r2, &(0x7f0000001000)=[{{&(0x7f0000000040)=@l2tp={0x2, 0x0, @remote}, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=""/53}]}, 0x3ff}, {{&(0x7f00000001c0)=@tipc=@id, 0x0, &(0x7f0000000940)=[{&(0x7f0000000280)=""/41}, {&(0x7f0000000400)=""/160}, {&(0x7f0000000340)=""/62}, {&(0x7f00000004c0)=""/73}, {&(0x7f0000000600)=""/201}, {&(0x7f0000000540)=""/15}, {&(0x7f0000000580)=""/1}, {&(0x7f0000000700)=""/189}, {&(0x7f00000007c0)=""/168}, {&(0x7f0000000880)=""/145}], 0x0, &(0x7f0000000a00)=""/146}, 0x4}, {{&(0x7f0000000ac0)=@isdn, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000b40)=""/26}, {&(0x7f0000000b80)=""/232}, {&(0x7f0000000c80)=""/88}, {&(0x7f0000000d00)=""/46}, {&(0x7f0000000d40)=""/224}, {&(0x7f0000000e40)=""/111}], 0x0, &(0x7f0000000f40)=""/168}}], 0xde0fddea64781a, 0x10002, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000002040)=0x4, 0x4) (async) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000002040)=0x4, 0x4) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000001d40)=0xe, 0x4) sendmsg$NL80211_CMD_GET_MPP(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000690005"], 0x28}}, 0x0) recvmmsg(r3, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/91, 0x5b}}, {{&(0x7f0000000000)=@isdn, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/225, 0x1}, {&(0x7f00000001c0)=""/65}, {&(0x7f0000000d40)=""/4095, 0x1f}, {&(0x7f0000000240)=""/99}, {&(0x7f00000002c0)=""/122}, {&(0x7f0000000340)=""/217}, {&(0x7f00000008c0)=""/35}, {&(0x7f0000000500)=""/214}, {&(0x7f0000000600)=""/1}]}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000780)=""/32}], 0x0, &(0x7f00000009c0)=""/126}}], 0x40000000000024a, 0x40002002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) 5.68583803s ago: executing program 5 (id=3705): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba350000ff800000000700ff020000000000000000000000000001000000000000000000000000000033"], 0xfdef) 5.314072911s ago: executing program 5 (id=3706): syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x258a, 0x6a88, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x6}}}}}]}}]}}, 0x0) r0 = socket(0x2a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendto$inet6(r5, &(0x7f0000000340)="d4d7efad020efa27e4b5b271825ef53d030f992ff58468566c6fc090ac508f876b89a6004f4d6aa59f13c8afda4bfc2137c8a1d584595b77c2a5f6a72a6d627f3408143aae7315bb608e1557b707b38c30f447a288036c", 0x57, 0x10, 0x0, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x38011, r6, 0x2c9ab000) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, 0x0, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000700)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1e71, 0x200e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x8, 0x40, 0xff, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x2, 0x6, {0x9, 0x21, 0x7, 0x9, 0x1, {0x22, 0x480}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x81, 0x44, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x4, 0x7, 0xff}}]}}}]}}]}}, &(0x7f0000000900)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0x0, 0x3, 0x5, 0x8, 0x9}, 0xca, &(0x7f0000000780)={0x5, 0xf, 0xca, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x3, 0x4, 0xfff}, @generic={0xbe, 0x10, 0x1, "fef4382735f3d212e98f9c78fdebc4d6b219ee762888eefcbab856e99a3ce3009b8220161a8e145866c5a8ecd9cc62d8e99bb0dc9b8a8b5b6365d53b081fe893f2ef166f8266a31c38cd0285d6d4f63b4ab07ef6c25cb2098a902c201587e02b18ace9520a93b3e635671511ac221d94d02c083119b419fa774f6f442da63eeced89eb8581cb1009379a254cd466f07848492b74dbcc02607c9262230f45c61b9998a6f72e2bb9fa3834a19663f5fd60694011f46c4763684f5ae9"}]}, 0x2, [{0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x437}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x2c0a}}]}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) 5.195314702s ago: executing program 4 (id=3707): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) read$FUSE(r2, &(0x7f00000002c0)={0x2020}, 0x2020) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x8, 0x0, 0x100000001, 0x0, 0x0, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}}, 0xb8}}, 0x4004) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e0000002000000000000000000000000000000000000000000000000100000000000009a100000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) (fail_nth: 8) 4.324323423s ago: executing program 2 (id=3709): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000ac0)=ANY=[@ANYBLOB="fcff81000000ae"], 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000040)=""/27, 0x1b) (async, rerun: 32) r2 = syz_open_dev$vbi(&(0x7f0000000140), 0x0, 0x2) (rerun: 32) ioctl$VIDIOC_QBUF(r2, 0xc058565d, &(0x7f0000000300)=@mmap={0x200, 0x6, 0x4, 0x800, 0x3, {}, {0x4, 0x8, 0x8, 0x7, 0xff, 0xaf, "db4af6e8"}, 0x200, 0x1, {}, 0x9}) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f0000000280)=ANY=[@ANYBLOB="400300eeff04"], 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000000)={0x44, &(0x7f0000000640)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) (async, rerun: 64) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 64) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x1, 0x100, @private0, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000000)={r7, @in6={{0xa, 0x4e24, 0x19b, @loopback, 0x101}}, [0xfffffffffffffffe, 0xfffffffffffffffd, 0x6, 0x5, 0x8, 0x4, 0x9, 0x800, 0x5, 0x8, 0x6, 0x81, 0x3, 0xa, 0xffff]}, &(0x7f0000000180)=0x100) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000840)={0x0, 0x4, 0x2, 0x80000000, r6}, 0x10) (async) r8 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfec9}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async, rerun: 64) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x19, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x200}}) (async, rerun: 64) io_uring_enter(r8, 0xdb4, 0x0, 0x0, 0x0, 0x0) (async) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r8, 0x18, &(0x7f0000000000)={0x6, 0xffffffffffffffff, 0x21, {0x4, 0x1}, 0x6}, 0x1) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r11 = syz_open_dev$loop(&(0x7f0000000100), 0xd5d1, 0x0) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r11, 0x4c0a, &(0x7f00000002c0)={r12, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x1, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000100", "2809e8dbe108598948224aee4afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x4, 0x2000000000001]}}) (async, rerun: 32) r13 = syz_open_dev$loop(&(0x7f0000000880), 0x3, 0x0) (rerun: 32) ioctl$LOOP_SET_FD(r13, 0x4c00, r11) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) (async, rerun: 64) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000001800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f0000000940)=ANY=[@ANYBLOB="40308c0000008c0b6edfb9cd873092c16e409f644b4ec08d5cfc5f98d650c2774562e78ce0cd243456c0ac74f134a419a33de8c428ac3a7cb3bb9a6e42b4577fc1541088a3ddc510427f0855cf5f0b98f116afa6754bc56696d238c45ef16d11303b39b0ecbc5f3172ac47dcbc5fd2b94a6a9fb4800c91249425dd4c138eaae7efe6a0d0dafa11ea7cd16c3ab1b40b26002a711f2bcf1b6a4e84bbeba962c8848d786d5ef1813e9a71509a9028bf551b392c95b4effe79975fc2e15a6550903951cee9cdd21d283c6c4acba59d3a14b5b3a7f7d3dd2f"], &(0x7f0000000a40)=ANY=[@ANYBLOB="00033b0000003b00426e08913f0c0d6f580c698c0375e2458306509a2b69137704aff377a649868248c3a03ff5f0fb5bf33ef1aeef9d05a81abd223a2773787028"], &(0x7f00000001c0)={0x0, 0xf, 0x2b, {0x5, 0xf, 0x2b, 0x2}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x2, 0x56, 0x2, "7763177f", "c79e384f"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x0, 0xd5, 0x4, 0x18, 0x2, 0xd11}}}, &(0x7f0000000780)={0x84, &(0x7f00000008c0)={0x20, 0x17, 0xaa, "9545a14b3ce15825f80e61afed976afbb73255cb5e9f6b891694321d242ac9b2d743c1cf8833bc987ab9096e36912f9f3eb9b44717f913e0982becaccb7d484a936542f48e576e326c711a9a4fe15fefde9f210410e5ea1be475b700002149c73b8d8028fbf74a77d5006f0e27be"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xb3}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x3}}, &(0x7f0000000480)={0x20, 0x0, 0xffffffffffffff0d, {0x1c00, 0x10, [0xf0]}}, &(0x7f00000004c0)={0x40, 0x7, 0x2, 0xff}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000540)={0x40, 0xb, 0x2, 'sC'}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0x7f}, &(0x7f00000005c0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000600)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x19, 0x2, "a66b"}, &(0x7f0000000680)={0x40, 0x1a, 0x2, 0x81}, &(0x7f00000006c0)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000700)={0x40, 0x1e, 0x0, 0xf1}, &(0x7f0000000740)={0x40, 0x21, 0x1, 0x80}}) 4.323489934s ago: executing program 1 (id=3710): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000480)=ANY=[@ANYBLOB='-', @ANYRESDEC=r3], 0x27) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 4.085719764s ago: executing program 4 (id=3711): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff0200000000000000000000000000010000000000000000000000000000002c0000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef) 4.028603522s ago: executing program 1 (id=3712): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1702}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) 3.931659216s ago: executing program 1 (id=3713): preadv(0xffffffffffffffff, &(0x7f0000001740), 0x0, 0x80073, 0xff7ef002) socket$kcm(0x21, 0x2, 0xa) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) syz_emit_ethernet(0x50, &(0x7f0000002e40)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x1a, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{}]}}}}}}, 0x0) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00cd04", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x5a, 0x1, 0x0, 0x5000000, [{0x3, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "000005000000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea468000000000054740a5d4901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2bce9ac946a3f0e2bc4000091394c02bcfbbb7d71138537d68e2d2c6393a9f3cc271a9ff09a48b5b303f4f0"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14ccb44d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d260600aa89c8f267d76ece1c9f6ae2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 3.769988503s ago: executing program 1 (id=3714): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfffffffffffffffd, 0x4, &(0x7f0000006680)) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) getitimer(0x0, &(0x7f0000000040)) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000000000090581034000000000090582"], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x4004550d, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001900)=[{{0x0, 0x0, &(0x7f0000004100)=[{&(0x7f0000004a40)="312908101225e7604aa5cabb", 0xc}], 0x1, &(0x7f0000000900)=ANY=[], 0x440}}], 0x1, 0x50) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.730956389s ago: executing program 4 (id=3715): syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x7, 0x0, 0x3}}}}}}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000000000000000000000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 3.474307594s ago: executing program 4 (id=3717): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) (fail_nth: 13) 3.297357047s ago: executing program 0 (id=3718): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x82042, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) (async) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) (async) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r5, 0xca, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x0, 0x0, r4, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) (async) socket$kcm(0x2c, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f00000001c0)=0x100000, 0x4) (async) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) (async, rerun: 64) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f0000000040), 0x4) (async, rerun: 64) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x3ff, &(0x7f0000000100)=0x6) (async) sync() 2.996869461s ago: executing program 4 (id=3719): r0 = syz_open_dev$vim2m(&(0x7f0000000780), 0x83, 0x2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x3, 0x0, 0x7, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0x0, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000004340), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r5, 0xc0f8565c, &(0x7f0000000000)={0x0, 0x6, 0x0, {0xa, @pix_mp={0x0, 0x0, 0x41415270, 0x0, 0x0, [{}, {}, {0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x7}], 0x7}}, 0xfffffffc}) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af60, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x0, 0x0}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0xad82, 0x0) write$sndseq(r6, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xc001, 0x0, 0x0) syz_usb_connect(0x0, 0x12, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x24}}, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000800)={0x0, 0x2, 0x4, "8eb8a828e93b07f1dd06da7a41bfeac48048beb159fbba176fb1de26098c68d9", 0x32314d48}) syz_usb_connect(0x5, 0x24, &(0x7f0000004680)={{0x12, 0x1, 0x310, 0x8, 0x31, 0xd8, 0x10, 0x499, 0x1507, 0xaa69, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0xba, 0x30, 0x7, [{{0x9, 0x4, 0x3, 0xdd, 0x0, 0xff, 0xff, 0xff, 0xc1}}]}}]}}, &(0x7f0000005400)={0x0, 0x0, 0x0, 0x0}) 2.926164409s ago: executing program 0 (id=3720): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) r2 = socket$inet(0x2, 0x3, 0x9) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0xffffffff, 0x6, 0x0) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000000)=0x8, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) fsopen(0x0, 0x0) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0xd0, r6, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0x9a, 0xa8, @random="516dcbb462a1efbdedbcfa9231b4bfa849ff387b7ff6176c733de694ba7da71bb827d0e9dae145bd433f6f72683d9e6ae880d516b4f23bc03e7da167a52136c8e532762740a44907cd0d83bf0a83f901b2ba4c603965bd57a712b460d12fde51e7bb2c21ee04168a44b4e96910398b1199f9bc99a5dfed8697878731a041fa10720387e54886cc566244c5af899ef6a80541a4c300cf"}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0xe0, r6, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x8}, @handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x100000007}, @DEVLINK_ATTR_RATE_NODE_NAME={0x6e, 0xa8, @random="85672b1a4bd849b6f9920873653650e8e03e20a0ad9d0f29e8ff049d7cc3b24699feef13340a761430d4511969b2016c60b967104fa3c18c33dbcc6f0778c0e34b7cd24110260f7634319e34e224e7d6fa1018b1974adcb0add9157a7c956f665dc995e53f678945abf1"}]}, 0xe0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) r7 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000040)={[{0x2b, 'cpuset'}]}, 0x8) syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x70202) socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$audio(0xffffffffffffff9c, &(0x7f0000000580), 0x80802, 0x0) 2.901586756s ago: executing program 2 (id=3721): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46a, 0x27, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x45}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000140)={0x14, &(0x7f0000000200)={0x20, 0x8, 0x45, {0x45, 0x21, "f55c10de9b8300ffd08a25211254aa82c9d5bd4018f0f6150b15fd369b1265c4130e98e3b392ae53bfa88113c38f63a6aed73f85631c02ba5017b036a150f1c2a748d1"}}, 0x0}, 0x0) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) r2 = syz_usb_connect$cdc_ecm(0x4, 0x125, &(0x7f0000000e00)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x113, 0x1, 0x1, 0x5, 0x90, 0x7, [{{0x9, 0x4, 0x0, 0x8, 0x3, 0x2, 0x6, 0x0, 0x41, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x5, 0x7, 0xe2}, [@mbim_extended={0x8, 0x24, 0x1c, 0x2, 0xc6, 0xff}, @ncm={0x6, 0x24, 0x1a, 0xb, 0x24}, @mbim_extended={0x8, 0x24, 0x1c, 0x9, 0xf7, 0x6}, @mdlm_detail={0xb9, 0x24, 0x13, 0x9, "1adacfd3899dbc65ba38336f24e0053b1e3915f95394f666d4c148a2f8703cfa33fc3729348822965dc388d92d599c9e3685c9439ca7f9ecc8821d9a1ad99d8893b7eca83d13e6cd3840c6cc7c503fb81e4e61496f68e364fe8633b361ebd9f98ae99f39ce88131864642eb8e09ecf7033188f07446e28571f2cf8c9b303d7701ab9bd53fcadaa5eed291785b2a84e5956ee96c7a5cffb1f4ed32915eb17af773eccb6d7347bec6beefce8a5d4599f6029b91838c4"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x10, 0xa, 0x0, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x0, 0x4, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x1, 0x2, 0x2}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0x4, 0x5, 0x9, 0x9f, 0x5}, 0x2a, &(0x7f0000000100)={0x5, 0xf, 0x2a, 0x3, [@ssp_cap={0x10, 0x10, 0xa, 0x4, 0x1, 0xff, 0x0, 0x9, [0xcf]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0xc, 0x3, 0x3ed}, @wireless={0xb, 0x10, 0x1, 0xc, 0xa2, 0x5e, 0x3, 0xd, 0xb}]}, 0x6, [{0x56, &(0x7f0000000d80)=@string={0x56, 0x3, "a26cd38f91dcf6138e016872e9597039849fd9ca484196ef1708e90fcf8b15db35c2d1a90d13f32f78564084d76f916af2b8d1ce21ba82914615b37eaf3336321b4a84918eb50154a0874192c2dfdee46305d57f"}}, {0xed, &(0x7f0000000400)=@string={0xed, 0x3, "4c7509d39611f240d5ef9f0c575a66b4def163a9310468a6e6409a99a57e5e9a33677862f65510a3a6ce26a3235e444ce932e8b60f198a5f9feb424cf0097907b7f4e8a434cebe8b60b5019a0da33ae1225a5a14a2ff3af72ba3019b3a2ca8c77f0286004728d359bca7a2132e8928e87c66736c236abc5d18303785c203fa6485bf370c6df4bfa00fd6f6cdb9061826195f3b8da38ba4c92df3bc76d63e3c231a0208071c9dc98da180c996ce9131bb004750533c429230b52d5869abe0345a0ead1759ed6c9a520881394a0cba59b4862f954d8abc8b45a19bab7618c078bb13d2a7bf0f2b2cbe3d210d"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2801}}, {0xef, &(0x7f0000000500)=@string={0xef, 0x3, "1850ed4c1c5bd2818fac7fe99403476ceae741009311d06c311c2729f1c8c6498cb45f538a4558837056e19a6740dc3ca2bcee08e0b4c8aeb109e28d52130547d32a6da0abea3c4efa438a3d169d35bf262ad248b39b99ecabdd32918d6a9d36fd8abc54520585fcba5c7764f70e710a8be0cbf1cf5f1fee072829906d545c266071e2eb91803d7a1f68d1ab52767be58f1aadac90cb23f71d5e5c593cde6a816ec026b0b729d3884965dd1d1b9ca52fc0e5455ef26992c0f0d2b6220b7bc610b8c24de3c2534fc79f027db92f8a2f0beffdf96571308624d79e15feadf5c0dc1ec77ee29c77ea320fc01724f7"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x1004}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x408}}]}) rseq(&(0x7f0000000200), 0x20, 0x4000000000, 0x0) futex(&(0x7f0000000000)=0x3, 0x9, 0x0, 0x0, &(0x7f0000000140), 0xc6fffffe) r3 = syz_usb_connect$lan78xx(0x1, 0x3f, &(0x7f0000000900)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r3, &(0x7f0000000ac0)={0x14, &(0x7f0000000940)={0x0, 0x22, 0x9f, {0x9f, 0x22, "47007776b1472ffadc7002f405cded989a3625927c0e388b1b098a65677e50c8eafa1fa2f65375ab5a1296a9b64928d2039abee5022dd1de678eb89344a43928e6318332589b94d514ba2052e902b1a0d9780cd8b713099b99c57b5809f3e8f02843fef48042e9b6f04289465bda56387a0a58c4207c05c7bf25bad66ac58be766b9637587a2212601fd4215800f03b39eda8c78a963ff98e70efc9b85"}}, &(0x7f0000000f40)=ANY=[@ANYBLOB="0003ab000000ab03aaa09ca6709da221889eb61dcbcaafd2777251e9718b3ba8b7d6a63198fb39f447cde0c9e7a73555d79c75823338ba789531975a5ffdfc6666fa18aacf50f31670fd2d897ee912c173f6061ea563a1cb5712fa52b6d1620ee830c0c3f23228f37eeb5b7f290b81050000007d3da3e73e0ee9803d28fbecabd021e30cf51729078a81b8dd7f1a77ad8ac8e0c7e622733c709b88866d2257ebdebaa0d3a8842b3f79286670eef78f1fb7dd58031656207fbac0d393011664bf7bf1c01ed80be08ff9acecf98f26a6f9bc998cff081b57de3676179b762769304d603c739febd1a2083193e51cd164814bee977386d36dacfd011830bb7f1e7373356aadcbc9f00c70535ae86ea1b8f3f576eec3088c26fc3344a14784cd9d31b16b46966503daef350a41de1a9ed60d83331295b8b39442a30ad529e0d2e7c2fac715f1715024b8aebbd426a908ec0d6eee02f31eb2004bc4a34520745f02ea88bd2830e2bff818d255af2608145b449e0a8a75"]}, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x20, 0xd, 0xee, "340623b313d9d467c2e5f3d3e870d5577f5c19cb20a9f566a957cd2dff6f40e31c6273106b33796b37270019a13f4483aa5c9ca5097a85a20b5e835b7eb8edae5297706e88e4c561bd6f8a82e57b6f2393768121f2449a8eaa1993b146c166fdfa9013b713b93dc7755c99068c7e568ec4d8c970a733e3cb2e182d5f327a86444fad5fcee0af66faf38c63e905048430d98a088cd587791a005d3ffe1ddde08216ddf5011551e4e2d64db0579c448dcb786868e7ad93d3f5b1308abb1ea36ff49dc5909fc80e9e4ef83d99c68c8f31aead1d16c8e65072b97421ed41d5344e95a33165ae29b9eb9cdd50779c2686"}, &(0x7f0000000c00)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000c40)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000c80)={0xc0, 0xa1, 0x4, 0xd}, &(0x7f0000000cc0)={0x40, 0xa0, 0x4, 0xe57}, &(0x7f0000000d00)={0xc0, 0xa2, 0x2f, "7f7091135c4b36fb298000726e9de77770e121fbf16109c2814a7071e060c9f9c480751b9bf5b30b295993057c06f5"}}) io_setup(0x3ff, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x42) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000780)={0x14, &(0x7f0000000700)={0x20, 0x24, 0x23, {0x23, 0x6, "6c42b6a32c06a624bf8d5cedf22e750320fbabadc78f992c6c1c399c20b8d08db2"}}, &(0x7f0000000740)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x1c, &(0x7f00000007c0)={0x0, 0x16, 0x46, "3ae3c7bad1ea54d46c29d0db8da125db6fcf4baf6a298d1faf56042ccb348d1f4bc53d73abe5ff89493a15a60539ff7cd30f027e07963d3348efca9144f212dd57201055555a"}, &(0x7f0000000840)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0xb}}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xc, &(0x7f0000000280)={[{0x8, 0x4e00, "00934f3a08aab88d"}]}) 1.579793651s ago: executing program 5 (id=3722): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000002c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda98800003f002800128009000100766c616e00000000180002800c0002201c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.32625429s ago: executing program 5 (id=3723): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1702}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) 1.153426724s ago: executing program 5 (id=3724): socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) capset(&(0x7f0000000000)={0x20080522}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="080100000000000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) 808.451463ms ago: executing program 0 (id=3725): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) sendfile(r1, r0, 0x0, 0x20000023893) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x7, 0xfc, 0xe1, 0x0, 0x6, 0xd9, 0x40, 0x1, 0xfb, 0x8, 0xc, 0x0, 0x0, 0x40, 0x1, 0x5}}) 611.751765ms ago: executing program 5 (id=3726): syz_io_uring_setup(0x3f, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002600)='/proc/bus/input/devices\x00', 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x2, @empty, 0xa09c}, {0xa, 0x2, 0xfffffffe, @dev={0xfe, 0x80, '\x00', 0xa}, 0x41}, r4, 0x5}}, 0x48) futex(&(0x7f0000000000)=0x1, 0x5, 0x20001, 0x0, &(0x7f0000000100), 0xc3000000) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) read$FUSE(r2, &(0x7f00000001c0)={0x2020}, 0x1906) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) syz_emit_ethernet(0xbc, &(0x7f0000002200)={@random="ad4f27226e60", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, @void, {@mpls_mc={0x8848, {[], @llc={@snap={0xab, 0x1, "aac5", '\x00', 0x15, "e872d848e7f5ffc8f20d0ded6ed94750ae5e5a4ff0451b3c0705fab6538d57bddbdfa61de74cf9c074d1252e6f536a83bab4d76f0cb2c9f00ad5576f517b6311a6f98722d8d2e5770210b8f59f7a5c8a2517a4c55de3258a39f43e3c36eaf4e56f557c1f2e0c14ea1facdf5b43238b4f4f993d0dfa488e634a2930093dd7605b5413bf92a8aa7b491da8a673bee16ac7774fe90e81b7a6757a66702543ed7b54b6b85a1091"}}}}}}, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000010000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, 0x0}], 0x1, 0x16, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYRES32=r6, @ANYRES16=r7], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x20000050) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r5) 463.285876ms ago: executing program 0 (id=3727): syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x7, 0x0, 0x3}}}}}}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000000000000000000fe0100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 346.33579ms ago: executing program 0 (id=3728): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000fff300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b5090800821300007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7040000080000004600000076001e00bf98000000000000b5080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 345.93653ms ago: executing program 2 (id=3729): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) (fail_nth: 14) 275.006684ms ago: executing program 0 (id=3730): syz_emit_ethernet(0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000080046000028000000000011907800000000000000000704"], 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0x0) keyctl$set_timeout(0xf, r1, 0xd1) syz_usb_disconnect(r0) syz_usb_connect$cdc_ncm(0x6, 0x6e, &(0x7f0000000540)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x11, 0x20, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xdf}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x0, 0x3, 0x5}, {0x6, 0x24, 0x1a, 0x401, 0x14}}, {{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x4, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0xf1, 0x2, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x26, 0xd, 0x7}}}}}}}]}}, 0x0) ioctl$EVIOCRMFF(r0, 0x80085502, 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 0s ago: executing program 2 (id=3731): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x41fec472531ebcab, 0xde) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x14, 0xc, "00f9737227af149989fc8dbe43ea6affffffffdc25f5ab60c9e6d680f985881a4c516bdd010f35000000b0000006000800000000000000005c9f00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) r2 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f00000000c0)={0x401, r2, 0x2e, {0x6, 0x315}, 0x1}, 0x1) r3 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x6c81c0) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc02c5625, &(0x7f0000002940)={0x80f0f000, 0x1, "9a555c34c966e134d198b9aaaa7da80f8e4fa888dece6ffdb507a3c83e58e128", 0xfffffffffffffffc, 0x7fffffffffffffff, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8, [0x1000]}) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/config', 0x0, 0x0) openat$cgroup_ro(r4, &(0x7f0000001780)='devices.list\x00', 0x275a, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000017c0)="a8e41ff66478df528eeedfb13fde322202773c92fa8096f0816d59c840a27810cd8e90afec8cde06b98ec277bddb449419676dc2784003a82bba368a88a3f9af42130ca7d446e7b37581c2b4783d404c50c0f0e01f14b80eaa1d7ca99459b3f61e1507fc8f5be291661ae3e5313bb686cc6437fd58480e1f32bc6643fa5ddf3003c8f78391d5a732c46a7ba787cd3ce5897eb8d664bd45c3d8773bddb274760eb4c657c01711c768a59d5c58900f79e0184f9ed7f2e2e8226382d5f9939c38ebc3e7d3f9464d13bc4937ad64e90dc27b20bfb0b1b20c88c1d157ca84961e10a2db0120fbd70d7aca7805a283d22c27ff7341d9950aca836aea0f758468ad376f167993c34ab1508e24b5646647e094f8d72609f1aa79d5c01e92e5b4d5dc90234d01ae0711e9fa2e588d6729d445d31cc9197a83c5b20fe9d4c34646f2366ba1c46408db5f2e50eae9d6595fe6cd39a319c8491ac9266a3ca118f2f736d97af2f810339268676b30ba4de0656382b454bbc82a15c09f321898f85189c62bae2238128a81ce9b402f8c04bab22a9ea4d13f4e062e574087c9ba20e24ec8af206590e33e6531820deaa75a8e605c5043118751fd748be44c492b9e77f934b63c2e8bf2a2974be635205b3509a449aeaebc9f9565eb21e2dd80fd4787935cfe2d587747b64f50cf180021adc7d13f9dafdf374ea709f0831151e6bf10a121c611cba5736a8b5326cfe691c619d77281e2ac8ee08a680763fbd1fa2f5948a6ceb5b1366309ae16935c0f756c57af4cac9cec862763356afbcfa160296c4850a888b327c1ee778c643f24971742e686f1e3cc23e1078f340c8a08a8491947f1d1e3e28838bfad93a979f92a81c931d669fc7d6a34a22d13ff57ec9e14162107db9381e24b7716a29ea5eba65a6f0f640ac0c78aa6d502c1d1436be9c38f4255234de7e44cf6da753ef4fd4b7cd55b8b08fc702580c45d79ea90b708230423ba104761278e4e8dd06d75b2630f83a934eb3d0892c2f0fadf5a0668ddc179030229dfb1859618f7c1c914a2eb78ef0f6099e3b7d7301d1b0c9592f1785c8a7945b6ac64a58e0ebf1ab7ecb7ef4217a0b09aa7291b444b5c6e3c49326867c0ad74ab6da69362dad0b61b204408a79442556849d571e715bcba9f552d673ff1eecd5d4f77eea7223b43e4c647a703ac3f7577a8fcf40157f8420fcf2a340d9baa93be60fa46b6a45240849aafbe0db0612786caba08912a69276869978c10369f0e668d497f183cb4170d2eb07a063dea66dbf75c9b5dcf3dc9b28879afeca06245d0ac852b9282343111bc2d42422276108ec767b02d66bf01e07a96153d730c3506fbf48058132cc4e41b4a05e98967a56e64022a51a40e2c02860dabb59849d4e20d761b1d44be961f89936c9774a3a2a6fa1e008bc46f374892cfc2cec7b7bf81fe749a15954f9d1980394b06bce7ca89c833b5a3029aa367011755663c4c57edc8331cbddb9643a35da568710c095c22680c3bf94dfbb3949c1e8c8f3af04082c1c01d2837668bd39f76db2e10318c7c3c86c695b013be5535ac06b7a4cd0586434d6f5e8daa1f11f660f04ee50e2c756beedad01facb53b5595df17555630dc37011e123f40fd8378de04e4bf834cab521371e34ea6afe6af8ed9e64f8d92ef8e1f1e89d45ba109d62091f1d32654289dd0673322b640bb1a64775c8a1447f4704f9f6fdaf9687ad9a517df6f4a75328466282386262b1cd1b95e1b0b914238f0474da16846acd1ed2c681bc4fd5495aa981df0200590da8b7356fcdac9c7f08ede6af6663aae2c46dd4b982952c0bbf124f45e730e3a2dd1895d502977f711ebefc10331d208191a6426d90f703795f65af60db8baf1490b3a66e1750e333bd4eda354f00ec4c73687977b9f9b8a243998f13b4343fb1ec418d266a856e738e1e214d554cbcbaa0c24ef1e585567adb05e91babbfbe668445ec8b0fb59b99a1bff50b4a0d6c7d6805d3c735aaabf79b2a9e934cefadf52b0df1ef5d38de09b2340ba941e918a762d56918525c4053beb82217582166b71330b2d2d9c67e5b422e3860b85633ada6bd97228bdb29a11af79e1c9d90262d21266b64e7e7eb0027b037e64d89d3459cc4bc09c06726c3a958ca41ddf32f8354b9c18087d0acd001ad62b9f2551174c07cdb67972ea588e573e0cd1b5671a29c25c1bbfa45f59bcb0727d088b37f35578d773e6b7cfe65c14154165115dd48e26c51abe22e453450b12783acc4ed97adc78d2db8518b52d5ad47968c428575696f9555e335e1c8898d4ae868be05d7c58101e8f4d72dfaf6c9686176ff832ccc2628b2b6ab0432fe0cc1c6c51fe9f440dacd0d4ba587b22a757f89eaf536a64f40ded77649a2d803acfd1209a5acd7fc88c0e2e265f0a1d22e9d56ba7dde6c022340e36522b4b48885ae0ae20a12862d12459123bc9dc50a3fdb3a6b83b9e90704af1c77eed8fd213cd8c210ad685dab1164a76d1cb290215ede6cd0a8883e3e7a5310f299961fa59b4157878803bcf55dd8eec2fd2336ad081094d56650d32b17f29408db9dec9def7ade7ca1ee2f3cfda3c8b091991dd22d896032eb654c40fd6f37e77f908d6a362b6aaacbe2fc2ba8fe0dfbb767afddd2902983f5c2865ed3374ada44c08430cc5cadfa273549e34e2917fb1f41a0ead8d332195c50d2f05b66048064584ca9f2d9ab7e977114d31e83b9b9ca245398ad7d9d4264248ab7e748e46e3ed934f104aabe9ad741ba1eb8b898c13eebf67192b0b1464967992979bf2b6840d98eb0037be2a367288f3e51252668cbad8fba71a159caa070a6cc19ad5556bf563f84ff4b1547d80111feeacbe4b713e67417cfc025b1bea2836bacf0b1d03b1674c43cf81055e95feb139792b57d32fd44c7c7b2a988fe4f16eda820a2a531486554d578d8fb09040790b23a7e7f228cb8d42bfc086e92df1f45a8628bb09b91c0de1a13d6ea06210200fcf73f9f0e3339d62477f96dca5f37b5ed3975ee9897794d308c828ea57a93033a4ace798fcda608218968047bc9d17fb4fa136de0ab0ca802a95be59881a8506789d1717eda298e0e193ac15be0638124ba75e80efe7514c0211a62300bd2423514f135e981bee2489b2701205cbb29b41e9bceb2f77583bc7b296f5c212d2a2b62b3f2864bd0482874e2d22693e4a55703dbd16cfeab9c7c386669a494b1819916e8fade7180a50489361a8e8e4052cdb2422e69ebea2114d1c9cb5e96af1c2c8fd317d0ecf8936193b28e2455520e648b07e821e785da75d294b39b746c393349546f330652a5201fd46cb4f21b0c4fdea26d581fade5bcee0cb5d6e08a20aa4fcf98633bc31fac76f48f62446f8c541df9c9251dd8d5278c0f81617744958edbfc7301cf34716dd551f8df7895baf5de43aa177c5b9572f00619f29b06cf137daaa4f6fe7d3a3162dc474ad4c2a5cf9f614111fc345fa978b3f6b4480c0c7f22a63d4faecc47a4f9b51024c65ab5798fef46067dc27b3ef6955e367a3ff942cc09ab0063d24e56ee9475b02f1178802fe3285ac2f5d321c3f38a533b67033910cd95f5c097490a198ada9e2f5ca8da8d8517d41372854fb3240d5c489cf90b5683711a505d8ce1c6281322f7b018db47e823f16f9cfc1f443719b6a393b3239ae3c385b1a1f77bcf9d3524324075e6889013c5728b51e04567bc6dc6f0f5d82485c643dc376db5e29fcb585a4c27116c200abed80ff017bcccdddf4d67f72f098b3cc679e5a087d104fdc08864fcc631812dbb772419ea46d06afce70957e5744d7626d05087918b6e98e901d0af21af2e4636c7cc875e084ce2685cd5cfacff3e7f844bd268d792d68e45fbfdf935f5114ec4b8fc0cc437785a8ac7d994f047f97f13bc85e40496fb011807f9e4f36639ea461d0be4f7a2c42cf7688f890251a161f27450f3ec6c954f6ab6bc9bbdaef8cc947ae5577a248bbad6707181bdcbc36ea992f5bb2076b4546a07724117a72546789fd41a081b3574345011eb8b8f4a7e7fd1a7b560f2266dbdab48eac70f6c50c2215e2e2fe23941d9d5b3e99ccf836e8546178fdb265ff63abe29cea82a52efb23e0d5c4f8fbdfe61f77678b6f48400e7a77b6193da4af133315bcc7226e1bd244c445b732c84a0722cc1a8361a90c4341e1c5429cea3856d17e3492697e1a595c4b61d75ae31358963328afef137818209e7690e4297bf26c7d939ed96c8638d6d20f9f4d71447f59a818cc53268231df93a59d2262047c31072df6343e210eb7f41f8e40ab0fdac1ed70d629e0b30e8c3473d47c3ea1f01ca0e4f2863a2b35e36d3fa6ca063499766b33bce63dc486b50b29a413f34b0813125fb11ad11c9ec6c0e34a1b5c4faceaa00c51d114235aa4ade2af89c80e5a355c8a20b6ea7954165b4d989647c799924ae720b84a56221597a5847aabcd771267e8e6711e76771f7cb67430f23bc3ec7a735253b9b7d401fcaff226792d0e6221041b09f28856084a38ab5cae3f194c6e47f5765ea776ec633c02b1061a8d2b2a2a820c62e5636bf600c99917b115c6e0dcb7dac6e3571dd327bf01569899fd59a43e72f0bf669820a0f25db2066fc8ecef84378d38edd631db8cb09c4e4c06a8747be4660239a320324a0b2912d2edc686843b0ca08e13c06d37442939a0f8ccdf8ac80e441f8a55a954594a6526be799bb4e66e3370f309fab9d332eb935955ff920dfb29101575d86c1b989bf785ac626431b1c3576624012dbacc6ecf2c88ef42b470b9842a62fc5ddccc9885e22eecb03acd0aa19926991361ea3d73055b05c20f44139ed06b0e47cc3659347f2b83c5a2a8090fa77b2fbde07539dc3b118cedc4a72040d1429c30a57ebd721080d9bd0fb1d9857183a148cdc28a19cedb1ab8eb3c6ac98bce453a254524b8e969c3f77b434b39c5e4f3b22f987b5cf862cb5e5c09c20638f2971fbae13db81064e41486b2fe39de4e39dd960cc53a8484b411f3525f7cb21ce80e54faa37119202cd525f1a9431b6863cf354480e4512159f0025565fdda7497c71b5782d0d3207bcf9e412664bd01e58d7dd53dd2a4511875206ca60a4202a9472b17b2443c712253b88f2c09a3bb13fbcf2015ccffb2a397a252bf7a4b85b241d8caa630bc9c5f1923687e46b99e37799c7dbcb526c72073ea6602ed0ed8cc63199683b4df3918ecffd3cac9aaf90f213a173e6d47dedd9e97bf46cfd08ac64b1a2f22237c47635d02e801c5eeb4f226f8b4d8f2cf9aa190a88905f0e1be1c3790955c1d63b5fcd302425e80613152c0e6f3bd3620d2503516f2ba6ab67b5924a56b5b68d76bb41f1713ddc303e7e5be99e8f0a0da1580ee060f09068416f9958cd62512a9cc792b709bc94ce0ef1e9a146f88cf9b44a339380b5415391b32fce7e75946c42dd934b7e5ac82d00133991eb4f07f29785feebf5da8be845df4423f844405bf94d64f02595a7d3b1e8f59e47964b8edb0ed07b9bac9cf2ad6051f25e2f303938636dea343e1d23ab9bdf76b116a9ffc9c2727276787099b63f391c402a47a2ec17b06e11ed6f5f709929f96042adc0adecb25e729e3e03f82662bbad60ec31aaa420f4f5a17acf4d1b7801788ff4eac6b8a18cebc6c2c28eb12cef39139bb20bc4adc5eb22b9e167ad27d21ce08627969780b1716e02feb6f791ff63f283c62a398f2dd1f0162e6e538399ade479779635979c63854af059f178a3d565b0020b3d28f9fdf947a8a255fc75816eff3eec4846567db65551a262a44e0", 0x1000) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000001000010500"/20, @ANYRES32=0x0, @ANYBLOB="000000007cd000002400128009000100626f6e640000000014000280080009000000000008000a00010000e7"], 0x44}, 0x1, 0x0, 0x0, 0x24040000}, 0x4048880) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r6, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {0x0, 0x4, 0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x5, 0x7fffffff, {"4c5c8205c36a3ab319b4d19d1fd840eb"}, 0x3, 0x6, 0x101}}}, 0xa0) ioctl$FIONCLEX(r5, 0x5450) kernel console output (not intermixed with test programs): atelimit+0x10/0x10 [ 875.486681][T18519] ? __pfx_dump_stack_lvl+0x10/0x10 [ 875.486700][T18519] ? __pfx__printk+0x10/0x10 [ 875.486734][T18519] should_fail_ex+0x414/0x560 [ 875.486763][T18519] _copy_to_user+0x31/0xb0 [ 875.486785][T18519] simple_read_from_buffer+0xe1/0x170 [ 875.486813][T18519] proc_fail_nth_read+0x1b3/0x220 [ 875.486835][T18519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 875.486857][T18519] ? rw_verify_area+0x2a6/0x4d0 [ 875.486878][T18519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 875.486900][T18519] vfs_read+0x200/0xa30 [ 875.486922][T18519] ? poll_select_finish+0x264/0x5e0 [ 875.486947][T18519] ? __pfx_vfs_read+0x10/0x10 [ 875.486970][T18519] ? do_sys_openat2+0x154/0x1c0 [ 875.486986][T18519] ? set_user_sigmask+0xc7/0x1b0 [ 875.487004][T18519] ? __pfx_set_user_sigmask+0x10/0x10 [ 875.487037][T18519] ksys_read+0x145/0x250 [ 875.487060][T18519] ? __pfx_ksys_read+0x10/0x10 [ 875.487077][T18519] ? rcu_is_watching+0x15/0xb0 [ 875.487101][T18519] ? do_syscall_64+0xbe/0x3b0 [ 875.487124][T18519] do_syscall_64+0xfa/0x3b0 [ 875.487141][T18519] ? lockdep_hardirqs_on+0x9c/0x150 [ 875.487159][T18519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.487176][T18519] ? clear_bhb_loop+0x60/0xb0 [ 875.487196][T18519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.487212][T18519] RIP: 0033:0x7f5ba878d8dc [ 875.487228][T18519] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 875.487244][T18519] RSP: 002b:00007f5ba970b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 875.487264][T18519] RAX: ffffffffffffffda RBX: 00007f5ba89e5fa0 RCX: 00007f5ba878d8dc [ 875.487277][T18519] RDX: 000000000000000f RSI: 00007f5ba970b0a0 RDI: 0000000000000005 [ 875.487288][T18519] RBP: 00007f5ba970b090 R08: 0000000000000000 R09: 0000000000000000 [ 875.487300][T18519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.487309][T18519] R13: 00007f5ba89e6038 R14: 00007f5ba89e5fa0 R15: 00007f5ba8b0fa28 [ 875.487337][T18519] [ 875.487376][ T5915] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 875.732719][ T5915] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 875.748591][ T5915] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 875.770369][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.793622][ T5915] usb 2-1: Product: syz [ 875.798232][ T5915] usb 2-1: Manufacturer: syz [ 875.803127][ T5915] usb 2-1: SerialNumber: syz [ 875.818454][ T5915] cdc_ncm 2-1:1.0: skipping garbage [ 875.829795][ T5915] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 875.836892][ T5915] cdc_ncm 2-1:1.0: bind() failure [ 877.625495][T18541] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3282'. [ 877.875533][T14006] usb 2-1: USB disconnect, device number 15 [ 877.935165][T18545] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3283'. [ 878.510554][ T9] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 879.066766][T18553] batman_adv: batadv0: Adding interface: dummy0 [ 879.075422][T18553] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 879.191027][T18553] batman_adv: batadv0: Interface activated: dummy0 [ 879.198265][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 879.217211][T18554] batadv0: mtu less than device minimum [ 879.225283][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.238032][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.249977][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.261980][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.273987][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.285888][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.297994][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.310119][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.323816][T18554] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 879.399144][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 879.528944][ T10] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 879.539427][ T9] usb 5-1: config 3 has an invalid interface number: 3 but max is 0 [ 879.558246][ T9] usb 5-1: config 3 has no interface number 0 [ 879.590988][ T9] usb 5-1: config 3 interface 3 has no altsetting 0 [ 879.612178][T18562] fuse: blksize only supported for fuseblk [ 879.624612][ T9] usb 5-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=aa.69 [ 879.641065][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.656750][ T9] usb 5-1: Product: syz [ 879.667032][ T9] usb 5-1: Manufacturer: syz [ 879.680926][ T9] usb 5-1: SerialNumber: syz [ 879.733240][ T10] usb 2-1: config 0 has an invalid interface number: 113 but max is 0 [ 879.751225][ T10] usb 2-1: config 0 has no interface number 0 [ 879.761535][ T10] usb 2-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 879.791098][ T10] usb 2-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 879.895145][ T10] usb 2-1: config 0 interface 113 has no altsetting 0 [ 879.916213][ T10] usb 2-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 879.925946][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.934713][ T10] usb 2-1: Product: syz [ 879.939997][ T10] usb 2-1: Manufacturer: syz [ 879.944826][ T5929] usb 6-1: new full-speed USB device number 72 using dummy_hcd [ 879.953455][ T10] usb 2-1: SerialNumber: syz [ 880.126858][ T10] usb 2-1: config 0 descriptor?? [ 880.129917][ T30] audit: type=1326 audit(1759491623.193:1038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18561 comm="syz.0.3286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ba878eec9 code=0x7ffc0000 [ 880.172848][ T5929] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 880.187881][ T5929] usb 6-1: can't read configurations, error -61 [ 880.210352][ C0] usb 2-1: NFC: Urb failure (status -71) [ 880.217886][ T10] usb 2-1: NFC: Unable to get FW version [ 880.242907][ T10] pn533_usb 2-1:0.113: probe with driver pn533_usb failed with error -90 [ 880.297393][ T30] audit: type=1326 audit(1759491623.193:1039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18561 comm="syz.0.3286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f5ba878eec9 code=0x7ffc0000 [ 880.331563][ T5929] usb 6-1: new full-speed USB device number 73 using dummy_hcd [ 880.461646][ T30] audit: type=1326 audit(1759491623.193:1040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18561 comm="syz.0.3286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ba878eec9 code=0x7ffc0000 [ 880.607039][ T30] audit: type=1326 audit(1759491623.193:1041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18561 comm="syz.0.3286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ba878eec9 code=0x7ffc0000 [ 880.647624][ T5929] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 880.655882][ T5929] usb 6-1: can't read configurations, error -61 [ 880.679235][ T5929] usb usb6-port1: attempt power cycle [ 881.051266][ T5929] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 881.134774][ T5929] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 881.145211][ T5929] usb 6-1: can't read configurations, error -61 [ 881.300960][ T5929] usb 6-1: new full-speed USB device number 75 using dummy_hcd [ 881.344511][ T5929] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 881.353101][ T5929] usb 6-1: can't read configurations, error -61 [ 881.380366][ T5929] usb usb6-port1: unable to enumerate USB device [ 881.464996][ T9] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 881.511118][ T9] snd-usb-audio 5-1:3.3: probe with driver snd-usb-audio failed with error -2 [ 881.570523][ T9] usb 5-1: USB disconnect, device number 53 [ 881.652765][ T5838] usb 2-1: USB disconnect, device number 16 [ 881.776405][T18578] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3292'. [ 881.946826][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:3.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 882.135429][T18595] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 882.151794][T18595] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 882.159251][T18590] tipc: Started in network mode [ 882.164850][T18590] tipc: Node identity e23587129a57, cluster identity 4711 [ 882.173659][T18590] tipc: Enabled bearer , priority 0 [ 882.182126][T18596] syzkaller0: entered promiscuous mode [ 882.187628][T18588] netlink: 'syz.0.3290': attribute type 20 has an invalid length. [ 882.192721][T18596] syzkaller0: entered allmulticast mode [ 882.201074][ T5838] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 882.212628][T18588] IPv6: NLM_F_CREATE should be specified when creating new route [ 882.233931][T18591] tipc: Resetting bearer [ 882.251209][T18590] tipc: Enabling of bearer rejected, already enabled [ 882.282646][T18589] tipc: Resetting bearer [ 882.305296][T18589] tipc: Disabling bearer [ 882.364504][ T5838] usb 3-1: Using ep0 maxpacket: 8 [ 882.371166][T16450] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 882.383791][ T5838] usb 3-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=31.1f [ 882.401172][ T5838] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.425134][ T5838] usb 3-1: Product: syz [ 882.437555][ T5838] usb 3-1: Manufacturer: syz [ 882.455196][ T5838] usb 3-1: SerialNumber: syz [ 882.508035][ T5838] usb 3-1: config 0 descriptor?? [ 882.530499][T16450] usb 2-1: device descriptor read/64, error -71 [ 882.637090][ T5838] (null): radio-mr800 - initialization failed [ 882.650739][ T5838] radio-mr800 3-1:0.0: probe with driver radio-mr800 failed with error -22 [ 882.664589][ T5838] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 882.753043][T18584] netlink: 'syz.2.3294': attribute type 1 has an invalid length. [ 882.809531][T16450] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 882.911970][T14006] usb 3-1: USB disconnect, device number 57 [ 883.035474][T16450] usb 2-1: device descriptor read/64, error -71 [ 883.163600][T16450] usb usb2-port1: attempt power cycle [ 883.550986][T16450] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 883.663243][T16450] usb 2-1: device descriptor read/8, error -71 [ 884.080960][T16450] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 884.181962][T16450] usb 2-1: device descriptor read/8, error -71 [ 884.291388][T16450] usb usb2-port1: unable to enumerate USB device [ 884.360448][T18625] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 884.690966][ T5915] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 884.854515][ T5915] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.865165][ T5915] usb 6-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 884.881076][ T5915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.898586][ T5915] usb 6-1: config 0 descriptor?? [ 884.921642][ T5915] usb 6-1: bad CDC descriptors [ 884.950900][T14006] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 885.114469][T14006] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 885.124630][T14006] usb 5-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 885.151538][T14006] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.173654][T16450] usb 6-1: USB disconnect, device number 76 [ 885.200616][T14006] usb 5-1: config 0 descriptor?? [ 885.569414][T18664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 885.578650][T18664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 885.765150][T18669] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3318'. [ 886.344718][T18673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 886.617770][ T30] audit: type=1326 audit(1759491629.933:1042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18674 comm="syz.0.3321" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5ba878eec9 code=0x0 [ 886.924505][ T30] audit: type=1326 audit(1759491629.963:1043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18674 comm="syz.0.3321" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5ba878eec9 code=0x0 [ 887.583597][T18699] netlink: 188 bytes leftover after parsing attributes in process `syz.0.3327'. [ 887.610410][T18699] syz.0.3327 (18699): drop_caches: 2 [ 887.967030][T14006] usbhid 5-1:0.0: can't add hid device: -71 [ 887.973770][T14006] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 888.044756][T14006] usb 5-1: USB disconnect, device number 54 [ 888.127586][T18712] geneve2: entered allmulticast mode [ 888.147721][T18713] usb usb9: usbfs: interface 0 claimed by hub while 'syz.4.3331' sets config #3 [ 888.334151][ T5915] usb 2-1: new low-speed USB device number 21 using dummy_hcd [ 888.430578][T18720] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 888.497362][ T5915] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 888.506392][ T5915] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 888.610490][ T5915] usb 2-1: config 0 has no interface number 0 [ 888.641593][ T5915] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt [ 888.740684][T14006] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 888.833155][T18724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3335'. [ 888.862399][ T5915] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 8 [ 888.911055][T14006] usb 5-1: device descriptor read/64, error -71 [ 888.938008][ T5915] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 888.948326][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.970331][ T5915] usb 2-1: config 0 descriptor?? [ 889.151414][T14006] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 889.292082][T14006] usb 5-1: device descriptor read/64, error -71 [ 889.417106][T14006] usb usb5-port1: attempt power cycle [ 889.456869][ T5915] input: USB Keyspan Remote 06cd:0202 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.21/input/input71 [ 889.766284][T14006] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 889.818721][T14006] usb 5-1: device descriptor read/8, error -71 [ 889.855288][ T9] usb 2-1: USB disconnect, device number 21 [ 889.855361][ C1] keyspan_remote 2-1:0.21: keyspan_irq_recv - usb_submit_urb failed with result: -19 [ 890.020992][ T5929] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 890.195938][T14006] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 890.241968][T14006] usb 5-1: device descriptor read/8, error -71 [ 890.352521][T14006] usb usb5-port1: unable to enumerate USB device [ 890.380993][ T5929] usb 1-1: Using ep0 maxpacket: 32 [ 890.415003][ T5929] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 890.423937][ T5929] usb 1-1: config 0 has no interface number 0 [ 890.446893][ T5929] usb 1-1: config 0 interface 184 has no altsetting 0 [ 890.514735][ T5929] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 890.523019][T18758] netdevsim netdevsim5: Direct firmware load for ./file0/file1 failed with error -2 [ 890.523965][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.551639][T18758] netdevsim netdevsim5: Falling back to sysfs fallback for: ./file0/file1 [ 890.580411][ T5929] usb 1-1: Product: syz [ 890.589063][ T5929] usb 1-1: Manufacturer: syz [ 890.598319][ T5929] usb 1-1: SerialNumber: syz [ 890.624711][ T5929] usb 1-1: config 0 descriptor?? [ 890.697834][ T5929] smsc75xx v1.0.0 [ 890.739707][ T5929] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 890.801322][ T5929] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -22 [ 891.120401][T14006] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 891.340966][T14006] usb 6-1: Using ep0 maxpacket: 16 [ 891.352149][T14006] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 891.363398][T14006] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.374094][T14006] usb 6-1: Product: syz [ 891.378715][T14006] usb 6-1: Manufacturer: syz [ 891.384006][T14006] usb 6-1: SerialNumber: syz [ 891.399137][T14006] r8152-cfgselector 6-1: Unknown version 0x0000 [ 891.399156][T14006] r8152-cfgselector 6-1: config 0 descriptor?? [ 891.616823][T18764] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3345'. [ 891.658408][T18778] netlink: 'syz.4.3349': attribute type 10 has an invalid length. [ 891.724758][T14006] r8152-cfgselector 6-1: Unknown version 0x0000 [ 891.746825][T14006] r8152-cfgselector 6-1: bad CDC descriptors [ 891.757273][T18778] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 891.775440][T14006] r8152-cfgselector 6-1: USB disconnect, device number 77 [ 891.960932][ T5929] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 892.008704][T18784] netlink: 'syz.1.3350': attribute type 4 has an invalid length. [ 892.076375][T18785] netlink: 'syz.1.3350': attribute type 4 has an invalid length. [ 892.240939][ T5929] usb 5-1: Using ep0 maxpacket: 32 [ 892.248232][ T5929] usb 5-1: config 0 has an invalid interface number: 217 but max is 0 [ 892.450845][ T5929] usb 5-1: config 0 has no interface number 0 [ 892.516500][ T5929] usb 5-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 892.605655][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.847697][ T5929] usb 5-1: Product: syz [ 892.857533][ T5929] usb 5-1: Manufacturer: syz [ 892.876687][ T5929] usb 5-1: SerialNumber: syz [ 892.902610][ T5929] usb 5-1: config 0 descriptor?? [ 892.923992][ T5929] ftdi_sio 5-1:0.217: FTDI USB Serial Device converter detected [ 892.955100][ T5929] usb 5-1: Detected SIO [ 892.978202][ T5929] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 893.001159][T16450] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 893.205387][ T5915] usb 5-1: USB disconnect, device number 59 [ 893.219114][ T5915] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 893.221479][T16450] usb 3-1: Using ep0 maxpacket: 8 [ 893.277739][T14006] usb 1-1: USB disconnect, device number 29 [ 893.312995][ T5915] ftdi_sio 5-1:0.217: device disconnected [ 893.390418][T16450] usb 3-1: config 1 has an invalid descriptor of length 28, skipping remainder of the config [ 893.489668][T18803] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3354'. [ 893.556896][T16450] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8512, setting to 1024 [ 893.606157][T16450] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 893.635026][T16450] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 893.870725][T16450] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 893.881479][T16450] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.226552][T16450] usb 3-1: Product: syz [ 894.239152][T16450] usb 3-1: Manufacturer: syz [ 894.291811][T16450] usb 3-1: SerialNumber: syz [ 894.352622][T18795] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 894.360146][T18795] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 894.633420][T16450] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 894.656293][T16450] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 894.675676][T16450] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 894.834124][T18818] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 895.509413][T14006] usb 3-1: USB disconnect, device number 58 [ 895.987865][T18825] net_ratelimit: 10 callbacks suppressed [ 895.987879][T18825] IPv6: addrconf: prefix option has invalid lifetime [ 896.163687][ T5838] IPVS: starting estimator thread 0... [ 896.250946][T18831] IPVS: using max 35 ests per chain, 84000 per kthread [ 896.301160][ T5929] usb 6-1: new full-speed USB device number 78 using dummy_hcd [ 896.440984][T16450] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 896.497037][ T5929] usb 6-1: not running at top speed; connect to a high speed hub [ 896.514512][ T5929] usb 6-1: config 1 interface 0 has no altsetting 0 [ 896.525550][ T5929] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 896.538867][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.547316][ T5929] usb 6-1: Product: ꒇ蔤孯â™é¾¾ê®¬æ§ é£§ê³â€·ï”‚ᎎ웦﨔溙錧熌å€ç¼à»¼â£¶ì¬‘î–귛ê¾Ë›á˜‘ã¯å—¼â„¦ê‘¨í€­ë’Ÿî§˜èŒƒã¶¸é´‘瀑ï¢íœ¿ã •í›ŠÎìžæŒŒé–‡ç¡Ý¢ãžµê¬ä™§ï¯€è˜›ë´”宨囨ꄆ㪉缀ꜹ☩⒅í¹ë–¿ç°’꠵ࢬ닱î‘蓰礙걎蛕쇃㧷箳鿇椹熼ᘀ숢혫㾖á¾ì¨µã«™ê±¤ãˆ¥ëœ»È«åŠ—魌䕀꘱邡긺äŒà²¶ë…ªî”œê‡£î³Ÿê±­ë‘—蟡醭ä€ïƒ†à·ƒë«ï ¬è¸–㚤í’ᜋ [ 896.582835][ C0] vkms_vblank_simulate: vblank timer overrun [ 896.744905][T16450] usb 2-1: unable to get BOS descriptor or descriptor too short [ 896.767207][T16450] usb 2-1: config 6 has an invalid interface number: 144 but max is 0 [ 896.781107][ T5929] usb 6-1: Manufacturer: 嘋䶟å眆⴫㗖馷瀒ç¨à¸´ç¸ƒì‚±åŒ¦ä¦·é£‹Ñ”ç•å• è§ê¬¦ì¾ã‚·ê›¨æ€®ä£²ë‘¾ï²±ã²å§¾ï‰˜à¤åºŒéµƒç‡‹ï‘¢è†¸å¨„é £ò¿¢¨í†–쑇գ੄饬䓱é‹Ó¾ê·æ™‚궼䓡︸嵞喙⟷ì…瑯褾鱊軖ëŸä·†è°—ë¹ì¯œä•¿ê£µí”­ä®µçŒ±æ‹®ì¿œæƒªî·ˆêˆ»è®½í…´ãªç§î¶šæºå¬ƒæ¶¨íœ¥â—§è‹­ê†³è®„é»ë³‹í‡‹å£·ãŠ¼ä‰¨é ®æ±†ïˆá·¯à¤žâ¤­á†°ì—º [ 896.813473][ C0] vkms_vblank_simulate: vblank timer overrun [ 896.821136][T16450] usb 2-1: config 6 has no interface number 0 [ 896.830999][T16450] usb 2-1: config 6 interface 144 altsetting 1 endpoint 0x3 has an invalid bInterval 113, changing to 10 [ 896.889858][T18844] netlink: 'syz.4.3366': attribute type 20 has an invalid length. [ 896.971653][T16450] usb 2-1: config 6 interface 144 has no altsetting 0 [ 897.038172][ T5929] usb 6-1: SerialNumber: 꾨á¯ã„㿪鎠怰⊑å£äŠ„⤢tඬ㴛é»è¥³ç°³éŒ—켟ꓡè·åœ©ã‰ç’햠댚ꈶ渨嗱䨂è•á¤è£‰ì·»ã‘¶ä¥…袨ä±à¼¯æ¢¹ï´‘áŠë°ªá‹¸â”™æ»†ã™±ç¶’î¿¥æ­ë­¨ãºµç¤Œé—µâ„˜é„¬ã»žî¹„㔲ã–⠿쀋à²ë›°ìž—ä³îª´æƒ³ï¯µá“‡ë¸œÑˆî¯½ä½§ãµºì‘®á‘¬æ¢ºé›¬æ·½Ú‘玒à¦ä «äƒ™å´çºé–¾ë‰¶âƒ” [ 897.065719][ C0] vkms_vblank_simulate: vblank timer overrun [ 897.078406][T16450] usb 2-1: New USB device found, idVendor=7f55, idProduct=02fc, bcdDevice=20.c2 [ 897.090975][T16450] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.120055][T16450] usb 2-1: Product: syz [ 897.137077][T16450] usb 2-1: Manufacturer: syz [ 897.147101][T16450] usb 2-1: SerialNumber: syz [ 897.329182][ T10] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 897.373980][T18829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 897.385575][T18829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 897.415805][ T5929] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 78 if 0 alt 243 proto 3 vid 0x0525 pid 0xA4A8 [ 897.430302][T16450] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 897.437938][T16450] usb 2-1: MIDIStreaming interface descriptor not found [ 897.485007][ T5929] usb 6-1: USB disconnect, device number 78 [ 897.491095][ T10] usb 3-1: device descriptor read/64, error -71 [ 897.518165][ T5929] usblp0: removed [ 897.534238][T16450] usb 2-1: USB disconnect, device number 22 [ 897.801010][ T10] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 897.953135][ T10] usb 3-1: device descriptor read/64, error -71 [ 898.135670][ T10] usb usb3-port1: attempt power cycle [ 898.217023][T18855] netlink: 'syz.4.3368': attribute type 20 has an invalid length. [ 898.390947][T14006] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 898.502164][T18864] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3372'. [ 898.512388][T18864] netlink: 4680 bytes leftover after parsing attributes in process `syz.1.3372'. [ 898.521710][T18864] netlink: 1896 bytes leftover after parsing attributes in process `syz.1.3372'. [ 898.601530][ T10] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 898.641712][ T10] usb 3-1: device descriptor read/8, error -71 [ 898.680945][T14006] usb 1-1: Using ep0 maxpacket: 32 [ 898.756514][T14006] usb 1-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 898.772998][T14006] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 898.782798][T14006] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.792525][T14006] usb 1-1: Product: syz [ 898.878954][T14006] usb 1-1: Manufacturer: syz [ 898.883863][T14006] usb 1-1: SerialNumber: syz [ 898.894235][ T10] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 898.907796][T14006] usb 1-1: config 0 descriptor?? [ 898.919570][T14006] usb 1-1: bad CDC descriptors [ 898.926139][T14006] usb 1-1: unsupported MDLM descriptors [ 899.039466][ T10] usb 3-1: device descriptor read/8, error -71 [ 899.161242][ T10] usb usb3-port1: unable to enumerate USB device [ 899.210998][ T5929] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 899.430901][ T5929] usb 6-1: Using ep0 maxpacket: 16 [ 899.437975][ T5929] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 899.453557][ T5929] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 899.472654][ T5929] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 899.482331][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.491349][ T5929] usb 6-1: Product: syz [ 899.495757][ T5929] usb 6-1: Manufacturer: syz [ 899.500671][ T5929] usb 6-1: SerialNumber: syz [ 899.511003][T14006] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 899.538181][ T5929] usb 6-1: config 0 descriptor?? [ 899.548141][ T5929] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 899.563688][ T5929] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 899.686707][ T10] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 899.717976][T14006] usb 2-1: Using ep0 maxpacket: 8 [ 899.725302][T14006] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 899.738470][T14006] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 899.758391][T14006] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 239, changing to 11 [ 899.769959][T14006] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 9059, setting to 1024 [ 899.781946][T14006] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 899.811537][T14006] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 899.821424][T14006] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.830339][T14006] usb 2-1: Product: syz [ 899.835652][T14006] usb 2-1: Manufacturer: syz [ 899.840287][T14006] usb 2-1: SerialNumber: syz [ 899.854322][ T5929] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 899.859926][T14006] usb 2-1: config 0 descriptor?? [ 899.867674][ T5929] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 899.875099][ T10] usb 5-1: device descriptor read/64, error -71 [ 899.882937][ T5929] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 899.894081][ T5929] em28xx 6-1:0.0: No AC97 audio processor [ 899.905625][ T5929] usb 6-1: USB disconnect, device number 79 [ 899.919250][ T5929] em28xx 6-1:0.0: Disconnecting em28xx [ 899.930215][ T5929] em28xx 6-1:0.0: Freeing device [ 900.131115][ T10] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 900.437226][ T5929] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 900.631024][ T10] usb 5-1: device descriptor read/64, error -71 [ 900.665236][ T5929] usb 6-1: Using ep0 maxpacket: 32 [ 900.751231][ T10] usb usb5-port1: attempt power cycle [ 900.834428][ T5929] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 900.844736][ T5929] usb 6-1: config 0 has no interface number 0 [ 900.854309][ T5929] usb 6-1: config 0 interface 12 has no altsetting 0 [ 900.868109][ T5929] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 900.877736][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.916254][ T5908] usb 1-1: USB disconnect, device number 30 [ 901.078555][ T5929] usb 6-1: Product: syz [ 901.099646][ T5929] usb 6-1: Manufacturer: syz [ 901.119818][ T5929] usb 6-1: SerialNumber: syz [ 901.152208][ T10] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 901.169830][T18893] dlm: non-version read from control device 8224 [ 901.171045][ T5929] usb 6-1: config 0 descriptor?? [ 901.271558][ T10] usb 5-1: device descriptor read/8, error -71 [ 901.581069][ T10] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 901.601931][ T10] usb 5-1: device descriptor read/8, error -71 [ 901.713137][ T10] usb usb5-port1: unable to enumerate USB device [ 902.391963][ T5838] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 902.780692][ T5838] usb 3-1: device descriptor read/64, error -71 [ 902.968372][T18882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 903.055058][ T5838] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 903.126418][T18882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 903.141897][T18915] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3386'. [ 903.173048][T18882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 903.183244][T18882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 903.201013][T14006] rc_core: IR keymap rc-imon-rsc not found [ 903.208882][T14006] Registered IR keymap rc-empty [ 903.254353][T14006] rc rc0: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 903.263781][ T5838] usb 3-1: device descriptor read/64, error -71 [ 903.327623][T18914] netlink: 4680 bytes leftover after parsing attributes in process `syz.4.3386'. [ 903.327727][T18914] netlink: 1896 bytes leftover after parsing attributes in process `syz.4.3386'. [ 903.350584][T14006] input: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input72 [ 903.384155][ T5838] usb usb3-port1: attempt power cycle [ 903.393747][T14006] usb 2-1: USB disconnect, device number 23 [ 903.550999][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 903.721031][ T5838] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 903.761978][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 903.791885][ T5838] usb 3-1: device descriptor read/8, error -71 [ 903.804513][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 904.040211][ T5838] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 904.162695][ T5838] usb 3-1: device descriptor read/8, error -71 [ 904.172766][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 904.279787][ T5838] usb usb3-port1: unable to enumerate USB device [ 904.332928][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 904.390994][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 904.599603][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 904.609444][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 904.636033][ T10] usb 1-1: SerialNumber: syz [ 904.676701][ T10] hub 1-1:1.0: bad descriptor, ignoring hub [ 904.724132][ T10] hub 1-1:1.0: probe with driver hub failed with error -5 [ 904.754461][ T5929] f81534 6-1:0.12: f81534_set_register: reg: 1003 data: b0 failed: -32 [ 904.773070][ T5929] f81534 6-1:0.12: f81534_find_config_idx: read failed: -32 [ 904.781676][ T10] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 904.790440][ T5929] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 904.827582][ T5929] f81534 6-1:0.12: probe with driver f81534 failed with error -32 [ 904.952122][ T5929] usb 6-1: USB disconnect, device number 80 [ 905.537337][T18943] pim6reg: entered allmulticast mode [ 905.919446][ T5929] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 906.105704][ T5929] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 906.115384][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.134883][ T5929] usb 3-1: Product: syz [ 906.160843][ T5929] usb 3-1: Manufacturer: syz [ 906.173176][ T5838] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 906.206590][ T5929] usb 3-1: SerialNumber: syz [ 906.351144][ T5838] usb 5-1: Using ep0 maxpacket: 8 [ 906.379499][ T5838] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 906.391435][ T5838] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 906.400622][ T5838] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.550939][ T10] usb 1-1: USB disconnect, device number 31 [ 906.822946][ T5838] usb 5-1: config 0 descriptor?? [ 906.869576][ T5838] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 907.977959][ T5929] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPROTO [ 908.015343][ T5929] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 908.097635][ T5929] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 908.162696][ T5929] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 908.317696][ T5838] gspca_vc032x: reg_w err -71 [ 908.322665][ T5838] vc032x 5-1:0.0: probe with driver vc032x failed with error -71 [ 908.342444][ T5838] usb 5-1: USB disconnect, device number 64 [ 908.577291][ T5929] usb 3-1: USB disconnect, device number 67 [ 908.891415][T18978] netlink: 'syz.2.3400': attribute type 1 has an invalid length. [ 909.004639][T18982] fuse: Bad value for 'fd' [ 909.059234][ T30] audit: type=1326 audit(1759491652.373:1044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18975 comm="syz.5.3401" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7d6bd8eec9 code=0x0 [ 909.327802][T18990] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 909.417485][T18970] tipc: Resetting bearer [ 910.384037][T19004] fuse: Unknown parameter 'éñá0x000000000000000300000000000000000000003çÌf`—ŒKËSºóËUÓ \YÇ*×hG±n7p– [ 910.384037][T19004] Í<âÃÃ>ÑdW{‰Ÿ•°¹Ë¡' [ 910.520901][ T10] usb 5-1: new low-speed USB device number 65 using dummy_hcd [ 910.670924][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 910.812601][ T10] usb 5-1: new low-speed USB device number 66 using dummy_hcd [ 910.955992][T19018] netlink: 'syz.0.3405': attribute type 1 has an invalid length. [ 911.040928][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 911.049183][ T10] usb usb5-port1: attempt power cycle [ 911.081049][T19018] 8021q: adding VLAN 0 to HW filter on device bond3 [ 911.182753][T19020] ipvlan0: entered promiscuous mode [ 911.203644][T19020] ipvlan0: entered allmulticast mode [ 911.236148][T19020] bond3: entered allmulticast mode [ 911.244553][T19020] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 911.268471][T19018] bond3: (slave gretap1): making interface the new active one [ 911.276740][T19018] gretap1: entered allmulticast mode [ 911.284215][T19018] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 911.573168][ T10] usb 5-1: new low-speed USB device number 67 using dummy_hcd [ 911.605586][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 911.741306][ T10] usb 5-1: new low-speed USB device number 68 using dummy_hcd [ 911.762043][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 911.763148][T19034] IPv6: addrconf: prefix option has invalid lifetime [ 911.767738][ T10] usb usb5-port1: unable to enumerate USB device [ 912.301208][ T5908] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 912.340942][ T5838] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 912.486328][ T5908] usb 2-1: Using ep0 maxpacket: 16 [ 912.531031][ T5908] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 912.539256][ T5908] usb 2-1: config 0 has no interface number 0 [ 912.563790][ T5838] usb 1-1: Using ep0 maxpacket: 32 [ 912.627598][ T5838] usb 1-1: config 0 has an invalid interface number: 247 but max is 0 [ 912.646502][ T5908] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 912.702078][ T5838] usb 1-1: config 0 has no interface number 0 [ 912.744342][ T5908] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 912.775176][ T5838] usb 1-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 912.894322][ T5838] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 912.904897][ T5908] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 912.914360][ T5908] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 912.923274][ T5838] usb 1-1: Product: syz [ 912.927867][ T5908] usb 2-1: Product: syz [ 912.933869][ T5838] usb 1-1: Manufacturer: syz [ 912.939021][ T5908] usb 2-1: SerialNumber: syz [ 912.960058][ T5838] usb 1-1: config 0 descriptor?? [ 912.995655][ T5908] usb 2-1: config 0 descriptor?? [ 913.036773][ T5908] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 913.053554][ T5908] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input73 [ 913.263909][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 913.290563][ T5908] usb 1-1: USB disconnect, device number 32 [ 913.472483][T19036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.496961][T19036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.533833][T19036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.563593][T19036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.674223][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 913.681756][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 913.689407][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 913.696889][ T10] usb 2-1: USB disconnect, device number 24 [ 913.702948][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 913.702967][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 913.760263][ T10] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 914.048250][T19079] netlink: 'syz.4.3414': attribute type 20 has an invalid length. [ 914.809350][T19093] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3418'. [ 914.813589][ T10] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 914.858563][T19095] IPv6: addrconf: prefix option has invalid lifetime [ 914.879901][T19093] veth0: entered promiscuous mode [ 914.928799][T19092] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3418'. [ 915.185302][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 915.225939][T19100] loop6: detected capacity change from 0 to 7 [ 915.285592][ T5975] Dev loop6: unable to read RDB block 7 [ 915.341303][ T5975] loop6: AHDI p3 [ 915.351596][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 915.358496][ T5975] loop6: partition table partially beyond EOD, truncated [ 915.406402][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.437345][ T10] usb 3-1: Product: syz [ 915.675784][ T10] usb 3-1: Manufacturer: syz [ 915.684621][ T10] usb 3-1: SerialNumber: syz [ 915.717885][ T10] usb 3-1: config 0 descriptor?? [ 915.812402][ T30] audit: type=1326 audit(1759491659.133:1045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19106 comm="syz.5.3421" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7d6bd8eec9 code=0x0 [ 915.911476][T19120] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3423'. [ 915.945168][T19120] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3423'. [ 916.131013][ T5922] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 916.461003][ T5922] usb 5-1: Using ep0 maxpacket: 32 [ 916.532898][ T5922] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 916.700488][ T5922] usb 5-1: config 0 has no interface number 0 [ 916.736982][ T5922] usb 5-1: too many endpoints for config 0 interface 34 altsetting 7: 58, using maximum allowed: 30 [ 916.852424][ T5922] usb 5-1: config 0 interface 34 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 58 [ 916.955005][ T5922] usb 5-1: config 0 interface 34 has no altsetting 0 [ 917.007581][ T5922] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 917.017000][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.035149][ T5922] usb 5-1: Product: syz [ 917.044055][ T5922] usb 5-1: Manufacturer: syz [ 917.060140][ T5922] usb 5-1: SerialNumber: syz [ 917.211402][ T5922] usb 5-1: config 0 descriptor?? [ 917.456914][ T5922] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 917.479089][ T5922] gspca_stk1135: reg_w 0x2 err -71 [ 917.515539][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.553236][ T5922] gspca_stk1135: Sensor write failed [ 917.577819][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.640458][ T5922] gspca_stk1135: Sensor write failed [ 917.655733][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.667621][ T5922] gspca_stk1135: Sensor read failed [ 917.676499][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.687904][ T5922] gspca_stk1135: Sensor read failed [ 917.698239][ T5922] gspca_stk1135: Detected sensor type unknown (0x0) [ 917.710725][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.732589][ T5922] gspca_stk1135: Sensor read failed [ 917.758416][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.786865][ T5922] gspca_stk1135: Sensor read failed [ 917.798284][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.816729][ T5922] gspca_stk1135: Sensor write failed [ 917.826854][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 917.845332][ T5922] gspca_stk1135: Sensor write failed [ 917.867111][ T5922] stk1135 5-1:0.34: probe with driver stk1135 failed with error -71 [ 917.974770][ T5922] usb 5-1: USB disconnect, device number 69 [ 917.991042][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 918.295374][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 918.518355][ T10] usb 1-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=67.3e [ 918.545734][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.571889][ T5929] usb 3-1: USB disconnect, device number 68 [ 918.580735][ T10] usb 1-1: Product: syz [ 918.617367][ T10] usb 1-1: Manufacturer: syz [ 918.639458][ T10] usb 1-1: SerialNumber: syz [ 918.667648][ T10] usb 1-1: config 0 descriptor?? [ 918.689019][ T10] port100 1-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 918.691211][ T5915] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 918.850466][ T5908] usb 5-1: new low-speed USB device number 70 using dummy_hcd [ 918.899487][ T5915] usb 2-1: config 0 has an invalid interface number: 138 but max is 0 [ 918.911204][ T5915] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 918.917041][ T10] usb 1-1: USB disconnect, device number 33 [ 918.924335][ T5915] usb 2-1: config 0 has no interface number 0 [ 918.942989][ T5915] usb 2-1: too many endpoints for config 0 interface 138 altsetting 84: 217, using maximum allowed: 30 [ 918.961454][ T5915] usb 2-1: config 0 interface 138 altsetting 84 has 0 endpoint descriptors, different from the interface descriptor's value: 217 [ 918.978839][ T5915] usb 2-1: config 0 interface 138 has no altsetting 0 [ 918.986514][ T5915] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 918.995850][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.004577][ T5908] usb 5-1: device descriptor read/64, error -71 [ 919.017274][ T5915] usb 2-1: config 0 descriptor?? [ 919.090974][ T5929] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 919.240939][ T5929] usb 3-1: Using ep0 maxpacket: 32 [ 919.248886][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 919.251112][ T5908] usb 5-1: new low-speed USB device number 71 using dummy_hcd [ 919.260528][ T5922] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 919.275436][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 919.289518][ T5929] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 919.298917][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.307016][ T5929] usb 3-1: Product: syz [ 919.311261][ T5929] usb 3-1: Manufacturer: syz [ 919.315916][ T5929] usb 3-1: SerialNumber: syz [ 919.323202][ T5929] usb 3-1: config 0 descriptor?? [ 919.334561][ T5929] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 919.401240][ T5908] usb 5-1: device descriptor read/64, error -71 [ 919.450959][ T5922] usb 6-1: Using ep0 maxpacket: 16 [ 919.462167][ T5922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 919.473917][ T5922] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 919.486190][ T5922] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 919.506974][ T5922] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 919.513266][ T5908] usb usb5-port1: attempt power cycle [ 919.528847][ T5915] usb 2-1: USB disconnect, device number 25 [ 919.545495][ T13] usb 3-1: Failed to submit usb control message: -71 [ 919.545910][ T10] usb 3-1: USB disconnect, device number 69 [ 919.563794][ T5922] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 919.565746][ T13] usb 3-1: unable to send the bmi data to the device: -71 [ 919.586060][ T13] usb 3-1: unable to get target info from device [ 919.593974][ T13] usb 3-1: could not get target info (-71) [ 919.594184][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.600021][ T13] usb 3-1: could not probe fw (-71) [ 919.610554][ T5922] usb 6-1: Product: syz [ 919.618021][ T5922] usb 6-1: Manufacturer: syz [ 919.624839][ T5922] usb 6-1: SerialNumber: syz [ 919.811046][ T5929] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 919.861001][ T5908] usb 5-1: new low-speed USB device number 72 using dummy_hcd [ 919.887617][ T5908] usb 5-1: device descriptor read/8, error -71 [ 919.931356][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 919.947721][ T5922] usb 6-1: USB disconnect, device number 81 [ 919.970980][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 919.978300][ T5929] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 919.989847][ T5929] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 920.002136][ T5929] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 920.011583][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.027612][ T5929] usb 1-1: config 0 descriptor?? [ 920.115769][T18022] Bluetooth: unknown link type 128 [ 920.141139][ T5908] usb 5-1: new low-speed USB device number 73 using dummy_hcd [ 920.171758][ T5908] usb 5-1: device descriptor read/8, error -71 [ 920.214358][T19176] netlink: 'syz.2.3434': attribute type 1 has an invalid length. [ 920.223509][T19172] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 920.232011][T19172] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 920.242079][T19172] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 920.248358][T19172] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 920.255413][T19172] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 920.281417][ T5908] usb usb5-port1: unable to enumerate USB device [ 920.501034][ T5838] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 920.571106][ T5908] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 920.660932][ T5838] usb 2-1: Using ep0 maxpacket: 32 [ 920.668675][ T5838] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 920.678054][ T5838] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.689088][ T5838] usb 2-1: config 0 descriptor?? [ 920.702514][ T5838] as10x_usb: device has been detected [ 920.708749][ T5838] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 920.722735][ T5908] usb 3-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 920.743741][ T5908] usb 3-1: config 253 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 920.755782][ T5838] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 920.766863][ T5908] usb 3-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 920.785283][ T5838] as10x_usb: error during firmware upload part1 [ 920.792258][ T5838] Registered device nBox DVB-T Dongle [ 920.801648][ T5908] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 920.816555][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 920.825268][ T5908] usb 3-1: SerialNumber: syz [ 920.901385][ T5922] usb 2-1: USB disconnect, device number 26 [ 920.929133][ T5922] Unregistered device nBox DVB-T Dongle [ 920.931310][ T5922] as10x_usb: device has been disconnected [ 921.041140][ T5908] rndis_host 3-1:253.0: RNDIS init failed, -71 [ 921.047813][ T5908] rndis_host 3-1:253.0: probe with driver rndis_host failed with error -71 [ 921.066133][ T5908] usb 3-1: USB disconnect, device number 70 [ 921.297907][ T5929] letsketch 0003:6161:4D15.0023: Device info: à° [ 921.340962][ T5838] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 921.480978][ T5838] usb 2-1: device descriptor read/64, error -71 [ 921.533812][ T5929] usb 1-1: Max retries (5) exceeded reading string descriptor 201 [ 921.544120][ T5929] letsketch 0003:6161:4D15.0023: probe with driver letsketch failed with error -71 [ 921.563396][ T5929] usb 1-1: USB disconnect, device number 34 [ 921.740947][ T5838] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 921.871112][ T5838] usb 2-1: device descriptor read/64, error -71 [ 921.920946][T14006] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 922.055425][ T5838] usb usb2-port1: attempt power cycle [ 922.064809][T19202] fuse: Bad value for 'fd' [ 922.174345][T18022] Bluetooth: hci1: command 0x040f tx timeout [ 922.184369][T14006] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 922.193157][T14006] usb 6-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 922.204001][T14006] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 922.213261][T14006] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 922.225180][T14006] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 922.236725][T14006] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 922.256925][T18022] Bluetooth: hci0: command 0x0c1a tx timeout [ 922.274901][ T5846] Bluetooth: hci2: command 0x0c1a tx timeout [ 922.284880][ T5846] Bluetooth: hci5: command 0x0406 tx timeout [ 922.291815][ T10] IPVS: starting estimator thread 0... [ 922.300132][T14006] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 922.309835][T14006] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 922.318848][T14006] usb 6-1: Product: syz [ 922.337385][T14006] usb 6-1: Manufacturer: syz [ 922.342171][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 922.363492][T19195] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 922.375943][T14006] cdc_wdm 6-1:1.0: skipping garbage [ 922.381605][T14006] cdc_wdm 6-1:1.0: skipping garbage [ 922.393014][T14006] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 922.412724][T14006] cdc_wdm 6-1:1.0: Unknown control protocol [ 922.421178][T19206] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3445'. [ 922.433093][T19204] IPVS: using max 38 ests per chain, 91200 per kthread [ 922.465254][ T5838] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 922.501459][ T5838] usb 2-1: device descriptor read/8, error -71 [ 922.583257][ C1] wdm_int_callback: 29 callbacks suppressed [ 922.583283][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.595816][ C1] wdm_int_callback: 29 callbacks suppressed [ 922.595839][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.608593][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.615523][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.622504][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.629149][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.635633][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.642262][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.648827][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.655643][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.662530][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.669170][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.675460][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.682164][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.688485][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.695101][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.701434][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.708057][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.714351][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 922.720976][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 922.911065][ T5915] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 922.919016][ T5838] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 922.946605][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 922.955520][T14006] usb 6-1: USB disconnect, device number 82 [ 922.964669][ T5838] usb 2-1: device descriptor read/8, error -71 [ 923.061030][ T5915] usb 1-1: device descriptor read/64, error -71 [ 923.092328][ T5838] usb usb2-port1: unable to enumerate USB device [ 923.300919][ T5915] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 923.320626][T19214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3447'. [ 923.432446][T19195] gretap1: entered promiscuous mode [ 923.480943][ T5915] usb 1-1: device descriptor read/64, error -71 [ 923.571061][ T5838] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 923.602154][ T5915] usb usb1-port1: attempt power cycle [ 923.731043][ T5838] usb 5-1: Using ep0 maxpacket: 16 [ 923.738883][ T5838] usb 5-1: unable to get BOS descriptor or descriptor too short [ 923.751775][ T5838] usb 5-1: config 3 has an invalid interface number: 3 but max is 0 [ 923.766867][ T5838] usb 5-1: config 3 has no interface number 0 [ 923.806169][ T5838] usb 5-1: config 3 interface 3 has no altsetting 0 [ 923.828598][ T5838] usb 5-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=aa.69 [ 923.849484][ T5838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.876313][ T5838] usb 5-1: Product: syz [ 923.885095][ T5838] usb 5-1: Manufacturer: syz [ 923.894756][ T5838] usb 5-1: SerialNumber: syz [ 923.980946][ T5915] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 924.012403][ T5915] usb 1-1: device descriptor read/8, error -71 [ 924.231014][ T5929] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 924.262259][ T5915] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 924.291395][ T5915] usb 1-1: device descriptor read/8, error -71 [ 924.393521][ T5929] usb 3-1: config 0 has too many interfaces: 202, using maximum allowed: 32 [ 924.402806][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 924.413312][ T5929] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 202 [ 924.421730][ T5915] usb usb1-port1: unable to enumerate USB device [ 924.432010][ T5929] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 924.441649][ T5929] usb 3-1: New USB device strings: Mfr=33, Product=2, SerialNumber=3 [ 924.449926][ T5929] usb 3-1: Product: syz [ 924.454678][ T5929] usb 3-1: Manufacturer: syz [ 924.459514][ T5929] usb 3-1: SerialNumber: syz [ 924.469555][ T5929] usb 3-1: config 0 descriptor?? [ 924.488539][ T5929] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 924.774383][ T5929] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 924.789540][ T5929] usb 3-1: USB disconnect, device number 71 [ 924.826530][ T5951] udevd[5951]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 926.032037][T19247] input: syz0 as /devices/virtual/input/input74 [ 926.041731][ T5922] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 926.158241][ T5838] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 926.233252][ T5922] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 926.317437][ T5838] snd-usb-audio 5-1:3.3: probe with driver snd-usb-audio failed with error -2 [ 926.338840][ T5838] usb 5-1: USB disconnect, device number 74 [ 926.355632][ T5922] usb 1-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 926.380255][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:3.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 926.438289][ T5922] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.461936][ T5922] usb 1-1: config 0 descriptor?? [ 927.289424][T19254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 927.299798][T19254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 928.090944][ T5929] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 928.142842][T19268] bridge0: port 2(bridge_slave_1) entered disabled state [ 928.158523][ T5929] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 928.171269][ T5846] Bluetooth: hci1: command 0x040f tx timeout [ 928.355897][ T30] audit: type=1326 audit(1759491671.673:1046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19261 comm="syz.2.3461" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfd178eec9 code=0x0 [ 929.177412][T19282] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3467'. [ 929.941001][ T9] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 930.226386][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 930.239509][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 930.256145][ T9] usb 6-1: config 3 has an invalid interface number: 3 but max is 0 [ 930.264864][ T9] usb 6-1: config 3 has no interface number 0 [ 930.271361][ T9] usb 6-1: config 3 interface 3 has no altsetting 0 [ 930.287205][ T9] usb 6-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=aa.69 [ 930.298083][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.315064][ T9] usb 6-1: Product: syz [ 930.320684][ T9] usb 6-1: Manufacturer: syz [ 930.327248][ T9] usb 6-1: SerialNumber: syz [ 930.332436][ T5846] Bluetooth: hci5: command 0x0406 tx timeout [ 930.343317][ T5929] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 930.363704][ T5929] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 931.288219][ T5922] usbhid 1-1:0.0: can't add hid device: -71 [ 931.298487][ T5922] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 931.482216][ T5922] usb 1-1: USB disconnect, device number 39 [ 931.855010][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.862347][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.151917][T19302] netlink: 'syz.4.3470': attribute type 20 has an invalid length. [ 932.495551][ T9] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 932.662620][ T5846] Bluetooth: hci2: command 0x0c1a tx timeout [ 932.721831][ T5929] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 932.801089][ T5929] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 932.846334][ T9] snd-usb-audio 6-1:3.3: probe with driver snd-usb-audio failed with error -2 [ 932.935027][ T9] usb 6-1: USB disconnect, device number 83 [ 933.022948][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:3.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 933.241778][T19316] fuse: Unknown parameter '' [ 934.890932][ T5929] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 934.901227][ T5846] Bluetooth: hci0: command 0x0c1a tx timeout [ 934.920996][ T5929] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 936.181091][ T977] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 936.342268][ T977] usb 6-1: Using ep0 maxpacket: 8 [ 936.352006][ T977] usb 6-1: unable to get BOS descriptor or descriptor too short [ 936.361270][ T977] usb 6-1: config 4 has an invalid interface number: 30 but max is 0 [ 936.369601][ T977] usb 6-1: config 4 has no interface number 0 [ 936.400571][ T977] usb 6-1: config 4 interface 30 has no altsetting 0 [ 936.430219][ T977] usb 6-1: string descriptor 0 read error: -22 [ 936.440229][ T977] usb 6-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 936.468954][ T977] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.566573][ T977] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 936.611087][ T977] dw2102: su3000_power_ctrl: 1, initialized 0 [ 936.643377][ T977] dvb-usb: bulk message failed: -22 (2/0) [ 936.681128][ T977] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 936.706738][ T977] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 936.714673][ T977] usb 6-1: media controller created [ 936.720039][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.733214][ T977] dw2102: i2c transfer failed. [ 936.741717][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.810908][ T977] dw2102: i2c transfer failed. [ 936.842361][T19359] dvb-usb: bulk message failed: -22 (3/0) [ 936.856491][T19359] dw2102: i2c transfer failed. [ 936.871125][T19359] dvb-usb: bulk message failed: -22 (4/0) [ 936.879335][T19387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 936.889730][T19359] dw2102: i2c transfer failed. [ 936.900275][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.900648][T19387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 936.906242][ T977] dw2102: i2c transfer failed. [ 936.918907][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.924951][ T977] dw2102: i2c transfer failed. [ 936.930356][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.936208][ T977] dw2102: i2c transfer failed. [ 936.941253][ T977] dvb-usb: bulk message failed: -22 (6/0) [ 936.947445][ T977] dw2102: i2c transfer failed. [ 936.952400][ T977] dvb-usb: MAC address: 02:02:02:02:02:02 [ 937.020535][ T977] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 937.086685][ T977] dvb-usb: bulk message failed: -22 (3/0) [ 937.110219][ T977] dw2102: command 0x0e transfer failed. [ 937.130439][ T977] dvb-usb: bulk message failed: -22 (3/0) [ 937.139339][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 937.146303][ T5929] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 937.152636][ T5929] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 937.160749][ T977] dw2102: command 0x0e transfer failed. [ 937.491230][ T977] dvb-usb: bulk message failed: -22 (3/0) [ 937.505968][ T977] dw2102: command 0x0e transfer failed. [ 937.528227][ T977] dvb-usb: bulk message failed: -22 (3/0) [ 937.539738][ T977] dw2102: command 0x0e transfer failed. [ 937.555901][ T977] dvb-usb: bulk message failed: -22 (1/0) [ 937.556856][T19396] loop6: detected capacity change from 0 to 63 [ 937.572516][ T977] dw2102: command 0x51 transfer failed. [ 937.585311][ T5975] buffer_io_error: 10 callbacks suppressed [ 937.585331][ T5975] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.588798][ T977] dvb-usb: bulk message failed: -22 (5/0) [ 937.651932][ T5975] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.663119][ T977] dw2102: i2c probe for address 0x68 failed. [ 937.680377][T19396] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.689848][ T977] dvb-usb: bulk message failed: -22 (5/0) [ 937.696048][T19399] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.716215][ T5975] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.720963][ T977] dw2102: i2c probe for address 0x69 failed. [ 937.741178][T19396] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.749286][T19396] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.770947][ T977] dvb-usb: bulk message failed: -22 (5/0) [ 937.787876][ T977] dw2102: i2c probe for address 0x6a failed. [ 937.794150][T19394] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.801358][ T977] dw2102: probing for demodulator failed. Is the external power switched on? [ 937.830584][ T5975] Buffer I/O error on dev loop6, logical block 0, async page read [ 937.841038][ T977] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 937.851953][ T5975] Buffer I/O error on dev loop6, logical block 0, async page read [ 938.141430][ T977] rc_core: IR keymap rc-tt-1500 not found [ 938.148632][ T977] Registered IR keymap rc-empty [ 938.189055][ T977] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 938.252389][ T977] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input75 [ 938.373294][ T977] dvb-usb: schedule remote query interval to 250 msecs. [ 938.684467][ T977] dw2102: su3000_power_ctrl: 0, initialized 1 [ 938.722070][ T977] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 938.932654][ T977] usb 6-1: USB disconnect, device number 84 [ 939.691176][ T977] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 939.765738][T19429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.821026][T19429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.994417][T14006] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 940.040947][ T977] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 940.181299][T14006] usb 1-1: Using ep0 maxpacket: 16 [ 940.196109][T14006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.207800][T14006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 940.213503][ T977] usb 6-1: Using ep0 maxpacket: 32 [ 940.267116][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.280340][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 940.281072][T14006] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 940.314871][T19434] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3508'. [ 940.333470][ T977] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 940.345407][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.438468][ T977] usb 6-1: config 0 descriptor?? [ 940.483772][T14006] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 940.509132][T14006] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.513589][ T977] hub 6-1:0.0: USB hub found [ 940.520200][T14006] usb 1-1: config 0 descriptor?? [ 940.673000][ T10] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 940.735230][ T977] hub 6-1:0.0: 2 ports detected [ 940.846601][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 940.855325][ T10] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 940.870971][ T10] usb 5-1: config 0 has no interface number 0 [ 940.948397][ T10] usb 5-1: config 0 interface 128 altsetting 0 has an endpoint descriptor with address 0x1B, changing to 0xB [ 940.981907][ T10] usb 5-1: config 0 interface 128 altsetting 0 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 940.987127][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.002978][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.003340][ T10] usb 5-1: config 0 interface 128 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 941.014973][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.029825][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.046664][ T10] usb 5-1: New USB device found, idVendor=0bb4, idProduct=0a26, bcdDevice=7b.73 [ 941.062574][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.066078][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.089287][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.097149][ T10] usb 5-1: Product: syz [ 941.109786][ T10] usb 5-1: Manufacturer: syz [ 941.121027][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.124911][ T10] usb 5-1: SerialNumber: syz [ 941.154076][ T10] usb 5-1: config 0 descriptor?? [ 941.159772][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.196767][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.217920][T14006] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 941.258758][T14006] microsoft 0003:045E:07DA.0024: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 941.301641][T14006] microsoft 0003:045E:07DA.0024: no inputs found [ 941.332397][T14006] microsoft 0003:045E:07DA.0024: could not initialize ff, continuing anyway [ 941.404770][T14006] usb 1-1: USB disconnect, device number 40 [ 941.414011][ T10] usb 5-1: USB disconnect, device number 75 [ 941.486562][T19443] fido_id[19443]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 941.775122][ T977] hub 6-1:0.0: hub_hub_status failed (err = -32) [ 941.796137][ T977] hub 6-1:0.0: config failed, can't get hub status (err -32) [ 941.809333][ T977] usbhid 6-1:0.0: can't add hid device: -32 [ 941.816695][ T977] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 941.830339][T19448] can: request_module (can-proto-0) failed. [ 942.278622][ T977] usb 6-1: USB disconnect, device number 85 [ 942.320603][T19473] fuse: Unknown parameter 'fd<Û¦þÙ#*¼Üœæü˜13]de9‰‰YiÂô@K]' [ 942.371015][T14006] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 942.554718][T14006] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 942.580912][T14006] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 942.618370][T14006] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 942.644071][T14006] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.702264][T19464] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 942.745534][T14006] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 942.755451][T19489] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3523'. [ 943.069851][T19489] syz.2.3523 (19489): drop_caches: 2 [ 943.841706][T19505] FAULT_INJECTION: forcing a failure. [ 943.841706][T19505] name failslab, interval 1, probability 0, space 0, times 0 [ 943.855321][T19505] CPU: 0 UID: 0 PID: 19505 Comm: syz.5.3531 Not tainted syzkaller #0 PREEMPT(full) [ 943.855346][T19505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 943.855357][T19505] Call Trace: [ 943.855369][T19505] [ 943.855377][T19505] dump_stack_lvl+0x189/0x250 [ 943.855403][T19505] ? __pfx____ratelimit+0x10/0x10 [ 943.855423][T19505] ? __pfx_dump_stack_lvl+0x10/0x10 [ 943.855443][T19505] ? __pfx__printk+0x10/0x10 [ 943.855470][T19505] ? rcu_read_lock_sched_held+0x89/0x100 [ 943.855493][T19505] ? rcu_is_watching+0x15/0xb0 [ 943.855516][T19505] should_fail_ex+0x414/0x560 [ 943.855546][T19505] should_failslab+0xa8/0x100 [ 943.855572][T19505] kmem_cache_alloc_node_noprof+0x77/0x710 [ 943.855594][T19505] ? __alloc_skb+0x112/0x2d0 [ 943.855620][T19505] __alloc_skb+0x112/0x2d0 [ 943.855643][T19505] skb_copy_expand+0x1b1/0xb90 [ 943.855681][T19505] sctp_ulpevent_make_send_failed_event+0x5d/0xb20 [ 943.855718][T19505] sctp_datamsg_put+0x38d/0x540 [ 943.855747][T19505] sctp_chunk_free+0x4a/0x60 [ 943.855774][T19505] __sctp_outq_teardown+0x7ab/0x9a0 [ 943.855799][T19505] sctp_association_free+0x240/0x7f0 [ 943.855826][T19505] sctp_do_sm+0x3eba/0x5a20 [ 943.855865][T19505] ? __pfx_sctp_do_sm+0x10/0x10 [ 943.855929][T19505] ? rcu_is_watching+0x15/0xb0 [ 943.855955][T19505] sctp_primitive_SHUTDOWN+0x98/0xc0 [ 943.855978][T19505] ? __pfx_sctp_shutdown+0x10/0x10 [ 943.855999][T19505] inet_shutdown+0x271/0x390 [ 943.856022][T19505] __x64_sys_shutdown+0x13c/0x1a0 [ 943.856047][T19505] do_syscall_64+0xfa/0x3b0 [ 943.856062][T19505] ? lockdep_hardirqs_on+0x9c/0x150 [ 943.856079][T19505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.856094][T19505] ? clear_bhb_loop+0x60/0xb0 [ 943.856113][T19505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.856127][T19505] RIP: 0033:0x7f7d6bd8eec9 [ 943.856141][T19505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 943.856168][T19505] RSP: 002b:00007f7d69ff6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000030 [ 943.856187][T19505] RAX: ffffffffffffffda RBX: 00007f7d6bfe6090 RCX: 00007f7d6bd8eec9 [ 943.856200][T19505] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003 [ 943.856211][T19505] RBP: 00007f7d69ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 943.856221][T19505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 943.856232][T19505] R13: 00007f7d6bfe6128 R14: 00007f7d6bfe6090 R15: 00007f7d6c10fa28 [ 943.856262][T19505] [ 944.119564][T19507] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3530'. [ 944.129926][T19507] netlink: 4680 bytes leftover after parsing attributes in process `syz.4.3530'. [ 944.139511][T19507] netlink: 1896 bytes leftover after parsing attributes in process `syz.4.3530'. [ 944.899703][ T10] usb 2-1: USB disconnect, device number 31 [ 946.569745][T19547] netlink: 'syz.2.3541': attribute type 20 has an invalid length. [ 947.173845][T19552] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3544'. [ 947.192369][T19552] netlink: 4680 bytes leftover after parsing attributes in process `syz.1.3544'. [ 947.218540][T19552] netlink: 1896 bytes leftover after parsing attributes in process `syz.1.3544'. [ 947.450129][T19557] netlink: 'syz.0.3546': attribute type 10 has an invalid length. [ 947.480770][T19557] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 947.566367][ T977] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 947.733335][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 947.746941][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 947.757805][ T9] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 947.776131][ T977] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 947.786787][ T977] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.819293][ T977] usb 5-1: config 0 descriptor?? [ 947.921049][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 947.939268][ T9] usb 1-1: config 0 has an invalid interface number: 217 but max is 0 [ 947.948922][ T9] usb 1-1: config 0 has no interface number 0 [ 947.976564][ T9] usb 1-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 947.986068][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.994965][ T9] usb 1-1: Product: syz [ 947.999891][ T9] usb 1-1: Manufacturer: syz [ 948.005415][ T9] usb 1-1: SerialNumber: syz [ 948.017953][ T9] usb 1-1: config 0 descriptor?? [ 948.033523][ T10] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 948.063719][ T9] ftdi_sio 1-1:0.217: FTDI USB Serial Device converter detected [ 948.075004][ T9] usb 1-1: Detected SIO [ 948.084513][ T9] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 948.200963][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 948.209364][ T10] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 948.219574][ T10] usb 3-1: config 0 has no interface number 0 [ 948.226162][ T10] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 21760, setting to 1024 [ 948.240177][ T10] usb 3-1: config 0 interface 67 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 948.258836][ T977] cm6533_jd 0003:0D8C:0022.0025: unknown main item tag 0x0 [ 948.268845][ T9] usb 1-1: USB disconnect, device number 41 [ 948.302014][ T9] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 948.316110][ T977] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0D8C:0022.0025/input/input77 [ 948.332561][ T10] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 948.343328][ T9] ftdi_sio 1-1:0.217: device disconnected [ 948.354414][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.378785][ T10] usb 3-1: Product: syz [ 948.392218][ T977] cm6533_jd 0003:0D8C:0022.0025: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.4-1/input0 [ 948.407629][ T10] usb 3-1: Manufacturer: syz [ 948.412780][ T10] usb 3-1: SerialNumber: syz [ 948.434228][ T10] usb 3-1: config 0 descriptor?? [ 948.442934][T19561] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 948.474920][ T10] smsc95xx v2.0.0 [ 948.509786][ T977] usb 5-1: USB disconnect, device number 76 [ 948.530046][T19578] fido_id[19578]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 948.674634][T19561] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 948.883911][ T10] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -61 [ 948.894947][ T10] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 949.061468][ T9] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 949.214731][T19588] input: syz1 as /devices/virtual/input/input78 [ 949.284951][ T9] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 949.320078][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 949.348758][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 949.431736][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 949.459012][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 949.475540][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 949.709054][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.231147][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.360988][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.384835][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.495437][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.511037][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.531088][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.541177][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.550476][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.573564][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.586173][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.605676][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.648756][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.682124][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.710954][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.769108][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.785771][ T10] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 950.812791][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 950.832226][ T10] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 950.852479][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 950.886059][ T10] usb 3-1: USB disconnect, device number 72 [ 950.900872][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 950.930416][ T9] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 950.956550][ T9] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 950.981929][ T9] usb 1-1: Product: syz [ 950.986144][ T9] usb 1-1: Manufacturer: syz [ 951.014992][ T9] usb 1-1: SerialNumber: syz [ 951.015239][T19610] syzkaller1: entered promiscuous mode [ 951.042136][T19610] syzkaller1: entered allmulticast mode [ 951.043055][ T9] usb 1-1: config 0 descriptor?? [ 951.071299][T19610] raw_sendmsg: syz.5.3562 forgot to set AF_INET. Fix it! [ 951.086662][ T9] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 951.320953][ T5915] usb 6-1: new low-speed USB device number 86 using dummy_hcd [ 951.332931][ C0] usb 1-1: yurex_control_callback - control failed: -71 [ 951.333341][T14006] usb 1-1: USB disconnect, device number 42 [ 951.350135][T14006] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 951.351431][ T10] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 951.459600][ T5915] usb 6-1: device descriptor read/64, error -71 [ 951.552589][ T10] usb 3-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 951.564173][ T10] usb 3-1: config 253 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 951.711141][ T10] usb 3-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 951.726386][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 951.732726][ T5915] usb 6-1: new low-speed USB device number 87 using dummy_hcd [ 951.743863][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 951.752318][ T10] usb 3-1: SerialNumber: syz [ 951.936266][ T5915] usb 6-1: device descriptor read/64, error -71 [ 952.001276][ T10] rndis_host 3-1:253.0: RNDIS init failed, -71 [ 952.012021][ T10] rndis_host 3-1:253.0: probe with driver rndis_host failed with error -71 [ 952.041404][ T10] usb 3-1: USB disconnect, device number 73 [ 952.051135][ T5915] usb usb6-port1: attempt power cycle [ 952.401094][ T5915] usb 6-1: new low-speed USB device number 88 using dummy_hcd [ 952.433909][T19639] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3569'. [ 952.460184][ T5915] usb 6-1: device descriptor read/8, error -71 [ 952.467369][T19639] netlink: 4680 bytes leftover after parsing attributes in process `syz.0.3569'. [ 952.490960][T19639] netlink: 1896 bytes leftover after parsing attributes in process `syz.0.3569'. [ 952.701088][ T5915] usb 6-1: new low-speed USB device number 89 using dummy_hcd [ 953.101708][ T5915] usb 6-1: device descriptor read/8, error -71 [ 953.140948][ T1207] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 953.215612][ T5915] usb usb6-port1: unable to enumerate USB device [ 953.297066][ T1207] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 953.308705][ T1207] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 953.319714][ T1207] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 953.331844][ T1207] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 953.347472][ T1207] usb 2-1: SerialNumber: syz [ 953.589060][T19644] input: syz1 as /devices/virtual/input/input79 [ 953.596213][T19644] input: failed to attach handler leds to device input79, error: -6 [ 953.604475][ T10] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 953.620422][T19655] netlink: 'syz.0.3574': attribute type 4 has an invalid length. [ 953.793627][ T10] usb 3-1: config 0 has an invalid interface number: 249 but max is 0 [ 953.804216][ T10] usb 3-1: config 0 has no interface number 0 [ 953.818944][ T10] usb 3-1: config 0 interface 249 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 953.829615][ T10] usb 3-1: config 0 interface 249 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 0 [ 953.858213][ T10] usb 3-1: config 0 interface 249 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 953.889797][ T10] usb 3-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=be.87 [ 953.909046][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.952084][ T10] usb 3-1: config 0 descriptor?? [ 953.970074][ T10] port100 3-1:0.249: NFC: Could not find bulk-in or bulk-out endpoint [ 954.179259][T19649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 954.212733][T19649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 954.234140][ T5915] usb 3-1: USB disconnect, device number 74 [ 954.825040][T19685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3582'. [ 955.242873][T19694] netlink: 596 bytes leftover after parsing attributes in process `syz.5.3584'. [ 955.930960][ T10] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 956.183014][ T10] usb 3-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 956.219308][ T10] usb 3-1: config 3 has 1 interface, different from the descriptor's value: 2 [ 956.591013][ T10] usb 3-1: config 3 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 957.142907][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 957.152382][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 957.179372][ T10] usb 3-1: Product: syz [ 957.264555][ T10] usb 3-1: Manufacturer: syz [ 957.280952][ T10] usb 3-1: SerialNumber: syz [ 957.313013][ T10] cdc_ncm 3-1:3.0: CDC Union missing and no IAD found [ 957.352345][ T10] cdc_ncm 3-1:3.0: bind() failure [ 957.655284][ T10] usb 3-1: USB disconnect, device number 75 [ 958.435889][ T1207] usb 2-1: 0:2 : does not exist [ 958.466161][ T1207] usb 2-1: unit 5 not found! [ 958.956681][ T10] usb 2-1: USB disconnect, device number 32 [ 959.249245][T19742] tipc: Enabling of bearer rejected, failed to enable media [ 959.264840][T19744] binder: 19743:19744 ioctl c0306201 200000000080 returned -14 [ 959.273828][T19742] syzkaller0: entered promiscuous mode [ 959.279511][T19742] syzkaller0: entered allmulticast mode [ 959.300022][T19744] vxcan1: entered allmulticast mode [ 959.307258][ T1207] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 959.363706][T19744] vxcan1: left allmulticast mode [ 959.379837][T19754] IPv6: addrconf: prefix option has invalid lifetime [ 959.488218][ T30] audit: type=1326 audit(1759491702.803:1047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 959.511561][ T1207] usb 6-1: Using ep0 maxpacket: 8 [ 959.632318][ T30] audit: type=1326 audit(1759491702.803:1048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=27 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 959.654920][ C1] vkms_vblank_simulate: vblank timer overrun [ 959.662201][ T30] audit: type=1326 audit(1759491702.803:1049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 959.687598][ T30] audit: type=1326 audit(1759491702.803:1050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 959.710695][ T1207] usb 6-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 959.720301][ T1207] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.789712][ T1207] usb 6-1: Product: syz [ 959.812094][ T1207] usb 6-1: Manufacturer: syz [ 960.380580][ T1207] usb 6-1: SerialNumber: syz [ 960.387880][ T30] audit: type=1326 audit(1759491702.803:1051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.414936][ T1207] usb 6-1: config 0 descriptor?? [ 960.434906][ T1207] usb 6-1: selecting invalid altsetting 3 [ 960.440718][ T1207] comedi comedi5: could not set alternate setting 3 in high speed [ 960.454245][ T30] audit: type=1326 audit(1759491702.803:1052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.476781][ T1207] usbdux 6-1:0.0: driver 'usbdux' failed to auto-configure device. [ 960.493035][ T30] audit: type=1326 audit(1759491702.803:1053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.516799][ T1207] usbdux 6-1:0.0: probe with driver usbdux failed with error -22 [ 960.539618][ T30] audit: type=1326 audit(1759491702.803:1054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.574261][ T30] audit: type=1326 audit(1759491702.803:1055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.613684][ T30] audit: type=1326 audit(1759491702.803:1056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19741 comm="syz.4.3596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f912ff8eec9 code=0x7ffc0000 [ 960.940926][ T1207] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 960.950458][T19788] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 961.141001][ T1207] usb 1-1: Using ep0 maxpacket: 8 [ 961.148745][ T1207] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 961.168428][T19789] tc_dump_action: action bad kind [ 961.196648][ T1207] usb 1-1: config 179 has no interface number 0 [ 961.203668][ T5838] usb 6-1: USB disconnect, device number 90 [ 961.222819][ T1207] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 961.313855][ T1207] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 961.493714][ T1207] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 961.572032][ T1207] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 961.583699][ T1207] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 961.598742][ T1207] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 961.611074][ T1207] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 961.638747][T19779] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 961.781005][ T5838] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 961.877416][T19778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 961.911278][ T5838] usb 6-1: device descriptor read/64, error -71 [ 961.921683][T19778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 961.935848][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input80 [ 961.948517][T19778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 961.986664][T19778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.028747][T19778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.067865][T19778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.151308][ T5838] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 962.274358][T19778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.285527][T19778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.293874][ T5838] usb 6-1: device descriptor read/64, error -71 [ 962.305046][T19778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.323605][T19778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.420200][ T5838] usb usb6-port1: attempt power cycle [ 962.524991][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input81 [ 962.545381][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input82 [ 962.697362][T19798] IPv6: addrconf: prefix option has invalid lifetime [ 962.761200][ T5838] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 962.801826][ T5838] usb 6-1: device descriptor read/8, error -71 [ 962.837277][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input83 [ 963.052873][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input84 [ 963.068759][ T5838] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 963.122410][ T5838] usb 6-1: device descriptor read/8, error -71 [ 963.156510][ T1207] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input85 [ 963.242022][ T5838] usb usb6-port1: unable to enumerate USB device [ 963.431791][ T5838] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input86 [ 963.735506][ T5908] usb 1-1: USB disconnect, device number 43 [ 963.741711][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 963.741753][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 963.968369][T19801] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3612'. [ 964.008173][T19813] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3617'. [ 964.017612][T19813] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3617'. [ 964.026725][T19813] netlink: 'syz.1.3617': attribute type 5 has an invalid length. [ 964.041163][T19813] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3617'. [ 964.925736][T19825] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 964.966215][ T5908] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 965.144769][ T5908] usb 6-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 965.154143][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.163462][ T5908] usb 6-1: Product: syz [ 965.169686][ T5908] usb 6-1: Manufacturer: syz [ 965.179174][ T5908] usb 6-1: SerialNumber: syz [ 965.207099][ T5908] usb 6-1: config 0 descriptor?? [ 965.219914][ T5908] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 965.261128][ T5838] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 965.291040][ T1207] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 965.417031][ T5838] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 965.442248][ T5838] usb 1-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 965.453057][ T1207] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 965.472771][ T5908] sonixb 6-1:0.0: Error reading register 00: -32 [ 965.479462][ T1207] usb 5-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 965.492478][ T5838] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.500977][ T1207] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.513843][ T5838] usb 1-1: config 0 descriptor?? [ 965.537980][ T1207] usb 5-1: config 0 descriptor?? [ 965.853163][T19842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 965.893029][T19842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 965.929779][T19844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 965.939255][T19844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 967.185383][T19855] netlink: 4680 bytes leftover after parsing attributes in process `syz.1.3628'. [ 967.221010][T19855] netlink: 1896 bytes leftover after parsing attributes in process `syz.1.3628'. [ 967.535125][ T9] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 967.662076][T14006] usb 6-1: USB disconnect, device number 95 [ 967.703450][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 967.719726][ T9] usb 3-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 967.752753][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.764918][ T9] usb 3-1: config 0 descriptor?? [ 968.531863][ T1207] usbhid 5-1:0.0: can't add hid device: -71 [ 968.551410][ T1207] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 968.710971][ T1207] usb 5-1: USB disconnect, device number 77 [ 969.201033][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 969.201052][ T30] audit: type=1326 audit(1759491712.433:1061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.258640][ T30] audit: type=1326 audit(1759491712.443:1062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.303042][ T5838] usbhid 1-1:0.0: can't add hid device: -71 [ 969.317797][ T5838] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 969.338617][ T30] audit: type=1326 audit(1759491712.443:1063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.393336][ T30] audit: type=1326 audit(1759491712.443:1064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.415837][ T1207] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 969.462468][ T5838] usb 1-1: USB disconnect, device number 44 [ 969.467211][ T30] audit: type=1326 audit(1759491712.443:1065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.518826][ T30] audit: type=1326 audit(1759491712.443:1066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.567605][ T30] audit: type=1326 audit(1759491712.443:1067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.607294][ T30] audit: type=1326 audit(1759491712.443:1068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.610951][ T1207] usb 5-1: Using ep0 maxpacket: 16 [ 969.637460][ T30] audit: type=1326 audit(1759491712.443:1069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.677328][ T30] audit: type=1326 audit(1759491712.453:1070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19877 comm="syz.1.3634" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f395098eec9 code=0x7ffc0000 [ 969.693132][ T1207] usb 5-1: unable to get BOS descriptor or descriptor too short [ 969.727710][ T1207] usb 5-1: config 13 has an invalid interface number: 50 but max is 0 [ 969.736232][ T1207] usb 5-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 969.775997][ T1207] usb 5-1: config 13 has no interface number 0 [ 969.804157][ T1207] usb 5-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 970.110032][ T1207] usb 5-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 970.211197][ T1207] usb 5-1: config 13 interface 50 has no altsetting 0 [ 970.220574][ T1207] usb 5-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 970.230068][ T1207] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.239161][ T1207] usb 5-1: Product: syz [ 970.266678][ T1207] usb 5-1: Manufacturer: syz [ 970.299733][ T1207] usb 5-1: SerialNumber: syz [ 970.330593][T19876] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 970.682809][T19876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 970.837851][T19876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 970.948956][ T1207] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 970.971286][ T1207] usb 5-1: MIDIStreaming interface descriptor not found [ 971.017524][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 971.058799][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 971.087333][ T1207] usb 5-1: USB disconnect, device number 78 [ 971.088425][ T9] usb 3-1: USB disconnect, device number 76 [ 971.184166][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:13.50/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 971.475558][T19911] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3642'. [ 971.487319][T19911] netlink: 4680 bytes leftover after parsing attributes in process `syz.5.3642'. [ 971.498893][T19911] netlink: 1896 bytes leftover after parsing attributes in process `syz.5.3642'. [ 971.583114][ T9] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 971.756266][ T9] usb 3-1: device descriptor read/64, error -71 [ 972.011307][ T9] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 972.161037][ T9] usb 3-1: device descriptor read/64, error -71 [ 972.271625][ T9] usb usb3-port1: attempt power cycle [ 972.679085][ T9] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 972.701420][ T9] usb 3-1: device descriptor read/8, error -71 [ 972.960933][ T9] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 972.981689][ T9] usb 3-1: device descriptor read/8, error -71 [ 973.545200][ T9] usb usb3-port1: unable to enumerate USB device [ 973.630926][T19936] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3648'. [ 973.910923][ T5929] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 974.080911][ T5929] usb 5-1: Using ep0 maxpacket: 16 [ 974.094769][ T5929] usb 5-1: unable to get BOS descriptor or descriptor too short [ 974.104268][ T5929] usb 5-1: config 3 has an invalid interface number: 3 but max is 0 [ 974.137630][ T5929] usb 5-1: config 3 has no interface number 0 [ 974.158842][ T5929] usb 5-1: config 3 interface 3 has no altsetting 0 [ 974.193486][T19954] fuse: Bad value for 'group_id' [ 974.219760][ T5929] usb 5-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=aa.69 [ 974.219963][T19954] fuse: Bad value for 'group_id' [ 974.234979][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.261063][ T5929] usb 5-1: Product: syz [ 974.265494][ T5929] usb 5-1: Manufacturer: syz [ 974.270108][ T5929] usb 5-1: SerialNumber: syz [ 974.424258][T19957] tipc: Enabled bearer , priority 0 [ 974.492743][T19958] syzkaller0: entered promiscuous mode [ 974.498252][T19958] syzkaller0: entered allmulticast mode [ 974.562995][T19962] netlink: 'syz.5.3655': attribute type 1 has an invalid length. [ 974.640538][T19957] tipc: Resetting bearer [ 974.663580][T19953] tipc: Resetting bearer [ 974.743430][T19953] tipc: Disabling bearer [ 974.903880][ T5922] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 975.151310][ T10] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 975.159558][ T5922] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 975.167858][ T5922] usb 3-1: config 0 has no interface number 0 [ 975.176744][ T5922] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 975.236413][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.245594][ T5922] usb 3-1: Product: syz [ 975.250062][ T5922] usb 3-1: Manufacturer: syz [ 975.256947][ T5922] usb 3-1: SerialNumber: syz [ 975.265147][ T5922] usb 3-1: config 0 descriptor?? [ 975.447427][ T10] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 975.472924][ T10] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 975.500172][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 975.510937][ T5922] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 975.532981][ T5922] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 975.550138][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.560329][ T5922] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 975.707813][T19984] netlink: 92 bytes leftover after parsing attributes in process `syz.5.3661'. [ 975.719946][T19975] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 975.727586][ T5922] usb 3-1: media controller created [ 975.753218][ T10] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 975.757366][ T30] kauditd_printk_skb: 101 callbacks suppressed [ 975.757382][ T30] audit: type=1400 audit(1759491719.073:1172): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=19983 comm="syz.5.3661" [ 975.935975][ T5922] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 975.948647][T19975] fuse: Unknown parameter 'rootmod' [ 976.139320][ T5929] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 976.263704][ T5929] snd-usb-audio 5-1:3.3: probe with driver snd-usb-audio failed with error -2 [ 976.281264][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 976.322363][ T5922] i2c i2c-1: ec100: i2c rd failed=-32 reg=33 [ 976.336164][ T5929] usb 5-1: USB disconnect, device number 79 [ 976.400165][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:3.3/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 976.530952][ T10] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 976.543684][ T5922] usb 3-1: USB disconnect, device number 81 [ 976.764013][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 976.783773][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 976.792151][ T10] usb 6-1: New USB device found, idVendor=0dfc, idProduct=0101, bcdDevice= 0.00 [ 976.810201][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 976.828667][ T10] usb 6-1: config 0 descriptor?? [ 976.861106][ T5929] usb 5-1: new full-speed USB device number 80 using dummy_hcd [ 976.990966][ T5929] usb 5-1: device descriptor read/64, error -71 [ 977.244269][ T5929] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 977.256305][ T10] hid (null): report_id 0 is invalid [ 977.272603][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.289714][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.303584][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.316136][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.337886][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.349800][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.372361][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.391425][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.403345][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.416903][ T10] hid-generic 0003:0DFC:0101.0026: unknown main item tag 0x0 [ 977.424500][ T5929] usb 5-1: device descriptor read/64, error -71 [ 977.516696][ T10] hid-generic 0003:0DFC:0101.0026: unexpected long global item [ 977.526141][ T10] hid-generic 0003:0DFC:0101.0026: probe with driver hid-generic failed with error -22 [ 977.559357][ T10] usb 6-1: USB disconnect, device number 96 [ 977.591567][ T5929] usb usb5-port1: attempt power cycle [ 977.961034][ T5929] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 977.991695][ T5929] usb 5-1: device descriptor read/8, error -71 [ 978.223731][ T10] usb 2-1: USB disconnect, device number 33 [ 978.266103][ T5929] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 978.301630][ T5929] usb 5-1: device descriptor read/8, error -71 [ 978.441283][ T5929] usb usb5-port1: unable to enumerate USB device [ 978.671170][ T10] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 978.823855][ T10] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 978.836346][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 978.868611][T20031] ptrace attach of "./syz-executor exec"[16218] was attempted by "./syz-executor exec"[20031] [ 978.874254][ T10] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 978.896788][T20031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3676'. [ 978.961092][ T10] usb 2-1: config 1 has no interface number 1 [ 978.967377][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 978.987388][ T10] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 979.012032][ T10] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 979.046624][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.056188][ T10] usb 2-1: Product: syz [ 979.060392][ T10] usb 2-1: Manufacturer: syz [ 979.065832][ T10] usb 2-1: SerialNumber: syz [ 979.078544][T20031] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 979.322565][ T10] usb 2-1: No endpoint at altset 1, falling back to MIDI 1.0 [ 979.330269][ T10] usb 2-1: MIDIStreaming interface descriptor not found [ 979.470123][ T10] usb 2-1: USB disconnect, device number 34 [ 979.542703][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 980.660924][ T1207] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 980.868458][ T1207] usb 2-1: Using ep0 maxpacket: 8 [ 980.892606][ T1207] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 980.905082][ T1207] usb 2-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 980.915155][ T1207] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.923778][ T1207] usb 2-1: Product: syz [ 980.928734][ T1207] usb 2-1: Manufacturer: syz [ 980.935762][ T1207] usb 2-1: SerialNumber: syz [ 980.955472][ T1207] usb 2-1: config 0 descriptor?? [ 981.026821][ T1207] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 981.077639][ T1207] usb 2-1: selecting invalid altsetting 1 [ 981.116452][T20061] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3683'. [ 981.125723][T20061] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3683'. [ 981.195447][T20061] bond7: entered promiscuous mode [ 981.202849][T20061] bond7: entered allmulticast mode [ 981.211510][T20061] 8021q: adding VLAN 0 to HW filter on device bond7 [ 981.500148][ T1207] usb 2-1: USB disconnect, device number 35 [ 982.306633][T20076] bond2: Removing last ns target with arp_interval on [ 983.118742][T20095] IPv6: addrconf: prefix option has invalid lifetime [ 983.141261][ T5929] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 983.331008][ T5929] usb 3-1: Using ep0 maxpacket: 16 [ 983.406656][ T5929] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 983.471454][ T5929] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 983.530441][ T5929] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 983.576937][ T5929] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 983.681927][T20104] program syz.1.3692 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 983.990104][ T5929] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 984.122350][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 984.122366][ T30] audit: type=1800 audit(1759491727.423:1173): pid=20105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3691" name="file0" dev="fuse" ino=0 res=0 errno=0 [ 984.192931][ T5929] usb 3-1: SerialNumber: syz [ 984.236220][ T5929] hub 3-1:1.0: bad descriptor, ignoring hub [ 984.247673][ T5929] hub 3-1:1.0: probe with driver hub failed with error -5 [ 984.347492][ T5929] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 984.768058][T20116] trusted_key: encrypted_key: master key parameter is missing [ 985.041209][ T5838] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 985.201615][ T5838] usb 5-1: Using ep0 maxpacket: 32 [ 985.214236][ T5838] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 985.223003][ T5838] usb 5-1: config 0 has no interface number 0 [ 985.507316][ T5838] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 985.523075][ T5838] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 985.533366][ T5838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.546890][ T5838] usb 5-1: Product: syz [ 985.552848][ T5838] usb 5-1: Manufacturer: syz [ 985.557820][ T5838] usb 5-1: SerialNumber: syz [ 985.575403][ T5838] usb 5-1: config 0 descriptor?? [ 985.585054][ T5838] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 985.598477][ T5838] em28xx 5-1:0.132: Video interface 132 found: [ 985.866767][T20137] IPv6: addrconf: prefix option has invalid lifetime [ 986.310688][ T5922] usb 3-1: USB disconnect, device number 82 [ 986.895232][ T5838] em28xx 5-1:0.132: unknown em28xx chip ID (0) [ 986.996955][ T5838] em28xx 5-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 987.086954][ T5838] em28xx 5-1:0.132: board has no eeprom [ 987.240928][ T5838] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 987.248792][ T5838] em28xx 5-1:0.132: analog set to bulk mode. [ 987.330965][T14006] em28xx 5-1:0.132: Registering V4L2 extension [ 987.418484][ T5838] usb 5-1: USB disconnect, device number 84 [ 987.521278][ T5915] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 987.536576][ T5838] em28xx 5-1:0.132: Disconnecting em28xx [ 987.703062][ T5915] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 987.747892][ T5915] usb 6-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 987.818950][ T5915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 987.959402][ T5915] usb 6-1: config 0 descriptor?? [ 988.120747][T14006] em28xx 5-1:0.132: Config register raw data: 0xffffffed [ 988.129293][T14006] em28xx 5-1:0.132: AC97 chip type couldn't be determined [ 988.177308][T14006] em28xx 5-1:0.132: No AC97 audio processor [ 988.214814][T14006] usb 5-1: Decoder not found [ 988.291626][T20174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 988.300863][T20174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 988.352117][T14006] em28xx 5-1:0.132: failed to create media graph [ 988.362002][T14006] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 988.392381][T14006] em28xx 5-1:0.132: Remote control support is not available for this card. [ 988.405283][ T5838] em28xx 5-1:0.132: Closing input extension [ 988.426521][ T5838] em28xx 5-1:0.132: Freeing device [ 988.516615][ T10] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 988.668071][T20182] IPv6: addrconf: prefix option has invalid lifetime [ 988.767114][ T10] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 988.787417][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.848995][ T10] usb 3-1: Product: syz [ 988.895683][ T10] usb 3-1: Manufacturer: syz [ 988.910670][ T10] usb 3-1: SerialNumber: syz [ 988.947049][ T10] usb 3-1: config 0 descriptor?? [ 988.974289][ T10] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 989.232245][ T1207] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 989.391187][ T1207] usb 2-1: Using ep0 maxpacket: 16 [ 989.520259][ T1207] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 989.580139][ T5922] usb 3-1: USB disconnect, device number 83 [ 989.607683][ T1207] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 989.675381][ T1207] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 989.891001][ T1207] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 990.109145][ T1207] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 990.203626][ T1207] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 990.270896][ T5922] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 990.304136][T20206] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3719'. [ 990.336297][ T1207] usb 2-1: SerialNumber: syz [ 990.490893][ T5922] usb 3-1: Using ep0 maxpacket: 8 [ 990.545488][ T5922] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 990.561984][ T5929] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 990.581571][ T1207] hub 2-1:1.0: bad descriptor, ignoring hub [ 990.588506][ T1207] hub 2-1:1.0: probe with driver hub failed with error -5 [ 990.597053][ T1207] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 990.712445][ T5922] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 990.731000][ T5922] usb 3-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 990.753346][ T5922] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 990.775774][ T5922] usb 3-1: config 0 descriptor?? [ 990.892084][ T5929] usb 5-1: Using ep0 maxpacket: 16 [ 990.914956][ T5929] usb 5-1: unable to get BOS descriptor or descriptor too short [ 990.922545][ T5915] usbhid 6-1:0.0: can't add hid device: -71 [ 990.947465][ T5915] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 990.948716][ T5929] usb 5-1: config 3 has an invalid interface number: 3 but max is 0 [ 990.975871][ T5915] usb 6-1: USB disconnect, device number 97 [ 990.989716][ T5929] usb 5-1: config 3 has no interface number 0 [ 991.020878][ T5929] usb 5-1: config 3 interface 3 has no altsetting 0 [ 991.163506][ T5929] usb 5-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=aa.69 [ 991.179828][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 991.200576][ T5929] usb 5-1: Product: syz [ 991.213994][ T5922] cherry 0003:046A:0027.0027: item fetching failed at offset 2/69 [ 991.223601][ T5929] usb 5-1: Manufacturer: syz [ 991.232499][ T5929] usb 5-1: SerialNumber: syz [ 991.244159][ T5922] cherry 0003:046A:0027.0027: probe with driver cherry failed with error -22 [ 991.411980][T20208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 991.422010][T20208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 991.435774][T20208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 991.446443][T20208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 991.634380][ T5922] usb 3-1: USB disconnect, device number 84 [ 992.615543][T20242] loop7: detected capacity change from 0 to 7 [ 992.630271][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.639510][ C0] buffer_io_error: 4852 callbacks suppressed [ 992.639522][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.663152][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.672712][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.681531][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.690737][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.698992][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.708286][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.759422][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.768659][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.777017][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.786342][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.794723][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.804123][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.812064][ T5951] ldm_validate_partition_table(): Disk read failed. [ 992.821778][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.831040][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.846755][T20244] bond5: option arp_all_targets: invalid value (18446744073290121217) [ 992.862748][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.871983][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.882254][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 992.891482][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.903881][ T5951] Dev loop7: unable to read RDB block 0 [ 992.906609][T20243] ================================================================== [ 992.915959][ T5951] loop7: unable to read partition table [ 992.917773][T20243] BUG: KASAN: slab-use-after-free in string+0x231/0x2b0 [ 992.917808][T20243] Read of size 1 at addr ffff88807c8d4a20 by task syz.5.3726/20243 [ 992.917824][T20243] [ 992.939111][ T5951] loop7: partition table beyond EOD, [ 992.940662][T20243] CPU: 0 UID: 0 PID: 20243 Comm: syz.5.3726 Not tainted syzkaller #0 PREEMPT(full) [ 992.940687][T20243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 992.940698][T20243] Call Trace: [ 992.940706][T20243] [ 992.940715][T20243] dump_stack_lvl+0x189/0x250 [ 992.940742][T20243] ? __kasan_check_byte+0x12/0x40 [ 992.940768][T20243] ? __pfx_dump_stack_lvl+0x10/0x10 [ 992.940788][T20243] ? lock_release+0x4b/0x3e0 [ 992.940808][T20243] ? __virt_addr_valid+0x4a5/0x5c0 [ 992.940831][T20243] print_report+0xca/0x240 [ 992.940847][T20243] ? string+0x231/0x2b0 [ 992.940869][T20243] kasan_report+0x118/0x150 [ 992.940891][T20243] ? number+0x101/0xf60 [ 992.940912][T20243] ? string+0x231/0x2b0 [ 992.940936][T20243] string+0x231/0x2b0 [ 992.940960][T20243] vsnprintf+0x739/0xf00 [ 992.940986][T20243] seq_printf+0x178/0x270 [ 992.941009][T20243] ? __pfx_seq_printf+0x10/0x10 [ 992.941030][T20243] ? kobject_get_path+0x20b/0x2d0 [ 992.941053][T20243] input_devices_seq_show+0x145/0x640 [ 992.941072][T20243] seq_read_iter+0x9b8/0xe20 [ 992.941098][T20243] seq_read+0x369/0x480 [ 992.941120][T20243] ? __pfx_seq_read+0x10/0x10 [ 992.941138][T20243] ? __pfx___mutex_trylock_common+0x10/0x10 [ 992.941173][T20243] ? __pfx_seq_read+0x10/0x10 [ 992.941191][T20243] proc_reg_read+0x1e9/0x2e0 [ 992.941213][T20243] ? __pfx_proc_reg_read+0x10/0x10 [ 992.941235][T20243] vfs_read+0x200/0xa30 [ 992.941255][T20243] ? fdget_pos+0x247/0x320 [ 992.941271][T20243] ? __pfx___mutex_lock+0x10/0x10 [ 992.941290][T20243] ? __pfx_vfs_read+0x10/0x10 [ 992.941310][T20243] ? __fget_files+0x2a/0x420 [ 992.941335][T20243] ? __fget_files+0x3a0/0x420 [ 992.941357][T20243] ? __fget_files+0x2a/0x420 [ 992.941383][T20243] ksys_read+0x145/0x250 [ 992.941404][T20243] ? __pfx_ksys_read+0x10/0x10 [ 992.941422][T20243] ? rcu_is_watching+0x15/0xb0 [ 992.941444][T20243] ? do_syscall_64+0xbe/0x3b0 [ 992.941463][T20243] do_syscall_64+0xfa/0x3b0 [ 992.941481][T20243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.941499][T20243] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 992.941515][T20243] ? clear_bhb_loop+0x60/0xb0 [ 992.941533][T20243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.941550][T20243] RIP: 0033:0x7f7d6bd8eec9 [ 992.941566][T20243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 992.941582][T20243] RSP: 002b:00007f7d69fd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 992.941601][T20243] RAX: ffffffffffffffda RBX: 00007f7d6bfe6180 RCX: 00007f7d6bd8eec9 [ 992.941614][T20243] RDX: 0000000000001906 RSI: 00002000000001c0 RDI: 0000000000000005 [ 992.941626][T20243] RBP: 00007f7d6be11f91 R08: 0000000000000000 R09: 0000000000000000 [ 992.941638][T20243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 992.941649][T20243] R13: 00007f7d6bfe6218 R14: 00007f7d6bfe6180 R15: 00007f7d6c10fa28 [ 992.941668][T20243] [ 992.941676][T20243] [ 992.958151][T20244] bond5 (unregistering): Released all slaves [ 992.965543][T20243] Allocated by task 1207: [ 992.965572][T20243] kasan_save_track+0x3e/0x80 [ 992.965596][T20243] __kasan_kmalloc+0x93/0xb0 [ 992.965616][T20243] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 992.965634][T20243] xpad_probe+0x428/0x1fc0 [ 992.965649][T20243] usb_probe_interface+0x665/0xc30 [ 992.965666][T20243] really_probe+0x26d/0x9e0 [ 992.965679][T20243] __driver_probe_device+0x18c/0x2f0 [ 992.965691][T20243] driver_probe_device+0x4f/0x430 [ 992.965704][T20243] __device_attach_driver+0x2ce/0x530 [ 992.965719][T20243] bus_for_each_drv+0x24e/0x2e0 [ 992.965737][T20243] __device_attach+0x2b8/0x400 [ 992.965751][T20243] bus_probe_device+0x185/0x260 [ 992.965767][T20243] device_add+0x7b6/0xb50 [ 992.965783][T20243] usb_set_configuration+0x1a87/0x20e0 [ 992.965799][T20243] usb_generic_driver_probe+0x8d/0x150 [ 992.965814][T20243] usb_probe_device+0x1c4/0x390 [ 992.965831][T20243] really_probe+0x26d/0x9e0 [ 992.965844][T20243] __driver_probe_device+0x18c/0x2f0 [ 992.965856][T20243] driver_probe_device+0x4f/0x430 [ 992.965870][T20243] __device_attach_driver+0x2ce/0x530 [ 993.344381][T20243] bus_for_each_drv+0x24e/0x2e0 [ 993.349247][T20243] __device_attach+0x2b8/0x400 [ 993.354135][T20243] bus_probe_device+0x185/0x260 [ 993.358994][T20243] device_add+0x7b6/0xb50 [ 993.363418][T20243] usb_new_device+0xa39/0x16f0 [ 993.368183][T20243] hub_event+0x2958/0x4a20 [ 993.372653][T20243] process_scheduled_works+0xade/0x17b0 [ 993.378386][T20243] worker_thread+0x8a0/0xda0 [ 993.383071][T20243] kthread+0x70e/0x8a0 [ 993.387346][T20243] ret_from_fork+0x436/0x7d0 [ 993.391951][T20243] ret_from_fork_asm+0x1a/0x30 [ 993.396747][T20243] [ 993.399070][T20243] Freed by task 5908: [ 993.403037][T20243] kasan_save_track+0x3e/0x80 [ 993.407706][T20243] __kasan_save_free_info+0x46/0x50 [ 993.413040][T20243] __kasan_slab_free+0x5c/0x80 [ 993.417823][T20243] kfree+0x19a/0x6d0 [ 993.422415][T20243] xpad_disconnect+0x350/0x480 [ 993.427178][T20243] usb_unbind_interface+0x26e/0x910 [ 993.432362][T20243] device_release_driver_internal+0x4d9/0x800 [ 993.438426][T20243] bus_remove_device+0x34d/0x410 [ 993.443360][T20243] device_del+0x511/0x8e0 [ 993.447726][T20243] usb_disable_device+0x3e9/0x8a0 [ 993.452773][T20243] usb_disconnect+0x330/0x950 [ 993.457451][T20243] hub_event+0x1cf5/0x4a20 [ 993.461856][T20243] process_scheduled_works+0xade/0x17b0 [ 993.467404][T20243] worker_thread+0x8a0/0xda0 [ 993.471997][T20243] kthread+0x70e/0x8a0 [ 993.476319][T20243] ret_from_fork+0x436/0x7d0 [ 993.481073][T20243] ret_from_fork_asm+0x1a/0x30 [ 993.485854][T20243] [ 993.488174][T20243] Last potentially related work creation: [ 993.493871][T20243] kasan_save_stack+0x3e/0x60 [ 993.498540][T20243] kasan_record_aux_stack+0xbd/0xd0 [ 993.503722][T20243] insert_work+0x3d/0x330 [ 993.508064][T20243] __queue_work+0xcd2/0xfb0 [ 993.512749][T20243] queue_work_on+0x181/0x270 [ 993.517337][T20243] xpad_irq_in+0xb57/0x2590 [ 993.522008][T20243] __usb_hcd_giveback_urb+0x376/0x540 [ 993.527469][T20243] dummy_timer+0x862/0x4550 [ 993.531974][T20243] __hrtimer_run_queues+0x529/0xc60 [ 993.537204][T20243] hrtimer_run_softirq+0x187/0x2b0 [ 993.542312][T20243] handle_softirqs+0x283/0x870 [ 993.547113][T20243] do_softirq+0xec/0x180 [ 993.551373][T20243] __local_bh_enable_ip+0x17d/0x1c0 [ 993.556648][T20243] wg_socket_send_skb_to_peer+0x16b/0x1d0 [ 993.562460][T20243] wg_packet_tx_worker+0x1c8/0x7c0 [ 993.567558][T20243] process_scheduled_works+0xade/0x17b0 [ 993.573759][T20243] worker_thread+0x8a0/0xda0 [ 993.578347][T20243] kthread+0x70e/0x8a0 [ 993.582405][T20243] ret_from_fork+0x436/0x7d0 [ 993.586975][T20243] ret_from_fork_asm+0x1a/0x30 [ 993.591725][T20243] [ 993.594038][T20243] Second to last potentially related work creation: [ 993.600621][T20243] kasan_save_stack+0x3e/0x60 [ 993.605296][T20243] kasan_record_aux_stack+0xbd/0xd0 [ 993.610513][T20243] insert_work+0x3d/0x330 [ 993.614844][T20243] __queue_work+0xcd2/0xfb0 [ 993.619616][T20243] queue_work_on+0x181/0x270 [ 993.624248][T20243] xpad_irq_in+0xb57/0x2590 [ 993.628742][T20243] __usb_hcd_giveback_urb+0x376/0x540 [ 993.634286][T20243] dummy_timer+0x862/0x4550 [ 993.638810][T20243] __hrtimer_run_queues+0x529/0xc60 [ 993.643996][T20243] hrtimer_run_softirq+0x187/0x2b0 [ 993.649095][T20243] handle_softirqs+0x283/0x870 [ 993.653871][T20243] __irq_exit_rcu+0xca/0x1f0 [ 993.658530][T20243] irq_exit_rcu+0x9/0x30 [ 993.662866][T20243] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 993.668502][T20243] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 993.674663][T20243] [ 993.676979][T20243] The buggy address belongs to the object at ffff88807c8d4800 [ 993.676979][T20243] which belongs to the cache kmalloc-1k of size 1024 [ 993.691016][T20243] The buggy address is located 544 bytes inside of [ 993.691016][T20243] freed 1024-byte region [ffff88807c8d4800, ffff88807c8d4c00) [ 993.704975][T20243] [ 993.707286][T20243] The buggy address belongs to the physical page: [ 993.713741][T20243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807c8d4800 pfn:0x7c8d0 [ 993.723793][T20243] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 993.732287][T20243] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 993.740909][T20243] page_type: f5(slab) [ 993.744886][T20243] raw: 00fff00000000240 ffff88813fe26dc0 ffffea0001625410 ffffea0001bf4c10 [ 993.753464][T20243] raw: ffff88807c8d4800 000000000010000c 00000000f5000000 0000000000000000 [ 993.762154][T20243] head: 00fff00000000240 ffff88813fe26dc0 ffffea0001625410 ffffea0001bf4c10 [ 993.770816][T20243] head: ffff88807c8d4800 000000000010000c 00000000f5000000 0000000000000000 [ 993.779474][T20243] head: 00fff00000000003 ffffea0001f23401 00000000ffffffff 00000000ffffffff [ 993.788139][T20243] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 993.796917][T20243] page dumped because: kasan: bad access detected [ 993.803620][T20243] page_owner tracks the page as allocated [ 993.809337][T20243] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5857, tgid 5857 (syz-executor), ts 82559481002, free_ts 49293548386 [ 993.831392][T20243] post_alloc_hook+0x240/0x2a0 [ 993.836259][T20243] get_page_from_freelist+0x2365/0x2440 [ 993.841989][T20243] __alloc_frozen_pages_noprof+0x181/0x370 [ 993.847816][T20243] alloc_pages_mpol+0x232/0x4a0 [ 993.852693][T20243] allocate_slab+0x96/0x3a0 [ 993.857246][T20243] ___slab_alloc+0xe94/0x1920 [ 993.862107][T20243] __slab_alloc+0x65/0x100 [ 993.866537][T20243] __kvmalloc_node_noprof+0x6ba/0x910 [ 993.871912][T20243] rhashtable_init_noprof+0x4f3/0xbc0 [ 993.877290][T20243] nsim_fib_create+0x316/0x9d0 [ 993.882075][T20243] nsim_drv_probe+0x778/0xba0 [ 993.886775][T20243] really_probe+0x26d/0x9e0 [ 993.891273][T20243] __driver_probe_device+0x18c/0x2f0 [ 993.896600][T20243] driver_probe_device+0x4f/0x430 [ 993.901801][T20243] __device_attach_driver+0x2ce/0x530 [ 993.907166][T20243] bus_for_each_drv+0x24e/0x2e0 [ 993.912114][T20243] page last free pid 5582 tgid 5582 stack trace: [ 993.918554][T20243] __free_frozen_pages+0xbc4/0xd30 [ 993.923686][T20243] __put_partials+0x146/0x170 [ 993.928570][T20243] put_cpu_partial+0x1f2/0x2e0 [ 993.933437][T20243] __slab_free+0x2b9/0x390 [ 993.937858][T20243] qlist_free_all+0x97/0x140 [ 993.942451][T20243] kasan_quarantine_reduce+0x148/0x160 [ 993.947925][T20243] __kasan_slab_alloc+0x22/0x80 [ 993.952784][T20243] __kmalloc_cache_noprof+0x36f/0x6f0 [ 993.958350][T20243] tomoyo_init_log+0x183/0x1f70 [ 993.963209][T20243] tomoyo_supervisor+0x340/0x1480 [ 993.968675][T20243] tomoyo_path_permission+0x25a/0x380 [ 993.974069][T20243] tomoyo_check_open_permission+0x24d/0x3b0 [ 993.980057][T20243] security_file_open+0xb1/0x270 [ 993.984999][T20243] do_dentry_open+0x384/0x13f0 [ 993.989774][T20243] vfs_open+0x3b/0x340 [ 993.993928][T20243] path_openat+0x2ee5/0x3830 [ 993.998514][T20243] [ 994.000828][T20243] Memory state around the buggy address: [ 994.006445][T20243] ffff88807c8d4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 994.014502][T20243] ffff88807c8d4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 994.022545][T20243] >ffff88807c8d4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 994.030586][T20243] ^ [ 994.035697][T20243] ffff88807c8d4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 994.043749][T20243] ffff88807c8d4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 994.051973][T20243] ================================================================== [ 994.064807][ T5951] truncated [ 994.081460][ T5915] usb 2-1: USB disconnect, device number 36 [ 994.082618][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 994.093935][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.141469][T20242] ldm_validate_partition_table(): Disk read failed. [ 994.148829][T20242] Dev loop7: unable to read RDB block 0 [ 994.181605][T20243] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 994.188853][T20243] CPU: 1 UID: 0 PID: 20243 Comm: syz.5.3726 Not tainted syzkaller #0 PREEMPT(full) [ 994.198234][T20243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 994.208303][T20243] Call Trace: [ 994.211624][T20243] [ 994.214562][T20243] dump_stack_lvl+0x99/0x250 [ 994.219168][T20243] ? __asan_memcpy+0x40/0x70 [ 994.223781][T20243] ? __pfx_dump_stack_lvl+0x10/0x10 [ 994.228998][T20243] ? __pfx__printk+0x10/0x10 [ 994.233620][T20243] vpanic+0x237/0x6d0 [ 994.237975][T20243] ? __pfx_vpanic+0x10/0x10 [ 994.242491][T20243] ? preempt_schedule+0xae/0xc0 [ 994.247352][T20243] ? __pfx_preempt_schedule+0x10/0x10 [ 994.252744][T20243] panic+0xb9/0xc0 [ 994.256503][T20243] ? __pfx_panic+0x10/0x10 [ 994.261370][T20243] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 994.267373][T20243] ? string+0x231/0x2b0 [ 994.271544][T20243] check_panic_on_warn+0x89/0xb0 [ 994.276487][T20243] ? string+0x231/0x2b0 [ 994.280644][T20243] end_report+0x78/0x160 [ 994.284880][T20243] kasan_report+0x129/0x150 [ 994.289373][T20243] ? number+0x101/0xf60 [ 994.293519][T20243] ? string+0x231/0x2b0 [ 994.297687][T20243] string+0x231/0x2b0 [ 994.301687][T20243] vsnprintf+0x739/0xf00 [ 994.306096][T20243] seq_printf+0x178/0x270 [ 994.310440][T20243] ? __pfx_seq_printf+0x10/0x10 [ 994.315297][T20243] ? kobject_get_path+0x20b/0x2d0 [ 994.320406][T20243] input_devices_seq_show+0x145/0x640 [ 994.325916][T20243] seq_read_iter+0x9b8/0xe20 [ 994.330495][T20243] seq_read+0x369/0x480 [ 994.334733][T20243] ? __pfx_seq_read+0x10/0x10 [ 994.339484][T20243] ? __pfx___mutex_trylock_common+0x10/0x10 [ 994.345406][T20243] ? __pfx_seq_read+0x10/0x10 [ 994.350079][T20243] proc_reg_read+0x1e9/0x2e0 [ 994.354736][T20243] ? __pfx_proc_reg_read+0x10/0x10 [ 994.359870][T20243] vfs_read+0x200/0xa30 [ 994.364031][T20243] ? fdget_pos+0x247/0x320 [ 994.368473][T20243] ? __pfx___mutex_lock+0x10/0x10 [ 994.373717][T20243] ? __pfx_vfs_read+0x10/0x10 [ 994.378499][T20243] ? __fget_files+0x2a/0x420 [ 994.383640][T20243] ? __fget_files+0x3a0/0x420 [ 994.388342][T20243] ? __fget_files+0x2a/0x420 [ 994.392965][T20243] ksys_read+0x145/0x250 [ 994.397238][T20243] ? __pfx_ksys_read+0x10/0x10 [ 994.401993][T20243] ? rcu_is_watching+0x15/0xb0 [ 994.406746][T20243] ? do_syscall_64+0xbe/0x3b0 [ 994.411412][T20243] do_syscall_64+0xfa/0x3b0 [ 994.415904][T20243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.421962][T20243] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 994.428103][T20243] ? clear_bhb_loop+0x60/0xb0 [ 994.432775][T20243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.438657][T20243] RIP: 0033:0x7f7d6bd8eec9 [ 994.443070][T20243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 994.462746][T20243] RSP: 002b:00007f7d69fd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 994.471150][T20243] RAX: ffffffffffffffda RBX: 00007f7d6bfe6180 RCX: 00007f7d6bd8eec9 [ 994.479109][T20243] RDX: 0000000000001906 RSI: 00002000000001c0 RDI: 0000000000000005 [ 994.487104][T20243] RBP: 00007f7d6be11f91 R08: 0000000000000000 R09: 0000000000000000 [ 994.495084][T20243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 994.503053][T20243] R13: 00007f7d6bfe6218 R14: 00007f7d6bfe6180 R15: 00007f7d6c10fa28 [ 994.511206][T20243] [ 994.514547][T20243] Kernel Offset: disabled [ 994.518858][T20243] Rebooting in 86400 seconds..