last executing test programs: 4m37.774456356s ago: executing program 1 (id=1234): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="b40000001300000100000000fbdbdf25ac1e0001000000000000000000000000fe8000000000000000000000000000aa4e2100044e2200000a0060a03b000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="fcffffffffffff7f02000000000000000f008000000000000000000000000200ffffff7f2fc90000fdfdffffffffffff5000000000000000030000000000000005f0ffffffffffffff0000000000000004000000000000000300000000000000060000000000004001010100"], 0xb4}, 0x1, 0x0, 0x0, 0x4000080}, 0x4048881) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x33c13, 0x2009}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x4}}}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x24e4}, @IFLA_GROUP={0x8, 0x1b, 0x87}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 4m37.647427935s ago: executing program 1 (id=1236): socket$nl_netfilter(0x10, 0x3, 0xc) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000b00)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec35420c00010004080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afdeb2713f450ebd010a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0x7}, 0x0) 4m37.569294238s ago: executing program 1 (id=1237): ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, &(0x7f0000000080)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0)=0x5, 0x4) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010102, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 4m37.503708837s ago: executing program 1 (id=1238): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x4c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='4', 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x62) r3 = openat$autofs(0xffffff9c, &(0x7f0000000040), 0x20000, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) statx(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x10, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r3, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {r5, r6}}, './file0\x00'}) r7 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) getsockname$packet(r9, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) pipe2$watch_queue(&(0x7f0000000000), 0x80) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r11 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r12 = openat$zero(0xffffff9c, &(0x7f00000002c0), 0x202280, 0x0) file_setattr(r12, &(0x7f0000000300)='./cgroup.cpu/memory.limit_in_bytes\x00', &(0x7f0000000340)={0x100, 0x141, 0x6, 0xfffffffe, 0xfffffc01}, 0x18, 0x1000) read(r11, &(0x7f0000000000), 0x202f) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000006d000100"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000180034801400350069"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r13 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e7cc6120c4108a81ad7d0102030109021b00010000c005090423000103"], 0x0) syz_usb_control_io$cdc_ncm(r13, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)=ANY=[@ANYBLOB="001503006c9ee5dedc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m34.897405556s ago: executing program 1 (id=1248): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = syz_clone(0x2000400, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x8, 0x0) openat$drirender128(0xffffff9c, 0x0, 0x1a3841, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @empty, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$sock_attach_bpf(r2, 0x1, 0xd, 0x0, 0x0) close(r2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) lsm_list_modules(&(0x7f0000002600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000000)=0x38, 0x0) (fail_nth: 4) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r4 = getpid() process_vm_readv(r4, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000540)) syz_open_dev$sg(0x0, 0x6f5e, 0x20403) socket$l2tp(0x2, 0x2, 0x73) getpeername$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000002c0)=0x63) 4m34.231833818s ago: executing program 1 (id=1252): r0 = socket$inet(0x2, 0x801, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000001400)={0x0, 0x3, 0x800, 0x1, 0x40055}, 0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(0x0, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) 4m33.836173279s ago: executing program 32 (id=1252): r0 = socket$inet(0x2, 0x801, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000001400)={0x0, 0x3, 0x800, 0x1, 0x40055}, 0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(0x0, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) 2m45.173161108s ago: executing program 5 (id=1768): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$vcsu(0xffffff9c, &(0x7f0000000040), 0x896f56857dd78a1d, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d424000000000000002900000002000000", 0xfe60) 2m44.936766537s ago: executing program 5 (id=1769): syz_open_dev$sndctrl(&(0x7f0000000000), 0x7, 0x20602) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) lsm_set_self_attr(0x69, &(0x7f0000000e40)=ANY=[@ANYBLOB], 0x20, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), 0xffffffffffffffff) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000f40)=ANY=[@ANYBLOB='(', @ANYRES16=r2, @ANYRES32=0x0, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x8801) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000040), 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x13) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', 0x20}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r5, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'bridge0\x00', 0x1}, 0x18) r6 = syz_open_dev$vim2m(0x0, 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000100)={0xf0f017, 0x3}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8e0400000000000000c61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b36db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece010000000100000010223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff814f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffff854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e92604e1026e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c36981edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ce852364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b00000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58f0225f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e20280e14700eb4acff907560500ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ad72a89a7f6d74126f327bf7dfa718d3e1e9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d7462c080c159ce40c14089c82759106f425a2554644b2582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202c2bbae137dc1c3cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e1000000b81b6790062e61cd000000acb1b33c38ddd302e28e8e30b5c180d38bb1cd770195799c541a7481f5d34ca75d74b3833d399371c8f09f6745d0e43d46f7c82ff1b7d6c04467d083fc708348f35ae9bb9b78f2984a0ee55647d4c4a63c4f438fdec726e7d8228eaff2374b2300b9c35f4259e3452b53ee114bb8a6c0ea6fc89a55fef6673013d7dd4597660865423e978dd6e41e201bb3a584d6fe6f24e290613b677271603c558ee2021be29c4a06a057b2acc5bfd34898afac0d839079bbcb3acd43532563367ac8ae6c4379fb5fdcdab5fe55e1a3a521284209871216817338073cbc4ec9903725b788a25b5a6003b579b8f0e20d78be3d885557292971e65f4f1daefad2c5ccbca608b46406ffff25610c3cbae9c3d6d47678f482e2c1f7cdfc5ce2a67c1545c1192f2ac3990f9c850788401469fbca801e73cd9efbcc6ea52ff414cdff5c49e706d699b5bfa75526f700c4e32611b826b2787f99532c02262a9c60e4b07a09377c38747c7f05e38b6db5d8cc625873af8fc5a7d362334c509f6bb4e36e1c9e08949679e0ed9f84e668588b9f1b21069bd5ffe263b191d1a7f5d4e85de1"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xfa, 0x0, &(0x7f0000000100)="b90000000044268cb89e14f086dd65e0ffff01032c00631177fbac141416e000030a44079f030000000000000000000000222f050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa007346111960500000000000000000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x0, &(0x7f0000000ac0), &(0x7f0000000a00), 0x0, 0x700}, 0x4c) 2m44.061439901s ago: executing program 5 (id=1770): r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122350007058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022350000000600"], 0x0}, 0x0) 2m42.224980006s ago: executing program 5 (id=1776): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000b00)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec35420c00010004080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afdeb2713f450ebd010a20ff2", 0x87}], 0x1, 0x0, 0x0, 0x7}, 0x0) 2m41.869061597s ago: executing program 5 (id=1777): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x80482, 0x0) writev(r0, &(0x7f0000000500)=[{0x0, 0x300}, {&(0x7f00000005c0)="d4c4403459", 0x5}], 0x2) 2m41.661871031s ago: executing program 5 (id=1778): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) openat$ppp(0xffffff9c, &(0x7f0000000000), 0x4c800, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000010000)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x402) r2 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x42) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000005840)={0x20, 0x3, 0x2cff, 0xfffe, 0x0, 0x3e8, 0x0}) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000001a40)={&(0x7f0000000180)=[{0x3, 0x200, 0x0, 0x0}], 0x1}) syz_usb_control_io$lan78xx(r0, &(0x7f0000000480)={0xc, &(0x7f0000000240)={0x20, 0x10, 0x9d, {0x9d, 0x21, "20cc88aa3f62dc163d0bbc058747a19913b61630407df56c88e10da9479a3697cf32a473fbb6ed7e41fe008933a140f66b556dc8278fc2905df6e6611a491c4d924465e9c8591f4902c91f7db68136cd40811f08311ca770d4017ee072c623ce1e068bf8a16545c35ccd96e5c338aec821a7f2668bf845ea2234c05e1e731c64e83acd02f5f5469e44d19ccef2a6810dd45d7afb832f845b3abe37"}}, 0x0}, &(0x7f0000000700)={0x1c, &(0x7f00000004c0)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) (async) openat$ppp(0xffffff9c, &(0x7f0000000000), 0x4c800, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000010000)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) (async) syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x402) (async) syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x42) (async) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000005840)={0x20, 0x3, 0x2cff, 0xfffe, 0x0, 0x3e8, 0x0}) (async) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000001a40)={&(0x7f0000000180)=[{0x3, 0x200, 0x0, 0x0}], 0x1}) (async) syz_usb_control_io$lan78xx(r0, &(0x7f0000000480)={0xc, &(0x7f0000000240)={0x20, 0x10, 0x9d, {0x9d, 0x21, "20cc88aa3f62dc163d0bbc058747a19913b61630407df56c88e10da9479a3697cf32a473fbb6ed7e41fe008933a140f66b556dc8278fc2905df6e6611a491c4d924465e9c8591f4902c91f7db68136cd40811f08311ca770d4017ee072c623ce1e068bf8a16545c35ccd96e5c338aec821a7f2668bf845ea2234c05e1e731c64e83acd02f5f5469e44d19ccef2a6810dd45d7afb832f845b3abe37"}}, 0x0}, &(0x7f0000000700)={0x1c, &(0x7f00000004c0)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 2m26.48563257s ago: executing program 33 (id=1778): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) openat$ppp(0xffffff9c, &(0x7f0000000000), 0x4c800, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000010000)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x402) r2 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x42) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000005840)={0x20, 0x3, 0x2cff, 0xfffe, 0x0, 0x3e8, 0x0}) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000001a40)={&(0x7f0000000180)=[{0x3, 0x200, 0x0, 0x0}], 0x1}) syz_usb_control_io$lan78xx(r0, &(0x7f0000000480)={0xc, &(0x7f0000000240)={0x20, 0x10, 0x9d, {0x9d, 0x21, "20cc88aa3f62dc163d0bbc058747a19913b61630407df56c88e10da9479a3697cf32a473fbb6ed7e41fe008933a140f66b556dc8278fc2905df6e6611a491c4d924465e9c8591f4902c91f7db68136cd40811f08311ca770d4017ee072c623ce1e068bf8a16545c35ccd96e5c338aec821a7f2668bf845ea2234c05e1e731c64e83acd02f5f5469e44d19ccef2a6810dd45d7afb832f845b3abe37"}}, 0x0}, &(0x7f0000000700)={0x1c, &(0x7f00000004c0)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) (async) openat$ppp(0xffffff9c, &(0x7f0000000000), 0x4c800, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000010000)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) (async) syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x402) (async) syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x42) (async) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000005840)={0x20, 0x3, 0x2cff, 0xfffe, 0x0, 0x3e8, 0x0}) (async) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000001a40)={&(0x7f0000000180)=[{0x3, 0x200, 0x0, 0x0}], 0x1}) (async) syz_usb_control_io$lan78xx(r0, &(0x7f0000000480)={0xc, &(0x7f0000000240)={0x20, 0x10, 0x9d, {0x9d, 0x21, "20cc88aa3f62dc163d0bbc058747a19913b61630407df56c88e10da9479a3697cf32a473fbb6ed7e41fe008933a140f66b556dc8278fc2905df6e6611a491c4d924465e9c8591f4902c91f7db68136cd40811f08311ca770d4017ee072c623ce1e068bf8a16545c35ccd96e5c338aec821a7f2668bf845ea2234c05e1e731c64e83acd02f5f5469e44d19ccef2a6810dd45d7afb832f845b3abe37"}}, 0x0}, &(0x7f0000000700)={0x1c, &(0x7f00000004c0)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 21.174639876s ago: executing program 4 (id=2418): socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x282, 0x0) lseek(r0, 0xfffffffffffffffe, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x7, 0x9}) fcntl$lock(r1, 0x7, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYRES32=r5, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x40014) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 19.146594245s ago: executing program 4 (id=2421): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000001c0)) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x2, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd70100400000008000000080009000200000008000c00a80a000008000b"], 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r6 = syz_open_dev$sg(&(0x7f0000000480), 0xa, 0x2100) ioctl$FIBMAP(r6, 0x5385, 0xffffffffffffffff) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x30000001}, 0x4080) syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x20d6, 0xcb17, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xa, 0x0, 0x6c, "", [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x1, 0x2, 0x4, {0x9, 0x21, 0x6, 0x9, 0x1, {0x22, 0xf93}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x4, 0xeb}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x6, 0xa8, 0x9}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x5, 0x7, 0x3, 0x20, 0x9}, 0x1a, &(0x7f0000000680)=ANY=[], 0x2, [{0xb5, &(0x7f00000004c0)=ANY=[@ANYBLOB]}, {0x38, &(0x7f0000000280)=@string={0x38, 0x3, "d8ee264b391e0bb569895c5521c6c0cf69aa46eb1728a568db9048324fca4cb2c181f49f16891356aaa09969ee1c40a8d52500da6cde"}}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x4, 0x7, 0x2}) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x12, 0x0, 0x0) syz_clone(0x86000, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140)="54b0a77367b202005877d24080de27e59dca6f715bb98393a987ee81344be01229bae336d1d43a4ab717113bdde4594f41cd6f22e5", 0x35, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) r7 = fsopen(&(0x7f00000029c0)='vfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) recvfrom$inet(r0, 0x0, 0xfffffd4e, 0x41, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r8, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x20, 0x1, 0x3, 0x301, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xffffffffffffffff, 0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x94) recvfrom$inet(r0, 0x0, 0x0, 0x61, 0x0, 0x0) 17.93302267s ago: executing program 4 (id=2428): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4790, 0x10000, 0x8, 0x6, 0x4, 0x8, 0x401, 0x4, 0x3}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0xf}, {0xffff, 0xb}, {0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x54811}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 17.864930891s ago: executing program 4 (id=2430): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = syz_open_dev$swradio(&(0x7f0000000300), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f0000000340)={0x0, 0x5, 0x3}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x7, 0x9, 0x9, 0x0, 0xffffffffffffffff, 0x9}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r2, 0xd}, 0x61) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r3}, 0x0, 0x0}, 0x1c) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x101141, 0x0) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000380)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x28bd, 0x74, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x10, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000040)={0x14, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @global=@item_012={0x1, 0x1, 0x1, "15"}, @global=@item_012={0x2, 0x1, 0x2, '\x00\x00'}, @local=@item_012={0x1, 0x2, 0x0, "04"}, @local=@item_012={0x1, 0x2, 0x4, "d1"}, @local=@item_4={0x3, 0x2, 0x0, "4489d619"}, @local=@item_012={0x0, 0x2, 0x4}, @global=@item_4={0x3, 0x1, 0x6, "5b112a1a"}]}}, 0x0}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x100) unshare(0x6020400) fcntl$lock(r6, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r6, 0x6, &(0x7f0000000200)={0x1, 0x1, 0x10001, 0x6}) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r7, &(0x7f0000001b40)=[{&(0x7f0000001b80)=""/4106, 0x100a}, {&(0x7f0000000180)=""/20, 0x14}, {&(0x7f0000001980)=""/41, 0x29}, {&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000001a40)=""/216, 0xd8}], 0x5, 0x2, 0xee8) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0xa, 0x0, 0x9, 0x50, 0x8, 0x2fa11, 0x401}, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) r8 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r8, &(0x7f00000005c0)=""/199, 0xc7) socket$xdp(0x2c, 0x3, 0x0) 17.192856241s ago: executing program 4 (id=2432): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000001380)=@urb_type_iso={0x0, {0xa}, 0x0, 0x20, 0x0, 0x0, 0x0, 0x8, 0x1, 0xd508, 0x0, &(0x7f0000000380)="266bdb023cbc30dfbb6802eeb9083f3417666e03199cc56b8c07c6643ead519de407d30ae5f35be1f853f3919fdd446fff6888ce59b73c5f52ec3d17b75131c7662acc89ebc3cb40bb0578143ed1aea15d8a517ca2e04bcee2412d702b94b382ad08cf5b77a7dec7bf1d18cb6bd75de9c11385fc330e53e819570938454e8a49c3733d60401992bb5942a7a15b5f605cfc1f4000b1fb9a4b681232a78f0011635880dc7cd0694bfb5391099d3e1b86d81eef4d3841d65ee80baeecc36ddf587b05a36ccebda0113a3ff204331e1ea636445625992dd97d10f077e003d82ebac3bdc14a2781fb53ddc53b7b4931c8d768a95b37b68d299f2d0c2a4a6f96c61b95e3eff2fd9cc69abd78747a367ec8f1cd1674588233c49ee02aad2c2775fabffb0b8ae078bf653204c49871ddb5ec98715a3faab613672e7e9e123ee7e6f779892e767695fe72250a5d3741f15485a9d04d65b371037c9180502d17f74848e7aa8bfea78fb68090d0dc90c76d48ff8e8f0bf1dda602acf942c27ef2068a9051c3b1dff94d060de0be18042f189ab7e0ac357727e37bc88eda385198a81afdf95d993850989c73357750b03dc53aa87293cc81bb79ba3fdfc7a5bd65a25830f0fbbf7ea95e7424edc07d218d87d23260041d4107d012eaf4e7bfb5c058c7520a66d7133bfcefb1bc42319ce782d171ac3803e537d2b712", [{0x1, 0x8}]}) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100)) 16.221588993s ago: executing program 4 (id=2436): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x1, @time={0x9f9f, 0x100}, 0x4, {0x9, 0x5}, 0x6, 0x1, 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r3, @ANYBLOB="26b75dd750073fdc031f4d2667574bf559288155609bba48ca6f758cc6b5f44c4cd51a020000000000000000000000400000"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1, 0x3}) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r4, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) close(0x3) 12.809612316s ago: executing program 3 (id=2451): socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x282, 0x0) lseek(r0, 0xfffffffffffffffe, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r3, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x7, 0x9}) fcntl$lock(r1, 0x7, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYRES32=r6, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x40014) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 10.709751297s ago: executing program 3 (id=2457): socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x282, 0x0) lseek(r0, 0xfffffffffffffffe, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r3, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r3, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x7, 0x9}) fcntl$lock(r1, 0x7, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 9.673272678s ago: executing program 6 (id=2459): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f0000000040)={0x8000000000000001, 0x3, 0xffff, 0xb, 0x7, 0x4, 0xe}) syz_usb_connect$midi(0x2, 0x31, &(0x7f0000000800)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x763, 0x150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1f, 0x1, 0x1, 0x8, 0x40, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x7, [], [{{0x9, 0x5, 0x9, 0x0, 0x8, 0x8, 0x0, 0x57, {0x4}}}]}}}}}]}}, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0}) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x81) 8.656108759s ago: executing program 0 (id=2464): socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x74) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) accept4$inet6(r1, 0x0, 0x0, 0x80800) (fail_nth: 4) 8.348339082s ago: executing program 0 (id=2465): socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x282, 0x0) lseek(r0, 0xfffffffffffffffe, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r3, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x7, 0x9}) fcntl$lock(r1, 0x7, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 8.281729917s ago: executing program 2 (id=2466): openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000023c0)=@delchain={0x630, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x604, 0x2, [@TCA_BPF_ACT={0x600, 0x1, [@m_bpf={0x12c, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0xcd, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d91028270a2722b141a9140c47e37d068e7193d463a6444e424bc792ab1295f79842a501700a5cc2f71eefaf131a98821e712b0"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_bpf={0x60, 0x8, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_OPS={0x24, 0x4, [{0x0, 0x0, 0x9, 0xff}, {0xb, 0xf6, 0x5, 0xfffffffc}, {0x401, 0xb0, 0x32}, {0x6092, 0x70, 0x6, 0x1ff}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_police={0x444, 0x9, 0x0, 0x0, {{0xb}, {0x408, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xe73, 0x9, 0x7, 0x3, 0x1ff, 0x7, 0x8, 0x80, 0x3, 0x1, 0x10000000, 0x401, 0x3, 0x2, 0x4, 0x6, 0x1000, 0x3, 0x5, 0x5, 0xfffffff9, 0xff, 0xc, 0x7fff, 0x5, 0x5c7000, 0x9, 0x7fffffff, 0x5, 0x6, 0x0, 0x80, 0x1f, 0x7ff, 0xfffffc84, 0x10, 0xfffffff7, 0x3, 0x8, 0x6, 0x5, 0xb, 0x8, 0xfffffffd, 0x4c, 0xe, 0xf, 0x9, 0x9, 0x3, 0xfffffff9, 0xfffffffa, 0x1, 0x2, 0x9, 0x8, 0xc6e7, 0xa000, 0x2, 0x8000, 0x17, 0x6, 0x2e52, 0x9, 0x7, 0x6, 0x414, 0x10001, 0x0, 0x5, 0xffffffff, 0xc, 0x1000, 0x4, 0x800, 0x10, 0x39, 0x5, 0x2, 0x5c3, 0x800, 0x2, 0x5, 0x6e6, 0x3, 0x7, 0x6, 0xc, 0x3, 0x14e, 0x8, 0x5, 0xad8, 0x289f, 0x3, 0x97e, 0x3, 0x80, 0x6, 0xb, 0x8, 0xe6, 0x720, 0x2, 0xa98f, 0x1, 0xffffffff, 0x0, 0x3, 0x74, 0xdd7c, 0x2, 0x0, 0xffffff7c, 0x6, 0x7f, 0x1, 0x6, 0x4, 0x7, 0x3, 0x7, 0xb, 0xfff, 0xfffffffd, 0x3, 0xc60, 0x7, 0x4, 0xf8ca, 0xb, 0x6, 0x3ff, 0x7fffffff, 0x8001, 0xd, 0x0, 0x4, 0x4, 0x0, 0x421, 0x8, 0x9, 0x2, 0x1, 0x0, 0x9, 0xffff, 0x7ff, 0x8, 0x9, 0x2, 0xb, 0xa00, 0x2, 0xfec, 0x5, 0x5, 0x5, 0x9, 0x2, 0x400, 0x3, 0x3, 0x3, 0x8, 0xe59, 0x1000, 0x101, 0x5, 0x8001, 0x9, 0x4, 0x0, 0x6155, 0xe040, 0x80000001, 0x40, 0x7f, 0x9, 0x5e59, 0x81, 0x0, 0x9, 0x0, 0x3, 0x1, 0xb571, 0xe, 0x7, 0xa, 0x80000000, 0x2797, 0x4, 0x2, 0x2, 0x2, 0x3, 0x81, 0xffffffff, 0x6f, 0xfffffffd, 0x5, 0xb, 0x1, 0x3, 0x3, 0x1, 0x2, 0x4, 0x8001, 0x7, 0x7, 0x1, 0x32d, 0x9, 0x6, 0x2, 0x6, 0x2, 0x4, 0x1, 0x4, 0x0, 0x1000, 0x80000001, 0xffffffff, 0x4, 0x7, 0x8, 0x8, 0x697, 0xe339, 0x9, 0x1, 0x6, 0xffffffff, 0x9, 0x9, 0x35, 0x7, 0x5, 0xfffffffb, 0xfffffff9, 0x965, 0x7145, 0x90b6, 0x6, 0x6, 0x2, 0x8, 0x1, 0x1, 0xd5, 0x7ff, 0x200]}]]}, {0x11, 0x6, "94cedea66d85e9b70c476ee3b0"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_xt={0x2c, 0x13, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x630}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 8.095899677s ago: executing program 6 (id=2467): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000001380)=@urb_type_iso={0x0, {0xa}, 0x0, 0x20, 0x0, 0x0, 0x0, 0x8, 0x1, 0xd508, 0x0, &(0x7f0000000380)="266bdb023cbc30dfbb6802eeb9083f3417666e03199cc56b8c07c6643ead519de407d30ae5f35be1f853f3919fdd446fff6888ce59b73c5f52ec3d17b75131c7662acc89ebc3cb40bb0578143ed1aea15d8a517ca2e04bcee2412d702b94b382ad08cf5b77a7dec7bf1d18cb6bd75de9c11385fc330e53e819570938454e8a49c3733d60401992bb5942a7a15b5f605cfc1f4000b1fb9a4b681232a78f0011635880dc7cd0694bfb5391099d3e1b86d81eef4d3841d65ee80baeecc36ddf587b05a36ccebda0113a3ff204331e1ea636445625992dd97d10f077e003d82ebac3bdc14a2781fb53ddc53b7b4931c8d768a95b37b68d299f2d0c2a4a6f96c61b95e3eff2fd9cc69abd78747a367ec8f1cd1674588233c49ee02aad2c2775fabffb0b8ae078bf653204c49871ddb5ec98715a3faab613672e7e9e123ee7e6f779892e767695fe72250a5d3741f15485a9d04d65b371037c9180502d17f74848e7aa8bfea78fb68090d0dc90c76d48ff8e8f0bf1dda602acf942c27ef2068a9051c3b1dff94d060de0be18042f189ab7e0ac357727e37bc88eda385198a81afdf95d993850989c73357750b03dc53aa87293cc81bb79ba3fdfc7a5bd65a25830f0fbbf7ea95e7424edc07d218d87d23260041d4107d012eaf4e7bfb5c058c7520a66d7133bfcefb1bc42319ce782d171ac3803e537d2b712", [{0x1, 0x8}]}) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x25, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d") 8.003349643s ago: executing program 3 (id=2468): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x1, @time={0x9f9f, 0x100}, 0x4, {0x9, 0x5}, 0x6, 0x1, 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1, 0x3}) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r4, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) close(0x3) 7.800471937s ago: executing program 2 (id=2469): r0 = syz_usb_connect(0x5, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_usb_control_io(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000200)={0x20, 0xf, 0x6, "48d9a51c3108"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) 5.684041675s ago: executing program 0 (id=2470): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000880)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000840)={0x14, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) syz_usb_connect$printer(0x4, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x40, 0x5, "", [{{0x9, 0x4, 0x0, 0xc, 0x1, 0x7, 0x1, 0x2, 0xa, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x0, 0x9, 0x5f}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x40, 0x7, 0x8}}]}}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0x8, 0x9, 0x8, 0x20, 0xbe}, 0x74, &(0x7f0000000300)={0x5, 0xf, 0x74, 0x3, [@generic={0x44, 0x10, 0x3, "de7b7e30a5939a171ecc879d07825318a03661822776a63948ebabe334a8634113391e830f9edc3e052fdf49d4506bc7ba04095a6acaf6f6aa497ed702cfb2e5d6"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x40, 0x0, 0x7, 0x0, 0xb}, @ssp_cap={0x20, 0x10, 0xa, 0x0, 0x5, 0x40, 0x0, 0x0, [0xf, 0x805f40, 0xf, 0x8d89492c7b9924d1, 0x7e18]}]}, 0x3, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1409}}, {0x102, &(0x7f0000001fc0)=ANY=[@ANYBLOB="0203717720452a5129c508962a4298b49f30931acc3c10523f1a59857a26bf9dd50e9b3f57e5c9e96600254e59bf25b3b4d4da74204615cf3bf0c3a2dcb20102e8f3772f09e090893178bc992e351b2a23b0a69ea6fd786f668f32bf73f11ffd40d81b9f3f282b946f8459a64e13d2debf50067ee4c9b5f00fa3176704ab7b380feef40ad1b05fcb6a31b9698932d5c2b90b3ecb1ef29ffd9e66573cc510ba8fb61902123babda811719e6655a1d8dea2fc8b4baba09bca832048386896f4486486c7ba68036ad592104be6a51eeeb69b1fb3174cbfeda4cf6d0c8477ab2fe0b572646d57410c796ad2355bdad5b1aeaae2fbe8cc7dd501fc439758cbc87805d4d1a92f75e126760a90fe312d0d3766ab05e27ba03ca982879c178fa11989b7fd35578daac75d82b4dac4a5cce400e4481ded706f4eb51c3"]}, {0x54, &(0x7f0000000b40)=@string={0x54, 0x3, "bfbdae2f2665f9fbb3d0d21b142433ecef9f42d01a4799f05e911b57726918e044f470c4264d3a8ec2332ddbbb92d8e88a2c44e6f8c480770cc66bbe54f96af199e72ef375ce756663da44befbd12ccc8cfb"}}]}) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000cc0)={0xc, &(0x7f00000008c0)={0x20, 0x30, 0x9d, {0x9d, 0x7, "bf74e383db36e6897cb3a4459bc7b3467bee49b2b1324a4c0f04f9dbea7efa72b364fa931a9968ae53f35e9ed9e33dbe279aa6e9aa5566471b12dd8fa94c839685654cc24aa66d56ac6e3e6690f8c0389cf10754ef4e44744de0b237729c2a802c3124d4714f2769428892daf9d6ffb5a77f74ccacb28c3f4b22c8f3cd9e2cf17f401eadb45556422a47fcf7cbeec6e44ac5e2cce293af096da908"}}, &(0x7f0000000c00)={0x0, 0x3, 0xb4, @string={0xb4, 0x3, "b8d7850dc33d463639d8d94d8a566142afedc6f7f06a8231cb361fbbd48dd4b2f5a2ab8c039349ae08bba3596cb9632cfdd3facac400e7b462864ec1814a2e8a5fef681795a7fb23fbab4cbcdf41fb7df65103c6539adfa0c5532c9574ed6fdca8ccf0e1a231603525ebfaa0425645b300c09932dd9a5b993d508e1966e1dc83816bb1eb8e63344d34037c29e4cb0f83a32c2093c150b492d10499fd44d75cad25b7cc655c9c746387f42d7dcfd285180609"}}}, &(0x7f0000000f80)={0x24, &(0x7f0000000d00)={0x0, 0x14, 0x8f, "b1473f086e599bca7d843cd5bd0822fcf6eb5deb8d5ea325ea224dc75df9eb75fc540ed6b192bd6c1cf56425db2e7979ae0899278307d1e34171f2fbb6b1d4ab6f174e49695552d83551da25ae7dce25d662bd96ef5fb228b0e7340a4e198930ad397fb50e72a3688e88f17df430e4546b6019f7683a5eae345c38793021490a82f0374986874b8144017d129e1c40"}, &(0x7f0000000dc0)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000e00)={0x0, 0x8, 0x1, 0x10}, &(0x7f0000000e40)={0x20, 0x81, 0x1, '-'}, &(0x7f0000000e80)={0x20, 0x82, 0x1, "1e"}, &(0x7f0000000ec0)={0x20, 0x83, 0x2, "31e1"}, &(0x7f0000000f00)={0x20, 0x84, 0x2, "cdb4"}, &(0x7f0000000f40)={0x20, 0x85, 0x3, "2fdcbf"}}) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0xc1, 0x7, 0x8}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000023c0)=@delchain={0x630, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x604, 0x2, [@TCA_BPF_ACT={0x600, 0x1, [@m_bpf={0x12c, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0xcd, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d91028270a2722b141a9140c47e37d068e7193d463a6444e424bc792ab1295f79842a501700a5cc2f71eefaf131a98821e712b0"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_bpf={0x60, 0x8, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_OPS={0x24, 0x4, [{0x0, 0x0, 0x9, 0xff}, {0xb, 0xf6, 0x5, 0xfffffffc}, {0x401, 0xb0, 0x32}, {0x6092, 0x70, 0x6, 0x1ff}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_police={0x444, 0x9, 0x0, 0x0, {{0xb}, {0x408, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xe73, 0x9, 0x7, 0x3, 0x1ff, 0x7, 0x8, 0x80, 0x3, 0x1, 0x10000000, 0x401, 0x3, 0x2, 0x4, 0x6, 0x1000, 0x3, 0x5, 0x5, 0xfffffff9, 0xff, 0xc, 0x7fff, 0x5, 0x5c7000, 0x9, 0x7fffffff, 0x5, 0x6, 0x0, 0x80, 0x1f, 0x7ff, 0xfffffc84, 0x10, 0xfffffff7, 0x3, 0x8, 0x6, 0x5, 0xb, 0x8, 0xfffffffd, 0x4c, 0xe, 0xf, 0x9, 0x9, 0x3, 0xfffffff9, 0xfffffffa, 0x1, 0x2, 0x9, 0x8, 0xc6e7, 0xa000, 0x2, 0x8000, 0x17, 0x6, 0x2e52, 0x9, 0x7, 0x6, 0x414, 0x10001, 0x0, 0x5, 0xffffffff, 0xc, 0x1000, 0x4, 0x800, 0x10, 0x39, 0x5, 0x2, 0x5c3, 0x800, 0x2, 0x5, 0x6e6, 0x3, 0x7, 0x6, 0xc, 0x3, 0x14e, 0x8, 0x5, 0xad8, 0x289f, 0x3, 0x97e, 0x3, 0x80, 0x6, 0xb, 0x8, 0xe6, 0x720, 0x2, 0xa98f, 0x1, 0xffffffff, 0x0, 0x3, 0x74, 0xdd7c, 0x2, 0x0, 0xffffff7c, 0x6, 0x7f, 0x1, 0x6, 0x4, 0x7, 0x3, 0x7, 0xb, 0xfff, 0xfffffffd, 0x3, 0xc60, 0x7, 0x4, 0xf8ca, 0xb, 0x6, 0x3ff, 0x7fffffff, 0x8001, 0xd, 0x0, 0x4, 0x4, 0x0, 0x421, 0x8, 0x9, 0x2, 0x1, 0x0, 0x9, 0xffff, 0x7ff, 0x8, 0x9, 0x2, 0xb, 0xa00, 0x2, 0xfec, 0x5, 0x5, 0x5, 0x9, 0x2, 0x400, 0x3, 0x3, 0x3, 0x8, 0xe59, 0x1000, 0x101, 0x5, 0x8001, 0x9, 0x4, 0x0, 0x6155, 0xe040, 0x80000001, 0x40, 0x7f, 0x9, 0x5e59, 0x81, 0x0, 0x9, 0x0, 0x3, 0x1, 0xb571, 0xe, 0x7, 0xa, 0x80000000, 0x2797, 0x4, 0x2, 0x2, 0x2, 0x3, 0x81, 0xffffffff, 0x6f, 0xfffffffd, 0x5, 0xb, 0x1, 0x3, 0x3, 0x1, 0x2, 0x4, 0x8001, 0x7, 0x7, 0x1, 0x32d, 0x9, 0x6, 0x2, 0x6, 0x2, 0x4, 0x1, 0x4, 0x0, 0x1000, 0x80000001, 0xffffffff, 0x4, 0x7, 0x8, 0x8, 0x697, 0xe339, 0x9, 0x1, 0x6, 0xffffffff, 0x9, 0x9, 0x35, 0x7, 0x5, 0xfffffffb, 0xfffffff9, 0x965, 0x7145, 0x90b6, 0x6, 0x6, 0x2, 0x8, 0x1, 0x1, 0xd5, 0x7ff, 0x200]}]]}, {0x11, 0x6, "94cedea66d85e9b70c476ee3b0"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_xt={0x2c, 0x13, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x630}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) close(r0) r3 = socket(0x10, 0x803, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 4.868204101s ago: executing program 3 (id=2471): r0 = socket$key(0xf, 0x3, 0x2) ioctl$XFS_IOC_SCRUB_METADATA(0xffffffffffffffff, 0xc040583c, &(0x7f0000000000)={0x4, 0x102, 0x3, 0x2, 0x8}) sendmsg$key(r0, &(0x7f0000000080)={0x2, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020a000002"], 0x10}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc01c586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x80000, &(0x7f0000000100)={@_ha_fsid={[0x7fd, 0x5]}, {0xffff, 0x7f, 0x1000}}, 0x6, &(0x7f0000000140), &(0x7f00000001c0)}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x8) 4.75344019s ago: executing program 6 (id=2472): r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x8800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="311031a124699f9e0c61a7f7a76b9c8c17d170ea6eeb3502220fb0b0ac236c", 0x1f, 0x4000000, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x1, 0x4, 0xc2, 0x4f, 0x40, 0x1, 0x80, 0x1, 0x7f, 0x44, 0x8, 0x0, 0x9}, {0xb, 0xa7f2, 0x6, 0x8, 0x9, 0xff, 0x4, 0x3, 0xa, 0x13, 0x22, 0x6, 0x1}, {0x1ff, 0x7, 0xd, 0x0, 0x25, 0x9, 0x0, 0xfb, 0x4, 0x15, 0x0, 0x68, 0x4}], 0x9}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xfffffffffffffffe, 0x6, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x0, 0x1, 0x10, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff], 0xeeef0000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r3) r4 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r4, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) ioctl$SNDCTL_MIDI_INFO(r5, 0xc074510c, &(0x7f0000000140)={"b27116b4a19e50fa3a4e4969d7ad577cadaeb60685b350a3f1ec308a61bd", 0xfffffff9, 0x1c00, 0x5, [0x4, 0x3, 0x800, 0xb80, 0x2, 0x3, 0x2, 0xff, 0x5, 0x2, 0xffffffff, 0x9, 0xbd, 0x10001, 0x0, 0x820, 0x5, 0x9]}) io_submit(r6, 0x1, &(0x7f00000001c0)=[&(0x7f0000000040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000000)="0d32818e2cede722e231", 0xa}]) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r7, &(0x7f00000007c0)="0bcde56ca9a62cbf", 0x8) syz_usb_disconnect(r4) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) fsetxattr(r9, &(0x7f0000000280)=ANY=[@ANYBLOB="757365722eef"], 0x0, 0x0, 0x1) close_range(r8, 0xffffffffffffffff, 0x0) r10 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r11 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r12 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r11) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r10, &(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)=@keyring={'key_or_keyring:', r12}) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r10) 4.50846113s ago: executing program 2 (id=2473): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x102) ioctl$USBDEVFS_GETDRIVER(r1, 0x41045508, &(0x7f0000000180)={0x0, "4d13772fd75e6d19e432d557563632e8b04e654a0ae923e74d29857b8ecc738beee8a583be3f4771d81e21008788a2b347a96e0742f28be4fe01245bad1bd937d4647906a4b14dd58f63c6940b083e46647bad24ae66092fd6aff21228047c169464257353225547949cdc8c96b6cdd42542802b2d6cd795b7783234e3d8ab032084880e67a75d63987693ed890840a32712dccaf3827e38273b7616b49c22dcd794390083f4e95a03be3cc1a4d92ca1d3b1dda2d7bb0208e24d8a46366bca5c443955337201700252baf3ceee7266b2c33d220b3acc8531a9730693cf04a7c540a6a624e693c689d1f5b334eb80b240b1fa73e3af2c633900"}) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0xfd7c, 0x4, 0x1, 0x290}, &(0x7f0000000340)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecf0, 0x800, 0x2, 0x3d9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x84b1, 0x8, 0x0, 0x119}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3d5b, 0x10, 0x8, 0x63}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8850, 0x4, 0x2, 0x2c2}, 0xffffffffffffffff}], 0x4, &(0x7f00000015c0)={0x2e, 0x53, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x4}, 0x0, 0x0, '\x00', {0x1, 0x33, 0x0, &(0x7f00000005c0)=@buf_4k="b2532c0ac6a8070a11ca9c8200c270cf689eedc31271f9479b341f9a0decd5afbe84f627ba9558f1b853283ac8d44da430b1e5baba4ad1e3ba84b75d74e46b69983b0d16615547c44aa3bd752c7d8c28baf140b077350fe502300b3aa2bff4e3493ebb2ae8f0e96169ec4cc448012bdf0dacc54d2c33adc43b75e3f992a75f3f107a4cb09d814e5bc28825ae9e57966edd663e80f899f050ed582e8e5233d88bf6ffcf16d81596eca56dc18bdea3101e4a31794646c1b6cfc97a838a22fa16f49ffd5cbc2512882c94cf707de5df2f10a8cff76c28de6306e58479be9eb5a94fa39d941151c4e70cec18e977c03a1946bfc1afd1527d9a8ac4c26443a576dfa4bea59a43aba0da7fa423d7dd35ac6bcbf4b2777e7773f38f39b5f6083da0ba847ca2c18a45ac850c4486afa8498486de3e0dc0873ad1ae699ce8970eee51e99d45089c8496ecfba024e7f96ac3f1fdb07ae4dbe84c72e513196ac35349f455b6830f86871c9ca36769ec22e200d7272559372e8d13bd9fd41eb9b82ec6e1565d8418b88e880d719c8104609f124f0270ca53f6bacc2f2d0be10cc5fafe50a7dbc57c8897ba8aba0d388ac3ac6a97a13e0f25e6d11be3403360f0ac8fd986bad4721b14fb66a35dc1731d24ae6104e5f2e0c4c520d9dcf59f01e03cb83223cdeedf8b00f8f648cc40bb4a918a45242c60551ddd685dea22c0b8978ae86374af9dc4fb7cea5166c84e0bb59919f27a1d56990bc0155c3a8f756b402465735b1d39537e9c1ac5d2dc69f91a1aae7fb2a88ca950c356f74b447364a062833eba25b165a6ea51482bdd53f6f921d5317db233839570f816b1f6175801e2c721ce11af04a6efa190547df6ddb6ecc315bac3be5570d399f815e43e9b89872fcfd586e5aa505ee8226cae572846f480021485870e6ad373d85af12b203961d4837eb99bacd76a581013f477ae9f81f2778b7861cd062d00ccc96fbd3d44c5656c5f7bea7ccb4fcfc20445a91fadb4f5900465c8813869412f146799375616b655c144f66d2c7563a12737b828278edb0fc891aa551e0bf992e798ba98e9d9e3bd1eb022602534b67df4d7c72e7923688c7392f9cf3d41c2ac073592c88f3fbc14096fbc53f5c7e628e4662345dcbe0945a36cc5084aeac4f829d8c2ed72d8b96329014c293e62151ade58318c4d1722be5801e47214773ccfe3b6a1165a3dc64b102271d91dd81b98f1319a3a30de17738d9a06617b24661584e3b7acd4bf2a63d03e406016fb18467d2229c44b31d1b455b4c5f36bd799bad0d54b40bf55e2d2ecb1ca90aaee6a5fd4fa161319a325c5802e337f87bfb6cbf5270de271f2cbe6cc41fc70538d499c7030d9a95f27c53d9385d421aa58628d61d96463d7db7bd6e761e9e039c7f24fa1b0e89d97f5290658310e4a64e74193cf3319c4ee218d2bb6a45726ddb5c6844df4d1455c96437b5e5cbf4747f64f99be2737b7da09fdee46470515e439a86509c9a9b0ed3da1c0fafc50811816a0c21d8468038294f02c12924b500943e00dc569930d7efd1dde908a576a07a7c0003c9f10c916367a976df6c5dfefffc8a39831c256af7430416967bb7d9933355528669cdb5f95517290c7ed84fe95ea38f1edddd1c6823fdc0c5ce891246cf2648bf186c927ce708bd9061a6bddbd1fc59724cc45619587608520346000a3041b55ec5317f5e1c5f4d73033da6e29500a48eb05c4ce340785aa8a976d43ed865f80aecc63318ff79bc3792f2480937ace3bb901aa5758dd8f5b6f7054b4aca04c41ccd121fe6c78a7bff3dde6b4bcf7558747e1b945e19819a417715e53dd828ff40a32160ac102a3f648d88a9616b954df6746e46bd09a02540ec83d7e2569bdcda200ffc7a3926204f0697df77bb8c8fad5ad8f925da3b9bebce7695c03d6c8a67f017de661ba3b8eb2eb7c9fbd24b4d703ce8aec7ec2ee2966c50321b2abcfd92bfa51966b8939b126bab1447f5c1abc4cac799968daf5de55d0376ec28e1411b4da4fa97fe668de598627f33986d1bcbc7dd4e04a8dc98cbd792ee31a8c037b383a278228e19882f6f952381b3cf54cf02783f60c54528edd92affed53ed4eeff97d983f998d8c4eaebad685c330481a973179402444c50886c9afb194d4aa487f9c000392aca4026ff1b421e0c744657e0ebc52431f9d6f27365a56a88ec7c952953ab11c7655ba088c5ec9c7af2c0ceb3923dd0ff9628ca6a83e3f9a31a2d43cb1ebfe6a682643def020570750a6db54098f4f0a9eb94123ace64390e88fb139a9cb020895a5d16e2c41e238723bd77c45d142adc19974efa3273ee57e2db0fbaa993ea6d08352e7ba93cc918b59882dbe78e382c833601a8d2c7e541799f25502e0e8a95ed872aa6d97b4fcf537ea5c2594cc75d76f336c38eceb339c271cc85940b5be1fabf519d692dabbd25353d8fea9cb3694bff3d7392856e71645ce9cb8619487fe4197b619045e90e30c2cbd15e5cc2d6a434ad7b0f195ac0bef508729be6058d1d536af44a571bdee46e70cc5a568799afea7586ffbe463a6161996fd5cc8a18082a0acce28ef675d0d88259f888b29672f0f20dcbb272fcfaa08d31e521356bc20f58efea165dc7dfd42eee22769d7502f1d492a3aea6bcb6d73fd73e046d9869df72f8ef8b5c8e96cfddccdf7d49392d71ce7436a2a0b27c2def8ece1f16cdd36270d991492c43374a22f426792eecc117fe6cfacfa687e5579981a28b219b31749f7e9f4e80ae3b4f4cb4e28cb24353a96f9303dd511875d28023a8bb0702ec29dfb3634bf36811c63f567213cd490a618455be1bd97b96502f8e255625ed1a71b9efb812e1882db0086365eef43d5e3ae9b3d052d3fe20e49d1b7bde432bb5fdbbd46f48a02b7c7b73dc53e573ce1adbcd99d764e41f5a1da9984f8237201ba5e3c8bf1bfa3c8752881d65e221dda6e5bcb9cbb8cdcb64d0705cddf2208a5a5cdc9f7528e6777da414a4c5e76681bb4b7cf2eb0463a86c66cdefee5ba167b628f1efd4c2ba1b030eb72b9d6236666f5b52d89e5913490b2bf93078f145af94cefa9361d31c93734ae181cb9e1eacf69eccf3bc8aed47707a1541b40c1fb051ff0600716a44b1f49b97327593350c2f44af6ee2d95d08a94feae96502150ca16a8c33b2266574d5ed97de37d397209a3b23122652a3d6432081e8ea5c80d67f39dd2e9288348e14182b171d5e83a9231b1a8cb69d535b2752013671f083e1c588e0c32e2022277cc5a6f668423cb91febc149a32281639d480007e8afc76e8d6c7936c783220a5497ad943402ec821f5919754e2d8c5f98711d0e36ad6205f721474dfeb5c6fd8d2fa2ceb89fc8c4bf08d8ecb9d0e8a56d8617af8bcb7583d52640c64a07e24817dc32284676f550512caff1ae1bfc1c7c9d7d8df8277b3e907928356695cfe4218d84f2b82b87b7a086dcc646d4cf1734007bc6a3000ae1bc4e8db7091a52cc1b9f6838b8528222a22591aaaf1727fa883472d637e22b9eeba23c9ef93f67f4d8871cc966af3c437e70dfc2d653d9e1a1c47b66fd4ea06b830a14b55b5395da216615a761194942ed7ea5d7fd380f19e6ae99cea23ef9b41dc399b9db374b8fab7407e3c32334d78a341be4a17f3898fafce84fb16f4528e3fe9e2495968a9229dc9f731ab5f9d1cf12c13852a0ffb85a8426d2eb59f007f4d948d18730b6ba10a1d483fc2aebc040e0d418a0d2b3e6e22b4b1dadfccb7ec27adc473459fc6420e0636b95ff9a8f5fa3bf182b2e263c66c17482ab7e9611f634f46e0ca957836e04bae36f190521244d33f4ed346033b592e961e5d9b6e2147c2552ee2c4b4dbb48a541ad0982c62d384179bb6dc2be33e98f579359b9384a9315656c6a322b08405f10396d499bfa3e7adbf80c88731fd2b895baac5ed01278034096f2e64c2b824647051cfa970950fed140499b065536a8cab381ca9a41f47f174242e904b47ee10f61d74b29f8cd317c92393ff5df955d6ce6d82fd5421768ce0a06f30d8691da1f224990df640710c576386cceb3aac48ad09b8c790aad4153c0862e14d1869b43316e0313220e66ff6edb8cdd0d11d74573800cb04821a40338c2f930ac8921b35fe9b6ea6983c47f6ab6bc99ad21e84b1a5c6d28fbd8da869c4e397ad41355a9849800b66b0faa439c9908f0f48c12f191d11ffc436c9a31aab431ee635760a201ae9d75eaec68df22d6d1b9d3d3f8310c228d58ed6dfe8b809db5d99b6612d5ce89a90b65f984c4816986aec886cd5738b4acda142374e171c8f1aa00a3c571c04263ff56ee3e4a1565091a4da648ea480ffeb6e5960707eb9215b6a5be6e601c35a36cc0d39f2e2f6a3d7239275418f28d7637cb356b2bbcfa2d187cfc5fc41c221cad4522da3e21e3e795d201f7d86dc3b414ea79bc6c180c138d35c95126a419dd7af8b0843f8bd0a014c26b543e822a2221d7bcc84236ba6b375215f59a68a75896e464054682705bf42c95d8d323a51299e907a85915f549e6754d940300142d3d3abd102c279b0693fefbe64003759ff590b3e0327353541891c90f0f1b7c915fdd18843a045e9b1419ae750d9fcc2c5ff0c7339d381e3bf29a363e8d30a6b2ecfbac862abaa6da1b9a0fe8bd53659b9f405968916dd8edf5b383693d713dd6d12748176115d2fba63cea05aa4a7625777c7c402c7660b2c563f3e8f6f4cbd62cef2610c275ae5149a0341502bad66eee00d6390c99629646b299378e863b28707545116438456d4ceb35911a707bf32e2649627031083012181949fcf5685abd64e84afcb5b31268c4dd9305a76eb41f6e77c7c78175d55493a37ab616cd541aee09395b7b76af4bcdb082dc73987d9bad4c32104c767ee18507b5fb1cb48476a0facc1e9282c3fd9139d8649f8c8d38ea7c10d1b355afd81a9a3f17af0689c104f7b34e0eff31622a690e8390282dda80821bbcfdfe8e479d3b62d4f755b795e3b5469d54f5b7e913828159e99dcfaec5d5332278f321af2ff0b96d55541b06afea9d052a76c8e281c574fa0f90391a3dc279c21547c05efe9d8d0658e8ec0f63e55b6303481a86985c24f5198223c399eeb290602a87ecafb20ae48c64e1d3e7859aba761f115ecc80f16f4333163d93ea27822c29f06ef0b0a6525dd47a491d659377d63a237eb96003910cf41f3f546bf0368fcb6ab826333eaf3a4bda75f30ea6f631bee70e7be7bc6d438c041f505a34f656a98f2c482d749eff9046c3bd888b54f4330b51e27ddf23bed1c86fef5d67e52aa50ff9c6e2607c7e7c0685e96fbb9ca2536a72436fd9c142d127607ecc39ea097a3783771f04772be9be123e86c89e2d58f2badc750e857a09eea19d8b0e5c929edb2d36a786826e17db096bd6025abd7f871fab1531bce2f449acba8f1d10587f8f5aab91d49077a0ef1633c1fc7e20b05bda0d73ab2cd38448ddd7978394823e3bb4bdd7e9549ccb6e1e7020186c373b4622fc98705d492704222d501608926315c4e136bd62ac1a043d85ab4b3c5428cf2d59f55af0c8824cf7c55e910ad888008771a156f85ce2200f66642d66e4e0150aed3c36f886a939db4c2c1a3f58c8059aa8b37642a96cfd7a6561be6c3bc3f67a62da48e519f2bf6c0c20f8bc5c2546236a2c79d58b188f2c583a591d983d0ed3d65ae807ea329c75fdb0363c1178a7fe15bd25f08e96ec1569b828b560b9c50533fafc780fa8846c5e71961414ac3a77c191702b39fe7f8f9c69aaa0de569c6c670f0b250ffb50c5857ba7b5"}}, &(0x7f0000001640)) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000016c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001680)=@any_dev={0x4, 0x505, 0x0, 0x0, 0x1000, 0x1, 0xffffffffffffffff, 0x0, 0x4}}}, &(0x7f0000001740)=0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000001780)={0x0, 0xeb47, 0x800, 0x2, 0x2270, 0x0, r3}, &(0x7f0000001800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f19, 0x8000, 0x0, 0xbf}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbad3, 0x1, 0x3, 0x3c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf22e, 0x8000, 0x1, 0x10d}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f14, 0x0, 0x2, 0xc2}}], 0x4, &(0x7f0000002a80)={0x2e, 0xa, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x81}, 0x0, 0x0, '\x00', {0x3, 0x5b4, 0x0, &(0x7f0000001a80)=@buf_512="71e7bafb11e7422adbaec10db5f2285ee6a96de1fc6804fc7d8d12dfef94407612d038219269475fb543d38ea7cc71cde9333ce99e16da16852cc8d78fc85c2d5469e9608aaa7177ef79f4742e0808d7fbcfd47afd2f3bafc9371365588bdc85f9f528068b013a63ab7157f70714a2db661a69e9babf48c4af55c9fe0de2713c0d90cc8ca0f4bc9ee3003001932fd65c14d4d57a0c1b9d2e0aea42546a47e87a8eb2edc7c27862eda622b08f4467496e7741478b2ec6a94520e81354c126bd38cf76bc3e8c7fea6b7d29c2b019f55836833a049eff36ed4292b8a06c4d4154d53f40e9d2e3152a8d7502588de62b67de4f2fc12bffc9216242591f12d2cd6e01e2d09b3b93fb62b2abae6e69ebf000002433537149b5552056eb38a3c779ac3dc29e4ee85195b783f6fa3c0bd705048918945b534d25877d373f7dfbddde0ba2a0dc9eb61d92ba1ca7e485b34da27e61f306ce17149774c8b86dd53a0bb75f3aa4edb509bdfc2ea9114d4c9a332371d839d2aabab76723fcf8ff646691ebaa394be09a0fa3b8d83d5240c295c2cbda92ff6af849ad00dba22f426a57d3adc8f9168a937f0b71a8801aa015743b95501420494729a39418fabb9da2538fc8d506f540eca06fc5101a2e09eb0889c83bc75b223b64ce102291d4792249d4ffc783a000cdbada6fd49cc0f1a9867a80eaedd147965514d800f018be2255aadbcc1c"}}, &(0x7f0000002b00)) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000002bc0)={0x0, 0x1bdd, 0x80, 0x2, 0x7b}, &(0x7f0000002c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf1e, 0x20000, 0x1, 0x1a0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x17e8, 0x800, 0x0, 0x36f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd04c, 0x400, 0x2, 0x40}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8b68, 0x2000, 0x3, 0x37b}, 0xffffffffffffffff}], 0x4, &(0x7f0000003ec0)={0x2e, 0x3, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xd}, 0x0, 0x0, '\x00', {0x2, 0x383, 0x0, &(0x7f0000002ec0)=@buf_max_buf="cd76c5a612c84d66bdf34a445d55d85ff64431ed584bdd0995325a646f48c2739c5e34b9a3bf65e3435cd049682b731d5694a62566a868808751767f1e67e2f91bccd56ca788d750d0472379280cf004512c67085c65c077b2c8d57d9eddc63d0efeda34678b225430ca8f0a239d1f4c955577193bb01d4204d871d8e431f921482944f0a6732e034133fdb31804c54162ac7cff18bdc86be93ea458700a3ee7cce09b7642efce65f3dc81eb35cb00df1b68e73038f25ec350bf1628b17ef3c28dddf032bf04c83a9271f0551cb403073a4edaf0c3cf792795126bef1cbb6ece5f38f5dd00328dcac4c58d05b451705bdc352dde48fc5c4d6240a47266ebf5864b7ef8b8809c7781a91f771bc2e7e8b2ede6708144b51bdc2e93fa40844af64725065f60f6445366d2d1fab586abad9083beef0833c60839e30ae0704a35e54e8c2a3067170f2fe300723e47c7b4bcf6d21bbded2ac9de812c9d6431c65a3b8bf01e9d9f91a3d4359947c2600185fa3a064a78d7e831d926edf6f8b5e041bdc6b028027f166ef61ae244b6efe9fa379b6a3fce743a10180f486b2c48781d8dd04528afc2adbca1233e840ce7e31a1ddb105598b82f0eed183dd9cccb9938ab0035ddb75faab37d8bf76605f93a8130658386892755eb40f7af2cf599c710f1270602271abd51daad294da6d777e6f5944c2e955ff81784ece9bcf48aee7fd4647b54ff4a010095bc29e7046d5c6b7ca3cd6cf0b0e6860a7799c569806312ba1491e5aadb94da5f840ed2cf1c9eaff256ffb0c6cf58fe3d3e62d81b52dd3487061b32c4810dad7c81e43fe639e6c510bcc62a09b66a5d22fd45fbebde06d60e8a6d98c2cfb6782f9b7577e1c2879eba32d0210bf6ea6ead6a68f3ab32a9c4f897993a041c974d151c83be4060e0545e135a564e68287fee7e6b58c4d457ccf352683fab75fc1160e8576ce455556821defcac310b276d3353eb1401aac4aa572cdaea89ff4451621de3cce4f068b9844155adf7f20fc7f58163693fe92b33a3798ec877309b84ee812aace00e9e8c5153d383013fd885bcc4eccea516e1b6cec174e7a4d74fc77d77c96aa82a55ee5ff0cc6385383c60c3e67c3f10b6ec502d0980bd9eafb5aec19de8891a8635661af4636cd66eab0e01f49679c2ecd70c7e518ef48dc602e5c90104f0ddcfa44e90643b48100d7e69fbdfc289b14d24db4b5c3bbee38a53e1decc1dbc17adc5ee89fb70dd190784d1545e2f6fb7660c7de6e0392f82023a3dd57f3c62a931dd56557c56894337e3a087f827642f8b95c6a2ea3e8bbe65775762eff0a9a08c8914c3c66e252dd63eda928d86bb9eaab090f311fd9a4bc2aefca3cd9aae75032fbfe45e7652c272311d775014db82c431257f346a572c0d6105e1d8c61a5928e362cf0db85c3cb140b39437ed57f5582b2b5d977c8245aefc7aa8fb48f8b58931ff91de160ca0d3e53ce0ba519535426200ef95ce83c22febbaebbb4c81384a381db5b1900ae5f49bf5a670cade22e196268e20f78b8793bf86bc2b413d513ad3cda0ca7f245386de86d1b2bef87acb4f79b20cb83b92120d132624c6c7f70db8a17f18c82c6ec9105e597791863d7ac07f031be11bb9aee1e3566331fe8c5515fed3e590ffffda01777c375757b58766645c70ae1a0a50e55f216b370e9d1550a6836815484228c29a55a8ebdc87a663979e305e30f5e34e6e750804677d25496ac3c433089035305c660cc146e01ec728567e987b6f59c0463afb0e543b63199039da8bb8c0548c50844c318befb0f4d7b5384d64d138c2a19ceba4d2ad4ac04c0a5a44ad8e6d1c30cd940f4aa27a33882b6bc99f0ce425485ac38736869efbe6424442c576d1f7e13b4f248b6b647edb964379073a80798977d11daaecc06ee87a62a3f8ca5f197c4aa8f9e75433f0a18e14b223fca34e5bfe9a1d6622cfbaaf697e6f3d73cf72d1f9a264d77ee35de6aa00d667db2478d2fb4101ac0c72e1da746687b88965bde3d8ecddf4ea6362935062d91ec601c0ca798027342759d5f7c898b9be2888bae13ee4f5e85cc2f19c02be27f9d2950aa1667264028a4d95ed930f0e78377ab5a3cda478bbcd8aa22f4afcf4b50acb7306dba36e6a77be741ca4ac07dbb352fa473e625f3ddfd12abb7b7765491d37acef3f75f6d11778c4b79d235e7b3b1013552e22a7427c5ddbb45d07f4906f3c69c0fd6843844dd23a18e6a2be8c123d019c986e9f09fab8c47a1aac9c6ed2d8d7d9ba02697eb44fc64ee94e9fb6b97b330dc16428130217eccb80f6e5e9a7c7d9c27793a0af7185328180a42153f7e1df2e154f3053a884d0a9443702316d5f895d8c46249d22b60013973b0abb5b77191f42c620248ea3996ffb6bf10e4b49eb790e1a2a2f2ebd31035ed0862da5a488927c3779a20077d2870381d34bd0359ce00605abedf6146371b5cbea96c2e3f36319f8f8a27d4acc9808752ac726195e0b07ffa30411e3887614dbfbf3900b43f03d33fa24f1de23d08d52c7112c98b21bb37570fc533077ad2490bfa771e0d101972b517d787b1063e8fc53545e897f885d338a2568c6c89e78910f85c6a098d0ccbeae23a215fa90967f1d2ee6d2833c98a7c3da6d1348fd55a5645cc35f285b26eb8d582fa9267b8737b371ef7c1cd0f86636d55ec364f625c4a37356c4f7a75786de432aa50e5eed49442e371c2a3af29c85b7f1a36b12ee86fc79036541c4adb1d28f01a09296561043453bd40191f05f700ce5fc8b13d29f64bc6d65c5362108017e621f5fbf1811f482d0f3ff862c9a9d9b71ba263c0573bf471a420695836adc29d054fa0d718c32c6ba3bb5efa51aa404155f2541fe8f2db42ce4fc36f8e5f48e687376d9d8eef9c1f551d5bc716568227ec6d5ec694610ef9ae679f0ffa95eccbe44cd7a6c4b89923d7c823873fc2ddbcb0d68a372f6748bce142d4d2dd6ee57af0bf6129b6d471a5039a674733b2926e117329e3d9d5bd081e01ac29ef7e5a3ac97cfc475bbef82936f4e68d11cbda5d1f461c49fe5b2ee8102d14bf39fa9b3333a77c2fd1a5413afc084f5109a0b2c1564bdf500acd5576b39b9c2a992a6806fb51e86be8af5cf51da3ffbc7163086dec8ef7be5f5c6fcc06fe1c2f518727324d1c80b0ab7880c8347283ccac2b8730394a1df643964eb64b02215d65ded462041646b7308a52da7a4a093dba707ffdfd16792497c478d3dd35af7b5c53e33a8afcf21adf09d79fe185d0b502214224c9976d5a95f1c9f667ee352f3ea08689a514ed86d3d92e12537c780f6ab9654e121b5834557e14c7530df9b316c9eab2698a670199dbd9ba42c20344cd1da003a38810aed9660d7269329e4a76e5f1b0405e8bff105af886933fccd370ef438d42444f354356360636570e594229a3521e15749c0f23a1178008b2f7e7dc5117afbd9f0530d9f1ab3489151b3bebeae4210f554741edabb29ef75516a6c6c1394b8b3742c23e6b82e7a3665e7556f5f2f054476b29866b578dc40da282ceed13689c8eed0ae2adfd17bef7fc3a805e21812f38e29a9679b088eea15b25b14dfea8b5452f27081a892e9694d44ad3709a07268bda28cc183623e644a5725d2233033c2a1c012ac0bdec34e7f1452a07641ab588ee69de1ec93650410ed91857922c18d544b2d84ad232ccc4bead3d467a9dc2f270f771d9b882a1f85b5d671b40a4cd9a4ff4651ea7fa063181a415f4273b1115af9e7585628fc509a4a1091dee2d9f1510501f54a6ee324fb7696dbb27da19eb13edec7a0dde59de4e1c2fe65438985c93f357d0825a54eb9056dd4741d700d745d9a28f05459bd058cdde5a0c574af33f1d0ef5b9c43b113484f1019ab637c282f1ba57a287ce20782a4fb405391c9e35c6587e8b84a28337ad2df210bad4bc60824c1daa05670ff1acfd51b46d607f43afe00d3d5c15193a759dc8495091112dce73fd283d1e53064743415d18fee4eb3698981f244015a63c999f6f5f83fcd58481e2f5307001941ccc6a40be38abdc84a88469db67bda6edbd8a6bb862c015cf05a2c51c4bfa8f2f2d2b438106e79a357055b6fe321d54af4091963d96d86949dbf5002ddabb43a2e63abdcea86bbb91586bed40c4f448552782c2f30b25e8e98e21b8136631aa70cebbdd43325e408202b3cd1bc80cf51806d25fee9fa9e67fdd1213545da9b8ae06d0fad9e7bfb0abe724f847e3d6574ecf8e9a5ad33a038a158588f9811e9223d88e43df057d15e927b09df9862762a1cda1c22abda8ad59676ffe9437aa7b13fe35a1de49e9fd3a83f742232a724bed97e172b3c2a7c1215ba29c24b13bb00146c703c497d3d35c3a06d4db937cc86d4d4641a1506a0e61a1f025e331f2a86529acf80bde70f7b8228f0ab4287c4c247afdeb6fe71b46630e690d587cb2e3682bbc2310fd91e71dd99ed16ba12045629fb7226a0ce110664da689ad32e78fb1c18394d267a2d9941a99e13515dc007dba4a55734796d589b021924d91c3cd60bcb9bedbd84fe8b134506474e814ded7b739499045a345b26bbb466f14236a5c2357771d78dfae4b9e850c2985ef4dcea22e1c1bef974e363159b4bd419887505cbdac396ff39a22eebc73bb393877ffeef0586dca196b0253259ee7d7d443828821da6a7751ac0539f9ba437fc801486b400ca2b58fb39fc9893cee0373401a379438bdb6f1b4c0271566d745f5c0b102e18d4b972ac58db3ec8ea2fc0b971811528f5e4f962066e02d74c866699fc6674a67dcb83f0343c5cc8461b41a2939763f6b4bdf2acb36603bc52261b7387120650cb4322b606b0b01cbffbea77798b3fcd0114ee817a8fe5cdac9c2e924294130e328cf3d276b770fca5146b9f8ccd80af88e1f241b8e1e19fd0a0b38a18aeb187221abee1efe64096cb06f77440c030aca4087efe8b61822a9888c68c2baedc9851de5e2297a409eb2e6e4c98223f95fecc4879b38a6922e9a79b189edaee32fb0b75f58dd185496dfe9ece3b946bbbc439abc0a9b6dc6104166e4dcec5a64d8006a046dc189175d4e17fd286608295619f452663baac4b1c120c45ac20fa8c1ef1bf7ba8bda55a00ee7e5e819993f46b082c8ad03fd4e41e614da6ead64b9e37d3d06fcff97c6deb1ac72e17d9e0c0918a1c6b579874b17ffaee3f007b11af8f32de3a05c26d90c60765e21b88f383439948815879a61efdd5f6c8704b4def5ae308b5d59b9a914400cbc7b5e4dd6494cb199c6e559ea71b3e2dd82de73bab36aefa9658729e72b7279cceea0dd370e397fb382fbe88d35650dd0a4d9e3b32574d7319846265c91dfec601c1a943e829bfcc0cf76341421c3d8b2e5374c7e5ec3345b5d24e8c8346c3c4d7eea9a6891fb8907381a0168b90bc7fecbcb608ff55c994df1cd07291c8f558a5f291fa1ebf58949b2b9501e2376d3f73ae708364572098b90ac6cf4797f12b94bab2ebd550b5f0f81dd7a96c96b48206dd8089997b48a9c23bf5712ed29cde91df13586844df48eb2f22991712221647429d8de18abce218a45431087f5f322241a3f4553a6aa2fa860733c4fe3b66c1ed2bb70c58fc0cf5da33b76f082d96b039f26175e53fdc6bbb449d72decb6765c31b5883e15f4f0ad1abb166ee3780cf6bc44a3260f4a1a749bf755ac4dd420f55fc14233c26b9b13fe06fa493513b5583d8dd09346c3cf49413483376b92d594356bd511ab6b29e82afd43de830a82aba21f4766ece26876db3302c53e6764fef9d5a2dac3977716267e1"}}, &(0x7f0000003f40)) r7 = io_uring_setup(0x5705, &(0x7f0000003f80)={0x0, 0x7aef, 0x40, 0x2, 0x1da}) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r9 = memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd\x9b`;\x1c\xfc\xaf9\x98\x91\xe7\x00'/52, 0x0) splice(r8, 0x0, r9, 0x0, 0x400c5, 0x5) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000004280)={0x0, 0x2184, 0x8000, 0x1, 0x9d}, &(0x7f0000004300)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x10aa, 0x1, 0x1, 0x3e7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x45ad, 0x2, 0x1, 0x20c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcb5c, 0x1, 0x1, 0x33a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa8ba, 0x2, 0x0, 0x24f}}], 0x4, &(0x7f0000005580)={0x2e, 0x70, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0xbf36}, 0x0, 0x0, '\x00', {0x0, 0x8, 0x0, &(0x7f0000004580)=@buf_max_buf="057747ea5af9bf77c079fb975e74dd3d4207639a06ff1ff39dc204aa20358714593c733b3210cf29c1eaf89d77f6cc221e93f9bbbb2b5521306ce4891dd9eb6eb0ea512a208495cb0f5ff62ec5e90547b5fefb0bf21c42e37cea0db2b276aed772881661e7e3eb815c5afc168c947349f560e0e1bbc7e48e297d87d70e3076630d5908ce94f001cc230e3f69d790cd72c10ac53b2b3dd3f305efca6d0ee105c584eb2774dd1840eafffe0d15178a7f41ce434c1d4a449c79d2afee500a3341623239c5b6ef51e91ef5f1136f6142b9363f5ff95c8da020f5eab4fe1659b7d65109b366c07a4056055a9f9ef723a9308adb130874b02371860693d9e065afd48fb74e6a2bf04826b2740120398402bf7f0e3c516da2759e62322336701511b827e05ea2a5b543dabf0cbe43c7339cba92d6a3f3ca69522855a2aa1c1c78ae870121e2b1f400f973887f40c28d60717a9803407d432e0265caa450dcfdf5972895a216cafe14837570e9eeefff4e5e7e6e5d2fbb3ec84e358ac4ed47ebfff68a41855c5544afb066bef7d467658b0d151811ae6904ed00e2eefc75ba906b944dfaef785ead64a6ec6b8ba8e9560e94df413acebdcff30c8724355bb8690e27c694f205f860db4a2f09a5b252af8b317968e30ec02dbdda00e60ac23d47f8145c59ccae7067263238fbe83bc07596d53c81cfed88e4aeaa29be10ca980625c1cb4a26b485bd39a6d2a9bf580f7fa3b4791fa5208a658fd25e539c38712e76b887b9f77099381a8316082938f2b2f6b05dbd115a48752032c896ba4a90c80682f65497834ed786c09652c506865fe68835ac55427f8f98fc5dcd48504afe61ad7b80104a2bd73ced7a2543a0e73a71d2d56b9c06b0d0fe33761232ed991035d573d8abd16bee4e9877f775bd8bbfe1cc19a9d47f18117005d2962adb5d853e767cc50362d98a8883cbf14ef3a4807970db03f9eb8450caa7896956995b9ccdbd6c52ca5130a4b2df8ee37f327245fe8171bbf4d2e7b327c0d859862c8961df029486c2ecdd541dbfa624f44a2c15d7c5861d6392e99ca4fa253deab3a9ce579b9ac06cf76166fcef9528bd1ee0b091a503998e73d2d001d520a559aea81ab2e417ab596bd679b678f05444b0a8d37130efc618f1cc26d83a7901bd274f4c69cd016770771ac3b6763723365842b372360cd1689ff7fffaf7469de59fe6eb0ebb17edfac06e70d8beafd1cf6989cf00212c8abc61b8cd4dda50ad497a11fd4c29fab6ca3fab6614d9f382d176b4ccadf068497c9f9bd44177ee1aa191da046d68cd3a8c8674180ae48d51d6ec69bef6b90f7f0681a5088dee4d70422af09a18a2057e1ac4ea98d33f1772584699a9fa4c2cc9818590f9f2e86a53d1c61d723c89c2f6184a1796648d7ecf2dee91146ef51ba5352bf0ca54ffaea299afda97aa25c07695c13f4e429166b1e5d40ab86336dcd58f29c755728313ca847687eed75739f59e86d3ae1a30dec557ab5d344b2b4dfbba19989453b75ffb1682f7a0e7cd89bb758958f3591036623c7e9de621a64ed154f95cc96edf3547eecf5f67753d803386ee5c30a5cda106f5f51e89a088dabd0e8425fd4237124b0a4197008888da23fa559ad25163e379e63b2c07aea9e70c1012b4cc98dd6faecd613fba4fa345ffcccb762295d7c9b32027f0c08ca314227d0c150d1567b1d5a121eaca6b72391fca3159e2f6071391102a65626ded0da284cb95e8cc4a514960f156ce7e6e25d89aed74df916adfdf105d85fe3e55339676305b889b3624a9ab8a73d08beaba1f080fb5784e20f0fc953e2f54078629b9621a1209f5cbfabc4b4070d775cf88a627bfcd7a35016792fdf6bb856f48132ec8863afa6ef28965f2e10c3d36e0b20fe7976db654fadb53454398ce666eeaed4d5e25fdee7f4e2115e54cf481bc66bbc9b66058b80308f365ce7ff00d78d60ea658be5e06c673fab49d0fd06eb7333429e5fedb76338b57fbb2140830774ff315c77c730dca64a0a1358796d4b01057842bd66a43cf00a6060f15b1f05b75ad9fc4ca7119db74ae520612ff7ba4910ee2eb7ceecbc439813f2bf1ebec97fcf68182fea6bc46b45d0b2127b18c67a3d7e13031a9c1c0cd23c014bd04bfe7b7a17736c1b55680848070eb61f3670c90bf1deb49656c2888fa9514496a8a9a69c1a0ae1742669b90332686d847f60c05437d4cb2e6490c3e5203e4e96b23a2990a2cb7b9c0629f5439591a69f80e323f2c79e01c9f88edc2b65384f57a325286e73ad762c2b5029c750320da43f427e580ae8dac678e543033f51f9eb02b5e91f5e5900cd2dcccce8c69edbc5648476e75957a06d88ee58ccaa511d25bfcbbb2ed4dc27a5292d52ea2d9f253fcd6ba33c47c6ebbd684432ca11e3f1ca93c23826551e0f4444a7817ee7565778aee718ffc9cfbf4703fbbe269a47190b28756619f9308e9bf25dd0f44c2d72b7973c6bbf74c1c554f0aa0bf9a983829d65b7374b3ea96fcca87316e9a84ffcf0ca804e6846ded58568c2033a4a861abee977c2e0ecc33f85ecd1efe291c80dfb5dcc4ba34f2f9900d497a2da15d8be8453504ae8a0e12357f309a569e4359b368d9497a34f7a0974b2a427e6597df19a84d41c9b65dd468b8d5ac966e41c7548165ec718ff6ef50b0e2a6ff32b33374e1c91de0489ac097a23389117b7466f71380b405b8b5b30a41d4445fcb8325722c9f5c7636fbd07575cb184a7eabb24f093baecb9a85bb78ce4c6e2974e572c1ba6bc1a78122a16ba955d26442876b339d65a3de4b1cb138ad48526c7dbdf4568403c58035545a5afb36b2b59707b341fe6abb8a8b8591e35ff2b0340bf7d7e05cf1c2b9d1bfc88f621a6f4160d020cefd866ccbf8dfc1013f9a88d774a999b1c0681db18548375f723200cf86abba602692288a11fa4821c323079f3e550d6ccb4cd9ba3cb7f1a04d54fed738c3853c74add8dc90ba40bcf63ffdbd17b3015e724f91eaf16ab955edcbaec3ef50f9d381b4de01e6a1a63ad4e05ea72c838b31df1bceae123d0e32b74c73d925b98c7a6aeecf605e944da7e0af71db14605ed11bb61abf31706f736de1297eb9e6ec1d815fde88ef17186ffd638dcf9e02a12d815bc2960572e77e2ed1e9e32d95c0b5b5e15141560fcf08fafe85065a62251c5ffcf698c3dc2984157a16ded56a7a4b9ecb713b16af5b32e9e0c27d5ba8d90e3eba1da9d84dffe4763521520efd4ad4b6162487353f7a9e14a5471060a0ecc90a2108d11cd8d4054bb8b2774cda20249f32f7194d813da89e2d156973f73b6de77cf4c81e19e30846a1324b62158087e09208d106590c41abed13987070ec5b98e8218cc726b70b4428ad984217820e0677361658dfc310e20dff536b50fbe76afde3ecce19990507f3df88c3ad62400ea3d603a10ccd1b7b32791537b1a1d2b06e9d596f71c9ccd77b06101f6e14c6ab64304eb6d207ba9db0608e159900956bc32994e5c47fd045a9fafb11655622926dcd518df5c39861d5d01c976009a17fd3c299dc17a6713c8310017bc059399d1401af4e76e66b5859dae261fadda7eafb42a836e624d1fe012a40280df7e24aec85b72e94c6ce31e55f963881bf053f77bea6a9d6ab24f4e70a8998ccd48a2eadff54eece11814e9d242f344130a52765b22d6ea8dc39de50e3ac7027393ad8a2077f4db0fd43faf6d63d423af6dc78a24bd991cfe96e5c1a2f7469913feae204b31a6c8827f6a5ccff2241dbc843762328bc5f8f3e3643e2dc86ff26b122799388f5e7163a5d280e921dddd0192e8de85e13ba92ad1a6f7a0ab2d8bcee167f894b2d14b02ec00cd5391dc320cc87163d4f22b87028f5864c7450df0e6c814949c50f368cfe54b1a351267f9c97363e611cdf8e9b277be4d4aef6d523da74904f33212e29be8721ad5e2462d99275efb7d3331fbee9544c81d794c94e175f06c98431bf4e5522348bd1c943ca3a793d0d838b2a1613f49f1ac88c2bf83675e691b914b579dfa52279ed64ebbee833862546c330175226fc647cfa9aae8ccf7198a0c8ddcadbc519a1cd3e554a3578f4f54be0cd4d9474781c49e53b8d0eacf39d2a80190c6efd14a32b8f14565a4a0bead6d0f3408e72af58434cfd62ff68756e3d763e9d37dd63584c507e3a94989f6d5ca60fca1f81ff5a5af5335e58f9c095ba646cc6d4580883127b23c51786ffa1161253cbbb72e8b96d7b34462ed2fe4c53a7017c800a0386a0e0a0dbf6d77f2c369329cf910547912b14d3e1dda6d91564bdec5cb7a3ad5ee9e5a776f68be32da8a392f8f6960227bd7e9376a03dd920058a0627788705ad10ec2dcae382232f5e6af53f1f9acc2e87e32e9aedcce70b5e1080edae74c970365fec359ab648a82a952c5ceb1b29327b692445f7854888d595391783ab80d747ddf4785577cab340d6af019cd9c744e2f64b4d2c80647aad7a74931bc559d7b28166fa924e24b243d357c53062e41f2cc45be8e089f80b3fc49e04c2dc0fd387778d2e0726cd289cac1f1ad6162d4705bd77b8756d3ba6edaa560c0e1977d6989c30293ad09c0c6f4b345535307337f87c0c62aff98ab2bc829a7ac1613fe7dcaf57fd89a5f62708b3373fb2c4eddf0c9f0752fd706b07221daa642db914daae09e5ed106a8e37281e4f9976271db810c2a2958d76142e5abc53c1b8026b3b44819e60fdb67a2942befa2e1cffd479fdeffb9a4c2dcce83f94f6f393d03e1d550680c6d02c2d03ebedaba868934978660c83c7aa2a057bc959bfeae30cc98857de42b6bae73d1bbbf553236cd02d576b102c0cd75b404fe400250424d165980d25c186c6698de805d7908788bbe02264de7a9d6f78dfddc6f94d376a52dcd2831782441c66af3ece6fdcf12bbe418ccd22261afd78bf6df07977fadfefb7fb855a07ad306a628786bbf7eb818736c1bbd3293ed62e6dc68c8957a2524ad39ec60dd267acbbe46082afc228ec71b98234da115765fe13349e46506f1c161c3a308ada9bea9dddc7ad31e8c9e52d146ed0e2673de7d100499c94e424f27fab30333387b91b8c182a40ad870f34a0bcd9b779c7cc33fc02ced0433a7b391f8575599ecaf271cb5a027c686488f9da61693129e85d6ca94191c0d749634c16f1335e0d8379528d57ae1f5c51b680e5338706ea55e2f4940742a5c11cccab717d3d4498da108ffa8b9eb9da3f459ff000ed7c3cbfaf52ad75ecf886c53efc522b178150141454b7210a73f25538539485583ba75c79ca64ef84d407865f9cab95886ac29a7b92c82bff44a07b13d3a6339af2d1a7332d95e41001fb4f12b1da5fe94322cebb8cfae0b19ae44e88053769ff6322f6b2f1a4c6242521b48405fc4541fac208197d3227b0e1bd6026854a5d21f7a74250082644cb71043df6e35d03ad0b000ca10e83dd7095d1e91a5465b6a3ad409637b3a63fd4addb284971738899880f7651722a230b810883ed3f26ff921560f0c862ddd37c1f26cc91420eb510721717f9c8fbe169b01071c08a6acf01f500a310ef67bcb26b731d09b8ec217808a44a53996fbd49019ff039cc80ea7a2d4033273d5be3ca33afced215dd0d55f4fc028fdb80b060daa42e2ed145cb91230517be3e5a33ea6333dd38451c1cdc367e5e17600780aa79272bf230c903009996ce72d7d21710ff6aa59fe5383f41bfb3576e9dbb7de9e89183d7cd92fcc3c7bdbf3d346cd8a7aae71bb9dae109ec17e5661219a0e394930112df434688136420dd05913da0182959b7"}}, &(0x7f0000005600)) syz_ublk_setup_queues(r2, r4, &(0x7f0000002b40)={0x0, 0x9a2b, 0x80, 0x1, 0x262, 0x0, r5}, &(0x7f0000004000)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1eb2, 0x10, 0x0, 0x2d0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7, 0x2, 0x2, 0x155, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9194, 0x1, 0x0, 0xac, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5613, 0x4000, 0x1, 0xd2}}], 0x4, &(0x7f0000006640)={0x2e, 0x4c, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xb2d9}, 0x0, 0x0, '\x00', {0x4, 0xc62, 0x0, &(0x7f0000005640)=@buf_512="7fa742f29806c284700415ba2bf5bd739a66dc50865ec151d177a0045c602f1deffcdb6540a481ad07f0b2bf567d85f3d954fecbc8447efe9534633f359a03357dbabe9d0792fd60f38352aa74c5d9f2d0717d4f9b3d8e8d3c1a295952f54419f732a5f2975d5f339737c8ad77473e7fdc596e391d12713724077b45c3792a9fa67f694c96085247b4e95d1e78a322c68c6152ab6849256c95f4d663ad07479974a75e6d6371d1eb3eaf448fe526bb7d7f62aa1b12a8756fadd07f2af8a97e13dbd114f555764c9a00206e4d5f394594745f30770824b79c1a61af8bd8cef3d5ff9c6fcebd3ce4b8a46c8be649d838b4243282089e7baec6d57ba199dd0361e14ff0cbddb12de44e47757973cd28679fa73298e7b9bc2be338f40912006df07f7bb3e40e7736407eb2f8fceb617d58d65f3f0501a90b1685ebfed30fc2048885ff7b6282a838d94fe8af89c9f6d94743cbb46e64dcdc3fd8883cf4c5330d4de86921e3a772a6bf9610295a5059e40aa509bf9582c5147d85002979d66288ba5696d621691b87c381a9e492e514c46f2b42b76fd0094974c665bea2493ff1acc711dffac168b14bc55ccfc0564e283488cd9be4b9502da480b911c5229c3b1ab77f0f3e2bcc72821a9edca2c5f68acd842a9a106e2940d97f7738658b693b70c4f38cbf37f7b39edfc70c91788ed96889a4717341e6ce3c4f5d4451c4268b97eb"}}, &(0x7f00000066c0)) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0xfffffffb}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 4.392204592s ago: executing program 3 (id=2474): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x1, @time={0x9f9f, 0x100}, 0x4, {0x9, 0x5}, 0x6, 0x1, 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1, 0x3}) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r3, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) close(0x3) 3.47757001s ago: executing program 2 (id=2475): r0 = dup(0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004070000000000000400000004000e1ff95000000000000002ba76bb33123751c4e3409e62751ee00ba19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac03d046837d907b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e3e8eea3fd8cf49827ca315f5b87e1ca6433a8acd715f5888b2007f0000000000000000010089937090c34410000000000000090000000000414027efc842b6d6f800005335001db43a5c000000000000000024000000000000000000e75a89faff01210cce39bf405f1e846c1242000000000000cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617da7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf9938d6df8600a62e96b7cb8e52cbdce57a79d6fce424c22001f6c3784a1975fa657d05003a32a4fd67ce446ac5430207db79240acaf091231b986e77d05d988d6edc71df48dca02113a38300c2bd2b5543ffc16695572361629d1022f722ec23812b70d72cd0010000007881bfa35b9fd6864e90ddb31f75f6324989cdc7044f563a1f74d4efe895fdbc463f747c08f40105869035000000000003000000000000000000000000000000000000080000003ddf4aa4b1c8b8a0ae6feb6737c275dc2740f742b5425f1d5819610608bbab35471cdb0500000000000000d4123f955267fe4a75c114f874e086287547d4099aeec9f15b8ee25a2a5ccf4a9b603c88e12ff25184d4e3c2f7f623559435b2c505fb7113400000f0bc440550ee91302f5a00000000000000000000000000000000e67ccc00148ac4c43021cce9f24f4b2f9492c32e7a92a557ac2b44b8f7a49789906d922b3e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd0294bea179b0433f5c899119ec0c0acef5383b5a2720caeb68f1e9c05b05d89467ded84da092dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696abaa042a7097ddefe0671f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb328790700000021e041254f06bd7f000000000000000000000000000000282ffe000000000000000431e8e3204a7d95938c5334a0dd177f1a7389ee570d95e543a27546d3770740f354df6dfdb3d1179b4b9fccd0cd5b7578802c66f5dbf22ad0bd03cbe0fecd096bcf419d35988948d1cd4c51c406040000000090a3bc3cbc08255975f3cee08dab765d8a4ef870aaae3f81ed6364837171ce5564f3cf6feba1b6745409000000000000003459263499fae97e7dcb30e4cff009e0f4f78c155c4ab19b878fcb4cc14b8d2823643a17120418f42b42ed879cb23e6d4e0d11db988d0bc46de02702d29243b72215d5563bdae8c2ccda4498687cd50f3a9058f61d52d70aabccb18d41d75788faf60ce9be97c13e4252d9d112d9ac47368829f8a29eca17de807c840293dd387eee13fdecf3d5a334350f045a22b9adb0539d44d58a00fb9e83ebf4fea36b87e2afdf63f7abf5caf2b01317a5f65f22c8bcf36b390dece1e98541ae932ec3486f74c1eea673c1647568acb17efcef24a9c3504dfa7c7eefe3dcb8d570a730a0837839f54527ce334b8173e7bf73bcd8d80ef294fde6549a0f1a23b78b41f79ea543d2b38b80d3d28c6c93901b763fc8b88794aa74facc345e28f0ad79de4df5afd52e7dfc387e4d2ca4d5caca74754987dbbd4d64e233b4a1d81a9aeb981734ca5416cacf516ca8384d85310f24d393fd48c668465546117377547d11a61bd2bd9e35fa0da5118554a1d93147b103a51baf94aeb1b6292038300423344e6add2226ba5f6724a08567ef515898f0f7dfd3fc198092af3265c5df377a66bbde4fa4a049692e06ee5022c58290bdc37eeb16f4e099e33679044ba21898f76c982c8203663f1adb7bbb42ed8d9b0bb8bd9255e342959b822fa8b3d08b29f2201dfe3a3c5c8bf8bc82f249e7eb9f8571823d730fdc78c6b3122a3fd9209dcae70c10c7b17e83dd759a52fe5c362358dbb780a52f540000000000000000000011230e1d6f9fd3315ada8ecee55fc0ec6ec0ec950c0ad006a06a162035d5729795c4a58b59f9a252723480b08ae9bd52c176380a42b972a3400b5d28b273e60000007cac9d35a991c27e23ce5217fec9ce89ea2dea8ddb383e53cdd077e7c2d73404b7450664f70225897307d8a140ba97bfc2232dccdb1dd0496c219315c02f2ef46f30add1aa13e52d67116328c3a5ee3356eadea07abe8506767771d68e760f8c623fb64865a942acc4912dcd1fa5d729cb45c15577bbb8b08a705efeaf09dd6aadeb8d61501e4fd9c9b1ac845a2138cbde58a04589888c0e528a5134e1dfa8b3f6d8a76517df589cae1019a3bc280e99fb661271357dbbd7e9c42d3fe45efaaa00"/1810], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x35}, 0x48) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000240)=r2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000003c0)={0xa, 0x4e21, 0xc, @private0, 0xfffff801}, 0x1c, 0x0}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, 0x0, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0xffffffff, 0x44, 0x48, 0xff}, 0xfffffffffffffff6) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x2710, @host}, 0x10) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x1) r9 = ioctl$KVM_CREATE_GUEST_MEMFD(r8, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_CREATE_GUEST_MEMFD(r8, 0xc040aed4, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r8, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r9}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r8, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x3) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) r11 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) (async, rerun: 500) ioctl$KVM_PRE_FAULT_MEMORY(r11, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000002c0)=0xd4, 0x4) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0xffff, 0x2) 2.847325061s ago: executing program 2 (id=2476): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf251c00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x24000040) (fail_nth: 4) 2.618491555s ago: executing program 2 (id=2477): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f00000000c0), 0x3, 0x88001) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000002c0)={0x1, @vbi={0xfffffffb, 0xca0d, 0x0, 0x33424752, [0xe, 0x1], [0x7a18, 0x10], 0x2}}) syz_usb_control_io(r0, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) 2.374324307s ago: executing program 0 (id=2478): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xf2, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYRES8=r0, @ANYRES16], 0x48) 2.206800497s ago: executing program 0 (id=2479): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x1000, 0x1) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) r2 = inotify_init() inotify_add_watch(r2, &(0x7f00000000c0)='./file0\x00', 0x5400032c) vmsplice(r1, &(0x7f0000000380)=[{&(0x7f0000000000)="9b", 0x1}], 0x1, 0x0) close(r0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x74) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r6, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) accept4$inet6(r3, 0x0, 0x0, 0x80800) 1.69026321s ago: executing program 3 (id=2480): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x1, @time={0x9f9f, 0x100}, 0x4, {0x9, 0x5}, 0x6, 0x1, 0x2}) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1, 0x3}) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040), 0x0) lchown(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x0, 0x0) close(0x3) 1.267060183s ago: executing program 0 (id=2481): syz_usb_connect$cdc_ecm(0x0, 0x0, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) syz_usb_connect$cdc_ncm(0x1, 0x74, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x4, 0x0, 0x3, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "874cda2ff6d5"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x2}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x0, 0x0, 0xb0, 0x4}}}}}}}]}}, &(0x7f00000006c0)={0x0, 0x0, 0x4, &(0x7f0000000080)={0x5, 0xf, 0x5, 0x0, [@ext_cap={0x0, 0x10, 0x2, 0x0, 0xe, 0x7, 0x6}, @wireless={0x0, 0x10, 0x1, 0x2, 0x0, 0xa, 0x7, 0x1}, @wireless={0x0, 0x10, 0x1, 0x4, 0x80, 0xf, 0xfe, 0x6, 0x8}, @ss_container_id={0x0, 0x10, 0x4, 0x5, "e5ccbdda0274ad9f417dc87614e49b18"}, @ss_cap={0x0, 0x10, 0x3, 0x0, 0x2, 0x81, 0x6, 0xa}]}, 0x1, [{0x0, 0x0}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f00000002c0)=0x1, 0x8) 524.875121ms ago: executing program 6 (id=2482): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x2000005}, 0x1c) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034888a80900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000000000000000000000000112006558"], 0xfdef) 192.317568ms ago: executing program 6 (id=2483): r0 = socket$key(0xf, 0x3, 0x2) ioctl$XFS_IOC_SCRUB_METADATA(0xffffffffffffffff, 0xc040583c, &(0x7f0000000000)={0x4, 0x102, 0x3, 0x2, 0x8}) sendmsg$key(r0, &(0x7f0000000080)={0x2, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020a000002"], 0x10}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc01c586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x80000, &(0x7f0000000100)={@_ha_fsid={[0x7fd, 0x5]}, {0xffff, 0x7f, 0x1000}}, 0x6, &(0x7f0000000140), &(0x7f00000001c0)}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x8) 0s ago: executing program 6 (id=2484): bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x10040) syz_emit_ethernet(0x46, &(0x7f0000000600)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x9, 0xc2, 0x5, 0x0, 0x6, {[@timestamp={0x8, 0xa, 0x654, 0x7}, @sack_perm={0x4, 0x2}, @window={0x3, 0x3, 0x1}]}}}}}}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) close(r1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0xa}, 0x9}]}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r1, &(0x7f0000000400)={0x0, 0xe000, &(0x7f0000000200)=[{&(0x7f00000002c0)="85", 0x890c}], 0x20, &(0x7f00000000c0)=[@sndinfo={0x1c, 0x84, 0x2, {0x6, 0x4, 0x29, 0x200000e, r3}}], 0x1c, 0x2400e044}, 0x6) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) kernel console output (not intermixed with test programs): g 6 interface 2 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 515.866192][ T9] usb 7-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 515.866223][ T9] usb 7-1: Product: syz [ 515.866239][ T9] usb 7-1: Manufacturer: syz [ 515.866298][ T9] usb 7-1: SerialNumber: syz [ 515.906368][ T9] hso 7-1:6.2: Failed to find INT IN ep [ 516.250152][ T5710] usb 7-1: USB disconnect, device number 18 [ 516.638717][T12469] bridge1: entered promiscuous mode [ 516.692790][T12472] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.693290][T12472] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.743755][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 516.813776][T11344] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 516.894354][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 516.896391][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 516.897456][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 516.897483][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 516.897520][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.900491][ T9] usb 4-1: config 0 descriptor?? [ 516.907218][ T9] hub 4-1:0.0: USB hub found [ 516.965981][T11344] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 516.967264][T11344] usb 3-1: config 0 has an invalid descriptor of length 162, skipping remainder of the config [ 516.967288][T11344] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 516.969407][T11344] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 516.969430][T11344] usb 3-1: SerialNumber: syz [ 516.975743][T11344] usb 3-1: config 0 descriptor?? [ 517.049109][T12476] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 517.139922][ T9] hub 4-1:0.0: 1 port detected [ 517.187173][T12467] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2213'. [ 517.297842][T11344] usb 3-1: USB disconnect, device number 11 [ 518.098086][T12494] netlink: 'syz.6.2222': attribute type 1 has an invalid length. [ 518.098157][T12494] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.303811][ T5677] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 518.476309][ T5677] usb 3-1: unable to get BOS descriptor or descriptor too short [ 518.484602][ T5677] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 518.498639][ T5677] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 518.520480][ T5677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.520550][ T5677] usb 3-1: Product: syz [ 518.520579][ T5677] usb 3-1: Manufacturer: syz [ 518.520598][ T5677] usb 3-1: SerialNumber: syz [ 518.996475][T12506] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 519.176475][T12507] bridge1: entered promiscuous mode [ 519.310698][T12510] FAULT_INJECTION: forcing a failure. [ 519.310698][T12510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 519.326870][T12510] CPU: 1 UID: 0 PID: 12510 Comm: syz.6.2226 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.326904][T12510] Tainted: [L]=SOFTLOCKUP [ 519.326911][T12510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.326922][T12510] Call Trace: [ 519.326931][T12510] [ 519.326940][T12510] dump_stack_lvl+0xe8/0x150 [ 519.326975][T12510] should_fail_ex+0x410/0x560 [ 519.327005][T12510] _copy_to_user+0x31/0xb0 [ 519.327025][T12510] simple_read_from_buffer+0xe1/0x170 [ 519.327053][T12510] proc_fail_nth_read+0x1bb/0x230 [ 519.327076][T12510] ? common_file_perm+0x20e/0x2b0 [ 519.327104][T12510] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 519.327131][T12510] ? rw_verify_area+0x24a/0x4c0 [ 519.327155][T12510] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 519.327178][T12510] vfs_read+0x213/0xa80 [ 519.327206][T12510] ? __pfx___mutex_lock+0x10/0x10 [ 519.327230][T12510] ? __pfx_vfs_read+0x10/0x10 [ 519.327263][T12510] ? __fget_files+0x2a/0x420 [ 519.327287][T12510] ? __fget_files+0x3a2/0x420 [ 519.327306][T12510] ? __fget_files+0x2a/0x420 [ 519.327335][T12510] ksys_read+0x150/0x270 [ 519.327361][T12510] ? __pfx_ksys_read+0x10/0x10 [ 519.327388][T12510] ? asm_int80_emulation+0x1a/0x20 [ 519.327411][T12510] do_int80_emulation+0x198/0x500 [ 519.327435][T12510] ? trace_irq_disable+0x3b/0x140 [ 519.327452][T12510] ? asm_int80_emulation+0x1a/0x20 [ 519.327469][T12510] ? clear_bhb_loop+0x70/0xc0 [ 519.327486][T12510] ? clear_bhb_loop+0x70/0xc0 [ 519.327507][T12510] asm_int80_emulation+0x1a/0x20 [ 519.327525][T12510] RIP: 0023:0xf71a75ab [ 519.327543][T12510] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 519.327558][T12510] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 519.327579][T12510] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f545d5d0 [ 519.327592][T12510] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 519.327603][T12510] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 519.327614][T12510] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 519.327625][T12510] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 519.327653][T12510] [ 519.579756][ T5677] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 519.588520][ T5677] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 519.602466][ T5677] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 519.667610][ T5677] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 519.684149][ T5677] usb 3-1: USB disconnect, device number 12 [ 519.965336][ T9] usb 4-1: USB disconnect, device number 2 [ 520.016858][ T5711] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 520.042125][T12526] netlink: 'syz.3.2233': attribute type 1 has an invalid length. [ 520.104303][T12526] 8021q: adding VLAN 0 to HW filter on device bond11 [ 520.171664][T12529] bond11: (slave veth21): Enslaving as an active interface with a down link [ 520.175549][T12526] binder: BINDER_SET_CONTEXT_MGR already set [ 520.175566][T12526] binder: 12525:12526 ioctl 4018620d 80000280 returned -16 [ 520.181855][ T5711] usb 7-1: Using ep0 maxpacket: 16 [ 520.188639][ T5711] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 520.211907][ T5711] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 520.231615][ T5711] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.231706][ T5711] usb 7-1: Product: syz [ 520.231740][ T5711] usb 7-1: Manufacturer: syz [ 520.231760][ T5711] usb 7-1: SerialNumber: syz [ 520.260598][ T5711] usb 7-1: config 0 descriptor?? [ 522.872512][ T5677] usb 7-1: USB disconnect, device number 19 [ 523.177004][T12558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.186074][T12558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.214998][T12574] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2247'. [ 524.288966][T12576] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 524.312735][T12576] tipc: Enabling of bearer rejected, already enabled [ 525.056067][ T9] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 525.210369][ T9] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 525.216208][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.216258][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.257367][ T9] usb 7-1: config 0 descriptor?? [ 525.316406][T11344] wiimote 0005:057E:0306.0020: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 525.360553][T11344] wiimote 0005:057E:0306.0020: New device registered [ 525.525465][ T9] usbhid 7-1:0.0: can't add hid device: -71 [ 525.525611][ T9] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 525.531890][ T9] usb 7-1: USB disconnect, device number 20 [ 525.555367][ T1834] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 525.703679][ T1834] usb 3-1: Using ep0 maxpacket: 8 [ 525.704543][ T1834] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 525.705199][ T1834] usb 3-1: config 0 has no interfaces? [ 525.707580][ T1834] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.707603][ T1834] usb 3-1: Product: syz [ 525.707616][ T1834] usb 3-1: Manufacturer: syz [ 525.707630][ T1834] usb 3-1: SerialNumber: syz [ 525.745073][ T1834] usb 3-1: config 0 descriptor?? [ 525.766189][T12594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.769734][T12594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.957184][T12601] wiimote 0005:057E:0306.0020: Unhandled report 32 size 1 [ 526.027768][ T1834] usb 3-1: USB disconnect, device number 13 [ 526.033304][T12600] wiimote 0005:057E:0306.0020: Device removed [ 526.054081][ T5711] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 526.224077][T12610] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2257'. [ 526.231251][T12610] ipvlan2: entered allmulticast mode [ 526.237279][ T5711] usb 7-1: New USB device found, idVendor=0958, idProduct=3333, bcdDevice= 0.40 [ 526.253045][ T5711] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.253145][ T5711] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.271572][ T5711] usb 7-1: config 0 descriptor?? [ 526.282471][T12611] FAULT_INJECTION: forcing a failure. [ 526.282471][T12611] name failslab, interval 1, probability 0, space 0, times 0 [ 526.283447][T12611] CPU: 1 UID: 0 PID: 12611 Comm: syz.4.2257 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.283478][T12611] Tainted: [L]=SOFTLOCKUP [ 526.283486][T12611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 526.283498][T12611] Call Trace: [ 526.283507][T12611] [ 526.283515][T12611] dump_stack_lvl+0xe8/0x150 [ 526.283551][T12611] should_fail_ex+0x410/0x560 [ 526.283581][T12611] should_failslab+0xa8/0x100 [ 526.283601][T12611] ? skb_clone+0x212/0x3a0 [ 526.283620][T12611] kmem_cache_alloc_noprof+0xa1/0x600 [ 526.283656][T12611] ? skb_clone+0x212/0x3a0 [ 526.283673][T12611] ? run_filter+0x23/0x270 [ 526.283697][T12611] skb_clone+0x212/0x3a0 [ 526.283714][T12611] ? packet_rcv+0x563/0x16f0 [ 526.283737][T12611] packet_rcv+0x65d/0x16f0 [ 526.283767][T12611] __netif_receive_skb_core+0x270b/0x30c0 [ 526.283796][T12611] ? __lock_acquire+0x6df/0x2e50 [ 526.283822][T12611] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 526.283842][T12611] ? __kasan_slab_alloc+0x6c/0x80 [ 526.283861][T12611] ? kmem_cache_alloc_noprof+0x2b9/0x600 [ 526.283884][T12611] ? __build_skb+0x62/0x440 [ 526.283905][T12611] ? build_skb+0x23/0x180 [ 526.283925][T12611] ? tun_get_user+0x1c6d/0x44d0 [ 526.283947][T12611] ? tun_chr_write_iter+0x113/0x200 [ 526.283968][T12611] ? vfs_write+0x612/0xba0 [ 526.283989][T12611] ? ksys_write+0x150/0x270 [ 526.284009][T12611] ? do_int80_emulation+0x198/0x500 [ 526.284032][T12611] ? asm_int80_emulation+0x1a/0x20 [ 526.284067][T12611] ? netif_receive_skb+0x102/0xbf0 [ 526.284086][T12611] ? netif_receive_skb+0x102/0xbf0 [ 526.284107][T12611] netif_receive_skb+0x1fe/0xbf0 [ 526.284134][T12611] ? __pfx_netif_receive_skb+0x10/0x10 [ 526.284160][T12611] ? rcu_is_watching+0x16/0xb0 [ 526.284181][T12611] ? tun_rx_batched+0x185/0x790 [ 526.284205][T12611] tun_rx_batched+0x1de/0x790 [ 526.284233][T12611] ? __pfx_tun_rx_batched+0x10/0x10 [ 526.284256][T12611] ? lock_acquire+0x115/0x350 [ 526.284281][T12611] ? tun_get_user+0x23ba/0x44d0 [ 526.284303][T12611] ? __local_bh_enable_ip+0xd6/0x140 [ 526.284324][T12611] ? tun_get_user+0x27b0/0x44d0 [ 526.284348][T12611] tun_get_user+0x2be0/0x44d0 [ 526.284384][T12611] ? tun_get_user+0x27b0/0x44d0 [ 526.284412][T12611] ? aa_file_perm+0x4ed/0x15f0 [ 526.284432][T12611] ? __pfx_tun_get_user+0x10/0x10 [ 526.284456][T12611] ? __lock_acquire+0x6df/0x2e50 [ 526.284485][T12611] ? ref_tracker_alloc+0x341/0x4b0 [ 526.284509][T12611] ? lock_acquire+0x115/0x350 [ 526.284527][T12611] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 526.284555][T12611] ? lock_acquire+0x115/0x350 [ 526.284575][T12611] ? tun_get+0x1c/0x2f0 [ 526.284606][T12611] ? tun_get+0x1c/0x2f0 [ 526.284631][T12611] ? tun_get+0x1c/0x2f0 [ 526.284670][T12611] tun_chr_write_iter+0x113/0x200 [ 526.284698][T12611] vfs_write+0x612/0xba0 [ 526.284734][T12611] ? __pfx_vfs_write+0x10/0x10 [ 526.284774][T12611] ? __fget_files+0x2a/0x420 [ 526.284810][T12611] ksys_write+0x150/0x270 [ 526.284843][T12611] ? __pfx_ksys_write+0x10/0x10 [ 526.284876][T12611] ? asm_int80_emulation+0x1a/0x20 [ 526.284904][T12611] do_int80_emulation+0x198/0x500 [ 526.284933][T12611] ? trace_irq_disable+0x3b/0x140 [ 526.284953][T12611] ? asm_int80_emulation+0x1a/0x20 [ 526.284973][T12611] ? clear_bhb_loop+0x70/0xc0 [ 526.284994][T12611] ? clear_bhb_loop+0x70/0xc0 [ 526.285020][T12611] asm_int80_emulation+0x1a/0x20 [ 526.285041][T12611] RIP: 0023:0xf71975ab [ 526.285062][T12611] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 526.285080][T12611] RSP: 002b:00000000f543544c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 526.285105][T12611] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080002100 [ 526.285120][T12611] RDX: 000000000000004a RSI: 0000000000000000 RDI: 0000000000000000 [ 526.285133][T12611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 526.285145][T12611] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 526.285158][T12611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 526.285190][T12611] [ 526.465525][ T965] wiimote 0005:057E:0306.0020: detected device: Nintendo Wii Remote (Gen 1) [ 526.671641][ T965] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0020/input/input57 [ 526.843264][ T965] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0020/input/input58 [ 526.914287][ T965] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0020/input/input56 [ 527.808557][ T5711] usbhid 7-1:0.0: can't add hid device: -71 [ 527.808798][ T5711] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 527.836508][ T5711] usb 7-1: USB disconnect, device number 21 [ 527.941847][T12619] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 528.057604][T12621] hub 9-0:1.0: USB hub found [ 528.071529][T12621] hub 9-0:1.0: 1 port detected [ 528.214282][ T5711] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 528.374389][ T5711] usb 7-1: Using ep0 maxpacket: 32 [ 528.380771][ T5711] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 528.392598][ T5711] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 528.404038][ T5711] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 528.404122][ T5711] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.437327][ T5711] usb 7-1: config 0 descriptor?? [ 528.457035][ T5711] hub 7-1:0.0: USB hub found [ 528.637845][T12637] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 528.661583][ T5711] hub 7-1:0.0: 1 port detected [ 528.675958][T12615] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 529.355636][T12636] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2263'. [ 529.988135][T12656] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 530.006438][T12656] tipc: Enabling of bearer rejected, already enabled [ 530.112657][T12660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.128408][T12660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.216113][T12663] FAULT_INJECTION: forcing a failure. [ 530.216113][T12663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 530.216213][T12663] CPU: 1 UID: 0 PID: 12663 Comm: syz.3.2271 Tainted: G L syzkaller #0 PREEMPT(full) [ 530.216240][T12663] Tainted: [L]=SOFTLOCKUP [ 530.216247][T12663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 530.216259][T12663] Call Trace: [ 530.216267][T12663] [ 530.216276][T12663] dump_stack_lvl+0xe8/0x150 [ 530.216309][T12663] should_fail_ex+0x410/0x560 [ 530.216344][T12663] _copy_from_iter+0x1d3/0x1660 [ 530.216370][T12663] ? __alloc_skb+0x27a/0x7a0 [ 530.216397][T12663] ? __alloc_skb+0x27a/0x7a0 [ 530.216424][T12663] ? __alloc_skb+0x27a/0x7a0 [ 530.216448][T12663] ? __pfx__copy_from_iter+0x10/0x10 [ 530.216472][T12663] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 530.216497][T12663] ? __alloc_skb+0x27a/0x7a0 [ 530.216519][T12663] ? __alloc_skb+0x27a/0x7a0 [ 530.216548][T12663] ? netlink_sendmsg+0x650/0xb40 [ 530.216569][T12663] ? skb_put+0x112/0x210 [ 530.216597][T12663] netlink_sendmsg+0x6c0/0xb40 [ 530.216626][T12663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 530.216654][T12663] ? apparmor_socket_sendmsg+0x98/0x360 [ 530.216682][T12663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 530.216702][T12663] sock_sendmsg_nosec+0x13a/0x180 [ 530.216736][T12663] ____sys_sendmsg+0x54e/0x850 [ 530.216760][T12663] ? __pfx_____sys_sendmsg+0x10/0x10 [ 530.216793][T12663] ___sys_sendmsg+0x2a5/0x360 [ 530.216810][T12663] ? __lock_acquire+0x6df/0x2e50 [ 530.216833][T12663] ? __pfx____sys_sendmsg+0x10/0x10 [ 530.216851][T12663] ? get_pid_task+0x20/0x1f0 [ 530.216869][T12663] ? get_pid_task+0x20/0x1f0 [ 530.216885][T12663] ? get_pid_task+0x20/0x1f0 [ 530.216929][T12663] ? __fget_files+0x2a/0x420 [ 530.216951][T12663] ? __fget_files+0x3a2/0x420 [ 530.216983][T12663] __sys_sendmsg+0x177/0x240 [ 530.217004][T12663] ? __pfx___sys_sendmsg+0x10/0x10 [ 530.217039][T12663] __do_fast_syscall_32+0x27a/0x6a0 [ 530.217066][T12663] ? do_fast_syscall_32+0x33/0x70 [ 530.217089][T12663] ? asm_int80_emulation+0x1a/0x20 [ 530.217108][T12663] ? do_int80_emulation+0x299/0x500 [ 530.217136][T12663] do_fast_syscall_32+0x33/0x70 [ 530.217161][T12663] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 530.217183][T12663] RIP: 0023:0xf6fdf0ec [ 530.217201][T12663] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 530.217217][T12663] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 530.217239][T12663] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800006c0 [ 530.217253][T12663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 530.217265][T12663] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 530.217277][T12663] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 530.217289][T12663] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 530.217317][T12663] [ 530.361292][T12660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.361881][T12660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.656042][ T5711] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 530.826854][ T5711] usb 4-1: unable to get BOS descriptor or descriptor too short [ 530.826926][ T5711] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 530.828338][ T5711] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 530.830875][ T5711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.830897][ T5711] usb 4-1: Product: syz [ 530.830933][ T5711] usb 4-1: Manufacturer: syz [ 530.830948][ T5711] usb 4-1: SerialNumber: syz [ 530.919010][T12670] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 531.066056][T12674] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2275'. [ 531.070951][T12674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.071960][T12674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.129781][T12676] netlink: 'syz.4.2275': attribute type 29 has an invalid length. [ 531.144740][T12676] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2275'. [ 531.210738][T12667] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 531.285947][ T5711] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 531.294408][ T5711] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 531.309840][ T5711] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 531.437038][ T5711] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 531.450326][ T5711] usb 4-1: USB disconnect, device number 4 [ 531.789783][ T5677] usb 7-1: reset high-speed USB device number 22 using dummy_hcd [ 531.801367][ T5677] usb 7-1: device reset changed ep0 maxpacket size! [ 531.805459][ T5677] usb 7-1: USB disconnect, device number 22 [ 531.948026][T12692] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 531.965073][T12693] misc userio: Can't change port proto on an already running userio instance [ 531.975668][T12692] tipc: Enabled bearer , priority 0 [ 531.986088][T12692] tipc: Resetting bearer [ 532.007347][T12690] tipc: Disabling bearer [ 532.092681][T12695] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 532.134791][ T5677] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 532.306301][ T5677] usb 7-1: unable to get BOS descriptor or descriptor too short [ 532.306367][ T5677] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 532.308108][ T5677] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 532.311419][ T5677] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.311443][ T5677] usb 7-1: Product: syz [ 532.311456][ T5677] usb 7-1: Manufacturer: syz [ 532.311469][ T5677] usb 7-1: SerialNumber: syz [ 532.434026][ T1834] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 532.451491][T12699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.451956][T12699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.587705][ T1834] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 532.590727][ T1834] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 532.590776][ T1834] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.598680][ T1834] usb 4-1: config 0 descriptor?? [ 532.633214][T12701] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 532.823047][ T1834] usbhid 4-1:0.0: can't add hid device: -71 [ 532.823204][ T1834] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 532.830343][ T1834] usb 4-1: USB disconnect, device number 5 [ 532.899754][ T5677] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 532.908100][ T5677] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 532.920376][ T5677] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 532.959714][ T5677] snd-usb-audio 7-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 532.971047][ T5677] usb 7-1: USB disconnect, device number 23 [ 533.274845][ T5710] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 533.454335][ T5710] usb 4-1: New USB device found, idVendor=0458, idProduct=3303, bcdDevice= 0.40 [ 533.457192][ T5710] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 533.457299][ T5710] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.466841][ T5710] usb 4-1: config 0 descriptor?? [ 533.883678][ T5677] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 534.055031][ T5677] usb 7-1: Using ep0 maxpacket: 8 [ 534.081935][T12709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.082666][T12709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.088388][T12709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.089340][T12709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.282155][ T5677] usb 7-1: unable to get BOS descriptor or descriptor too short [ 534.282274][ T5677] usb 7-1: New USB device found, idVendor=413c, idProduct=8137, bcdDevice=e3.82 [ 534.286347][ T5677] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 534.286385][ T5677] usb 7-1: can't read configurations, error -71 [ 534.435933][T12725] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2295'. [ 534.503406][T12727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2296'. [ 534.505591][T12727] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2296'. [ 534.557663][T12729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.558136][T12729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.777692][T12731] FAULT_INJECTION: forcing a failure. [ 534.777692][T12731] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 534.777756][T12731] CPU: 0 UID: 0 PID: 12731 Comm: syz.0.2298 Tainted: G L syzkaller #0 PREEMPT(full) [ 534.777784][T12731] Tainted: [L]=SOFTLOCKUP [ 534.777792][T12731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 534.777802][T12731] Call Trace: [ 534.777810][T12731] [ 534.777819][T12731] dump_stack_lvl+0xe8/0x150 [ 534.777851][T12731] should_fail_ex+0x410/0x560 [ 534.777882][T12731] _copy_from_iter+0x1d3/0x1660 [ 534.777908][T12731] ? __alloc_skb+0x27a/0x7a0 [ 534.777936][T12731] ? __alloc_skb+0x27a/0x7a0 [ 534.777962][T12731] ? __alloc_skb+0x27a/0x7a0 [ 534.777987][T12731] ? __pfx__copy_from_iter+0x10/0x10 [ 534.778010][T12731] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 534.778036][T12731] ? __alloc_skb+0x27a/0x7a0 [ 534.778058][T12731] ? __alloc_skb+0x27a/0x7a0 [ 534.778088][T12731] ? netlink_sendmsg+0x650/0xb40 [ 534.778108][T12731] ? skb_put+0x112/0x210 [ 534.778136][T12731] netlink_sendmsg+0x6c0/0xb40 [ 534.778165][T12731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 534.778194][T12731] ? apparmor_socket_sendmsg+0x18b/0x360 [ 534.778222][T12731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 534.778251][T12731] sock_sendmsg_nosec+0x13a/0x180 [ 534.778277][T12731] ____sys_sendmsg+0x54e/0x850 [ 534.778300][T12731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 534.778333][T12731] ___sys_sendmsg+0x2a5/0x360 [ 534.778350][T12731] ? __lock_acquire+0x6df/0x2e50 [ 534.778374][T12731] ? __pfx____sys_sendmsg+0x10/0x10 [ 534.778391][T12731] ? get_pid_task+0x20/0x1f0 [ 534.778410][T12731] ? get_pid_task+0x20/0x1f0 [ 534.778426][T12731] ? get_pid_task+0x20/0x1f0 [ 534.778470][T12731] ? __fget_files+0x2a/0x420 [ 534.778492][T12731] ? __fget_files+0x3a2/0x420 [ 534.778524][T12731] __sys_sendmsg+0x177/0x240 [ 534.778545][T12731] ? __pfx___sys_sendmsg+0x10/0x10 [ 534.778584][T12731] __do_fast_syscall_32+0x27a/0x6a0 [ 534.778610][T12731] ? do_fast_syscall_32+0x33/0x70 [ 534.778634][T12731] ? asm_int80_emulation+0x1a/0x20 [ 534.778652][T12731] ? do_int80_emulation+0x299/0x500 [ 534.778675][T12731] ? trace_irq_disable+0x3b/0x140 [ 534.778696][T12731] do_fast_syscall_32+0x33/0x70 [ 534.778720][T12731] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 534.778742][T12731] RIP: 0023:0xf703f0ec [ 534.778760][T12731] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 534.778776][T12731] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 534.778798][T12731] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 534.778811][T12731] RDX: 000000003aa711f2 RSI: 0000000000000000 RDI: 0000000000000000 [ 534.778824][T12731] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 534.778835][T12731] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 534.778847][T12731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 534.778874][T12731] [ 535.017779][T12735] fuse: Unknown parameter '0x0000000000000005' [ 535.083097][T12735] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2300'. [ 535.275037][ T5710] usbhid 4-1:0.0: can't add hid device: -71 [ 535.275241][ T5710] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 535.306905][ T5710] usb 4-1: USB disconnect, device number 6 [ 535.469507][T12750] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 535.652364][T12753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.661916][T12753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.682032][T12753] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2307'. [ 535.691378][T12753] netlink: 93 bytes leftover after parsing attributes in process `syz.4.2307'. [ 535.700647][T12753] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2307'. [ 535.700713][T12753] netlink: 39 bytes leftover after parsing attributes in process `syz.4.2307'. [ 535.700729][T12753] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2307'. [ 535.719883][ T5710] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 535.904756][ T5710] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 535.916509][ T5710] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 535.924992][ T5710] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 535.934193][ T5710] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 535.934222][ T5710] usb 4-1: config 220 has no interface number 2 [ 535.934388][ T5710] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 535.934418][ T5710] usb 4-1: config 220 interface 0 has no altsetting 0 [ 535.934466][ T5710] usb 4-1: config 220 interface 76 has no altsetting 0 [ 535.934485][ T5710] usb 4-1: config 220 interface 1 has no altsetting 0 [ 535.988875][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.997120][ T5710] usb 4-1: Product: syz [ 535.997143][ T5710] usb 4-1: Manufacturer: syz [ 535.997159][ T5710] usb 4-1: SerialNumber: syz [ 536.248173][ T5710] usb 4-1: selecting invalid altsetting 0 [ 536.271048][ T5710] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 536.271126][ T5710] uvcvideo 4-1:220.0: No valid video chain found. [ 536.315547][ T5710] usb 4-1: selecting invalid altsetting 0 [ 536.315611][ T5710] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 536.337050][ T5710] usb 4-1: USB disconnect, device number 7 [ 536.430277][T12761] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 536.433802][ T5623] Bluetooth: hci5: unexpected cc 0x0c05 length: 4 > 1 [ 536.470161][T12764] FAULT_INJECTION: forcing a failure. [ 536.470161][T12764] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.470234][T12764] CPU: 0 UID: 0 PID: 12764 Comm: syz.4.2311 Tainted: G L syzkaller #0 PREEMPT(full) [ 536.470265][T12764] Tainted: [L]=SOFTLOCKUP [ 536.470272][T12764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 536.470285][T12764] Call Trace: [ 536.470293][T12764] [ 536.470301][T12764] dump_stack_lvl+0xe8/0x150 [ 536.470333][T12764] should_fail_ex+0x410/0x560 [ 536.470364][T12764] _copy_from_user+0x2d/0xb0 [ 536.470384][T12764] get_compat_msghdr+0xb3/0x4c0 [ 536.470410][T12764] ? __pfx_get_compat_msghdr+0x10/0x10 [ 536.470443][T12764] ___sys_sendmsg+0x201/0x360 [ 536.470463][T12764] ? __lock_acquire+0x6df/0x2e50 [ 536.470486][T12764] ? __pfx____sys_sendmsg+0x10/0x10 [ 536.470504][T12764] ? get_pid_task+0x20/0x1f0 [ 536.470522][T12764] ? get_pid_task+0x20/0x1f0 [ 536.470537][T12764] ? get_pid_task+0x20/0x1f0 [ 536.470589][T12764] ? __fget_files+0x2a/0x420 [ 536.470612][T12764] ? __fget_files+0x3a2/0x420 [ 536.470644][T12764] __sys_sendmsg+0x177/0x240 [ 536.470665][T12764] ? __pfx___sys_sendmsg+0x10/0x10 [ 536.470700][T12764] __do_fast_syscall_32+0x27a/0x6a0 [ 536.470727][T12764] ? do_fast_syscall_32+0x33/0x70 [ 536.470751][T12764] ? asm_int80_emulation+0x1a/0x20 [ 536.470769][T12764] ? do_int80_emulation+0x299/0x500 [ 536.470792][T12764] ? trace_irq_disable+0x3b/0x140 [ 536.470814][T12764] do_fast_syscall_32+0x33/0x70 [ 536.470839][T12764] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 536.470861][T12764] RIP: 0023:0xf7f940ec [ 536.470879][T12764] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 536.470895][T12764] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 536.470924][T12764] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 536.470938][T12764] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 536.470950][T12764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 536.470962][T12764] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 536.470974][T12764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 536.471001][T12764] [ 537.193500][T12784] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 537.212539][T12784] syzkaller0: entered promiscuous mode [ 537.219700][T12784] syzkaller0: entered allmulticast mode [ 538.206175][T12797] FAULT_INJECTION: forcing a failure. [ 538.206175][T12797] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.206249][T12797] CPU: 0 UID: 0 PID: 12797 Comm: syz.3.2320 Tainted: G L syzkaller #0 PREEMPT(full) [ 538.206280][T12797] Tainted: [L]=SOFTLOCKUP [ 538.206287][T12797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 538.206297][T12797] Call Trace: [ 538.206305][T12797] [ 538.206314][T12797] dump_stack_lvl+0xe8/0x150 [ 538.206346][T12797] should_fail_ex+0x410/0x560 [ 538.206377][T12797] _copy_from_iter+0x1d3/0x1660 [ 538.206403][T12797] ? __alloc_skb+0x27a/0x7a0 [ 538.206430][T12797] ? __alloc_skb+0x27a/0x7a0 [ 538.206456][T12797] ? __alloc_skb+0x27a/0x7a0 [ 538.206481][T12797] ? __pfx__copy_from_iter+0x10/0x10 [ 538.206504][T12797] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 538.206530][T12797] ? __alloc_skb+0x27a/0x7a0 [ 538.206552][T12797] ? __alloc_skb+0x27a/0x7a0 [ 538.206581][T12797] ? netlink_sendmsg+0x650/0xb40 [ 538.206607][T12797] ? skb_put+0x112/0x210 [ 538.206635][T12797] netlink_sendmsg+0x6c0/0xb40 [ 538.206673][T12797] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.206701][T12797] ? apparmor_socket_sendmsg+0x98/0x360 [ 538.206729][T12797] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.206748][T12797] sock_sendmsg_nosec+0x13a/0x180 [ 538.206774][T12797] ____sys_sendmsg+0x54e/0x850 [ 538.206809][T12797] ? __pfx_____sys_sendmsg+0x10/0x10 [ 538.206842][T12797] ___sys_sendmsg+0x2a5/0x360 [ 538.206859][T12797] ? __lock_acquire+0x6df/0x2e50 [ 538.206883][T12797] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.206900][T12797] ? get_pid_task+0x20/0x1f0 [ 538.206918][T12797] ? get_pid_task+0x20/0x1f0 [ 538.206933][T12797] ? get_pid_task+0x20/0x1f0 [ 538.206978][T12797] ? __fget_files+0x2a/0x420 [ 538.207000][T12797] ? __fget_files+0x3a2/0x420 [ 538.207033][T12797] __sys_sendmsg+0x177/0x240 [ 538.207053][T12797] ? __pfx___sys_sendmsg+0x10/0x10 [ 538.207089][T12797] __do_fast_syscall_32+0x27a/0x6a0 [ 538.207116][T12797] ? do_fast_syscall_32+0x33/0x70 [ 538.207140][T12797] ? asm_int80_emulation+0x1a/0x20 [ 538.207158][T12797] ? do_int80_emulation+0x299/0x500 [ 538.207181][T12797] ? trace_irq_disable+0x3b/0x140 [ 538.207203][T12797] do_fast_syscall_32+0x33/0x70 [ 538.207228][T12797] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 538.207250][T12797] RIP: 0023:0xf6fdf0ec [ 538.207267][T12797] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 538.207284][T12797] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 538.207307][T12797] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 538.207321][T12797] RDX: 00000000000000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 538.207333][T12797] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 538.207345][T12797] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 538.207357][T12797] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 538.207384][T12797] [ 538.684701][T12803] netlink: 'syz.2.2323': attribute type 1 has an invalid length. [ 538.782444][T12803] 8021q: adding VLAN 0 to HW filter on device bond11 [ 538.888692][T12808] bond11: (slave veth17): Enslaving as an active interface with a down link [ 539.177699][T12733] syz.0.2299 (12733): drop_caches: 3 [ 539.489238][T12823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2329'. [ 539.560986][T12823] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 539.568982][T12823] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 539.582595][T12823] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 539.582684][T12823] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 539.922693][T12830] netlink: 'syz.4.2330': attribute type 1 has an invalid length. [ 540.002641][T12830] 8021q: adding VLAN 0 to HW filter on device bond10 [ 540.153434][T12833] bond10: (slave veth11): Enslaving as an active interface with a down link [ 542.360753][T12862] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2339'. [ 542.806226][T12867] syzkaller0: entered promiscuous mode [ 542.806274][T12867] syzkaller0: entered allmulticast mode [ 542.869823][T12867] tipc: Enabled bearer , priority 0 [ 542.916484][T12867] FAULT_INJECTION: forcing a failure. [ 542.916484][T12867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 542.920298][T12867] CPU: 0 UID: 0 PID: 12867 Comm: syz.2.2341 Tainted: G L syzkaller #0 PREEMPT(full) [ 542.920332][T12867] Tainted: [L]=SOFTLOCKUP [ 542.920340][T12867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 542.920351][T12867] Call Trace: [ 542.920359][T12867] [ 542.920368][T12867] dump_stack_lvl+0xe8/0x150 [ 542.920402][T12867] should_fail_ex+0x410/0x560 [ 542.920433][T12867] _copy_from_user+0x2d/0xb0 [ 542.920453][T12867] sock_do_ioctl+0x1ed/0x320 [ 542.920479][T12867] ? __pfx_sock_do_ioctl+0x10/0x10 [ 542.920514][T12867] ? unix_ioctl+0x206/0x780 [ 542.920612][T12867] compat_sock_ioctl+0xbb9/0xcc0 [ 542.920639][T12867] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 542.920663][T12867] ? __fget_files+0x3a2/0x420 [ 542.920687][T12867] ? __fget_files+0x2a/0x420 [ 542.920713][T12867] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 542.920741][T12867] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 542.920764][T12867] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 542.920783][T12867] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 542.920810][T12867] ? __fget_files+0x3a2/0x420 [ 542.920839][T12867] ? fput+0xa0/0xd0 [ 542.920860][T12867] ? ksys_write+0x242/0x270 [ 542.920896][T12867] __do_fast_syscall_32+0x27a/0x6a0 [ 542.920923][T12867] ? do_fast_syscall_32+0x33/0x70 [ 542.920947][T12867] ? asm_int80_emulation+0x1a/0x20 [ 542.920965][T12867] ? do_int80_emulation+0x299/0x500 [ 542.920993][T12867] do_fast_syscall_32+0x33/0x70 [ 542.921018][T12867] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 542.921041][T12867] RIP: 0023:0xf708f0ec [ 542.921060][T12867] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 542.921076][T12867] RSP: 002b:00000000f547d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 542.921099][T12867] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000008922 [ 542.921113][T12867] RDX: 0000000080002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 542.921126][T12867] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 542.921138][T12867] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 542.921150][T12867] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 542.921178][T12867] [ 543.181847][T12866] tipc: Resetting bearer [ 543.288778][T12866] tipc: Disabling bearer [ 543.476182][T12872] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2342'. [ 543.536793][T12872] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 543.536865][T12872] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 543.554329][T12872] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 543.554386][T12872] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 543.613559][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 543.802709][T12877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.803224][T12877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.957404][T12882] FAULT_INJECTION: forcing a failure. [ 543.957404][T12882] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.957466][T12882] CPU: 0 UID: 0 PID: 12882 Comm: syz.2.2346 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.957495][T12882] Tainted: [L]=SOFTLOCKUP [ 543.957503][T12882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 543.957516][T12882] Call Trace: [ 543.957526][T12882] [ 543.957536][T12882] dump_stack_lvl+0xe8/0x150 [ 543.957570][T12882] should_fail_ex+0x410/0x560 [ 543.957603][T12882] _copy_from_user+0x2d/0xb0 [ 543.957625][T12882] move_addr_to_kernel+0x7e/0x160 [ 543.957667][T12882] get_compat_msghdr+0x3db/0x4c0 [ 543.957696][T12882] ? __pfx_get_compat_msghdr+0x10/0x10 [ 543.957734][T12882] ___sys_sendmsg+0x201/0x360 [ 543.957754][T12882] ? __lock_acquire+0x6df/0x2e50 [ 543.957779][T12882] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.957805][T12882] ? kstrtoull+0x137/0x1d0 [ 543.957857][T12882] ? __fget_files+0x2a/0x420 [ 543.957886][T12882] ? __fget_files+0x3a2/0x420 [ 543.957921][T12882] __sys_sendmmsg+0x2de/0x4d0 [ 543.957949][T12882] ? __pfx___sys_sendmmsg+0x10/0x10 [ 543.957998][T12882] ? fput+0xa0/0xd0 [ 543.958024][T12882] ? ksys_write+0x242/0x270 [ 543.958059][T12882] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 543.958087][T12882] __do_fast_syscall_32+0x27a/0x6a0 [ 543.958119][T12882] ? do_fast_syscall_32+0x33/0x70 [ 543.958146][T12882] ? asm_int80_emulation+0x1a/0x20 [ 543.958168][T12882] ? do_int80_emulation+0x299/0x500 [ 543.958193][T12882] ? trace_irq_disable+0x3b/0x140 [ 543.958218][T12882] do_fast_syscall_32+0x33/0x70 [ 543.958248][T12882] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 543.958274][T12882] RIP: 0023:0xf708f0ec [ 543.958295][T12882] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 543.958314][T12882] RSP: 002b:00000000f547d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 543.958338][T12882] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003000 [ 543.958353][T12882] RDX: 0000000000000002 RSI: 0000000020002040 RDI: 0000000000000000 [ 543.958367][T12882] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 543.958380][T12882] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 543.958394][T12882] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 543.958424][T12882] [ 544.219992][T12891] FAULT_INJECTION: forcing a failure. [ 544.219992][T12891] name failslab, interval 1, probability 0, space 0, times 0 [ 544.233106][T12891] CPU: 1 UID: 0 PID: 12891 Comm: syz.3.2349 Tainted: G L syzkaller #0 PREEMPT(full) [ 544.233150][T12891] Tainted: [L]=SOFTLOCKUP [ 544.233159][T12891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 544.233172][T12891] Call Trace: [ 544.233181][T12891] [ 544.233195][T12891] dump_stack_lvl+0xe8/0x150 [ 544.233232][T12891] should_fail_ex+0x410/0x560 [ 544.233267][T12891] should_failslab+0xa8/0x100 [ 544.233293][T12891] __kmalloc_cache_node_noprof+0xaa/0x620 [ 544.233327][T12891] ? __get_vm_area_node+0x155/0x2f0 [ 544.233353][T12891] ? __get_vm_area_node+0x155/0x2f0 [ 544.233387][T12891] __get_vm_area_node+0x155/0x2f0 [ 544.233412][T12891] ? __pfx_process_measurement+0x10/0x10 [ 544.233444][T12891] __vmalloc_node_range_noprof+0x343/0x1540 [ 544.233470][T12891] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 544.233520][T12891] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 544.233549][T12891] ? lock_acquire+0x115/0x350 [ 544.233575][T12891] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 544.233596][T12891] __vmalloc_noprof+0xd2/0x120 [ 544.233624][T12891] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 544.233649][T12891] bpf_prog_alloc_no_stats+0x47/0x560 [ 544.233672][T12891] ? bpf_prog_alloc+0x2a/0x1a0 [ 544.233697][T12891] bpf_prog_alloc+0x3c/0x1a0 [ 544.233723][T12891] bpf_prog_load+0x7f8/0x1c20 [ 544.233759][T12891] ? __pfx_bpf_prog_load+0x10/0x10 [ 544.233809][T12891] __sys_bpf+0xd0d/0xd90 [ 544.233841][T12891] ? __pfx___sys_bpf+0x10/0x10 [ 544.233867][T12891] ? ksys_write+0x1e6/0x270 [ 544.233900][T12891] ? __mutex_unlock_slowpath+0x731/0x900 [ 544.233947][T12891] ? fput+0xa0/0xd0 [ 544.233972][T12891] ? ksys_write+0x242/0x270 [ 544.234006][T12891] __ia32_sys_bpf+0xba/0xd0 [ 544.234031][T12891] __do_fast_syscall_32+0x27a/0x6a0 [ 544.234062][T12891] ? do_fast_syscall_32+0x33/0x70 [ 544.234090][T12891] ? asm_int80_emulation+0x1a/0x20 [ 544.234110][T12891] ? do_int80_emulation+0x299/0x500 [ 544.234150][T12891] do_fast_syscall_32+0x33/0x70 [ 544.234177][T12891] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 544.234202][T12891] RIP: 0023:0xf6fdf0ec [ 544.234222][T12891] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 544.234240][T12891] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 544.234265][T12891] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800006c0 [ 544.234281][T12891] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 544.234294][T12891] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 544.234307][T12891] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 544.234320][T12891] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 544.234350][T12891] [ 544.254893][ T1834] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 544.260633][T12891] syz.3.2349: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 544.260729][T12891] CPU: 1 UID: 0 PID: 12891 Comm: syz.3.2349 Tainted: G L syzkaller #0 PREEMPT(full) [ 544.260753][T12891] Tainted: [L]=SOFTLOCKUP [ 544.260760][T12891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 544.260771][T12891] Call Trace: [ 544.260779][T12891] [ 544.260787][T12891] dump_stack_lvl+0xe8/0x150 [ 544.260817][T12891] warn_alloc+0x24d/0x270 [ 544.260848][T12891] ? __kasan_kmalloc+0x22/0xb0 [ 544.260870][T12891] ? __pfx_warn_alloc+0x10/0x10 [ 544.260893][T12891] ? __get_vm_area_node+0x155/0x2f0 [ 544.260922][T12891] ? __get_vm_area_node+0x2a9/0x2f0 [ 544.260941][T12891] ? __pfx_process_measurement+0x10/0x10 [ 544.260969][T12891] __vmalloc_node_range_noprof+0x36b/0x1540 [ 544.261018][T12891] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 544.261042][T12891] ? lock_acquire+0x115/0x350 [ 544.261065][T12891] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 544.261083][T12891] __vmalloc_noprof+0xd2/0x120 [ 544.261105][T12891] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 544.261125][T12891] bpf_prog_alloc_no_stats+0x47/0x560 [ 544.261153][T12891] ? bpf_prog_alloc+0x2a/0x1a0 [ 544.261173][T12891] bpf_prog_alloc+0x3c/0x1a0 [ 544.261193][T12891] bpf_prog_load+0x7f8/0x1c20 [ 544.261241][T12891] ? __pfx_bpf_prog_load+0x10/0x10 [ 544.261282][T12891] __sys_bpf+0xd0d/0xd90 [ 544.261308][T12891] ? __pfx___sys_bpf+0x10/0x10 [ 544.261329][T12891] ? ksys_write+0x1e6/0x270 [ 544.261357][T12891] ? __mutex_unlock_slowpath+0x731/0x900 [ 544.261398][T12891] ? fput+0xa0/0xd0 [ 544.261417][T12891] ? ksys_write+0x242/0x270 [ 544.261445][T12891] __ia32_sys_bpf+0xba/0xd0 [ 544.261466][T12891] __do_fast_syscall_32+0x27a/0x6a0 [ 544.261491][T12891] ? do_fast_syscall_32+0x33/0x70 [ 544.261513][T12891] ? asm_int80_emulation+0x1a/0x20 [ 544.261531][T12891] ? do_int80_emulation+0x299/0x500 [ 544.261560][T12891] do_fast_syscall_32+0x33/0x70 [ 544.261585][T12891] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 544.261606][T12891] RIP: 0023:0xf6fdf0ec [ 544.261624][T12891] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 544.261640][T12891] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 544.261660][T12891] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800006c0 [ 544.261674][T12891] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 544.261686][T12891] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 544.261698][T12891] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 544.261710][T12891] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 544.261739][T12891] [ 544.261775][T12891] Mem-Info: [ 544.261786][T12891] active_anon:11746 inactive_anon:514 isolated_anon:0 [ 544.261786][T12891] active_file:147 inactive_file:5637 isolated_file:0 [ 544.261786][T12891] unevictable:0 dirty:237 writeback:0 [ 544.261786][T12891] slab_reclaimable:11162 slab_unreclaimable:114878 [ 544.261786][T12891] mapped:36159 shmem:2593 pagetables:1452 [ 544.261786][T12891] sec_pagetables:0 bounce:0 [ 544.261786][T12891] kernel_misc_reclaimable:0 [ 544.261786][T12891] free:1321305 free_pcp:6876 free_cma:0 [ 544.261834][T12891] Node 0 active_anon:46984kB inactive_anon:2056kB active_file:588kB inactive_file:22416kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:144636kB dirty:948kB writeback:0kB shmem:10372kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15344kB pagetables:5684kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 544.261884][T12891] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 544.261954][T12891] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 544.262007][T12891] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 544.262040][T12891] Node 0 DMA32 free:1326064kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:46984kB inactive_anon:2056kB active_file:588kB inactive_file:22416kB unevictable:0kB writepending:948kB zspages:412kB present:3129332kB managed:2546820kB mlocked:0kB bounce:0kB free_pcp:27504kB local_pcp:12916kB free_cma:0kB [ 544.359472][T12891] lowmem_reserve[]: 0 0 0 0 0 [ 544.359515][T12891] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 544.366322][T12891] lowmem_reserve[]: 0 0 0 0 0 [ 544.366365][T12891] Node 1 Normal free:3943796kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 544.366422][T12891] lowmem_reserve[]: 0 0 0 0 0 [ 544.366457][T12891] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 544.366567][T12891] Node 0 DMA32: 2410*4kB (UME) 1837*8kB (UME) 1214*16kB (UME) 1256*32kB (UME) 593*64kB (UME) 302*128kB (UME) 137*256kB (UM) 46*512kB (M) 23*1024kB (M) 17*2048kB (UM) 256*4096kB (UME) = 1326128kB [ 544.366761][T12891] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 544.366853][T12891] Node 1 Normal: 5*4kB (UM) 6*8kB (UM) 7*16kB (UM) 2*32kB (UM) 4*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (UM) 960*4096kB (M) = 3943796kB [ 544.366998][T12891] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 544.367014][T12891] Node 0 hugepages_total=3 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 544.367029][T12891] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 544.367045][T12891] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 544.367060][T12891] 8781 total pagecache pages [ 544.367068][T12891] 383 pages in swap cache [ 544.367075][T12891] Free swap = 123316kB [ 544.367083][T12891] Total swap = 124996kB [ 544.367091][T12891] 2097051 pages RAM [ 544.367098][T12891] 0 pages HighMem/MovableOnly [ 544.367105][T12891] 428730 pages reserved [ 544.367112][T12891] 0 pages cma reserved [ 544.411275][ T1834] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 544.424392][ T1834] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 544.424442][ T1834] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.436068][ T1834] usb 7-1: config 0 descriptor?? [ 544.688244][ T1834] usbhid 7-1:0.0: can't add hid device: -71 [ 544.688354][ T1834] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 544.710509][ T1834] usb 7-1: USB disconnect, device number 26 [ 544.841074][T12894] bridge0: port 1(bridge_slave_0) entered disabled state [ 544.843174][T12894] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 544.861503][T12894] syzkaller0: entered promiscuous mode [ 544.861527][T12894] syzkaller0: entered allmulticast mode [ 545.108541][T12898] FAULT_INJECTION: forcing a failure. [ 545.108541][T12898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 545.108578][T12898] CPU: 0 UID: 0 PID: 12898 Comm: syz.4.2352 Tainted: G L syzkaller #0 PREEMPT(full) [ 545.108604][T12898] Tainted: [L]=SOFTLOCKUP [ 545.108611][T12898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 545.108623][T12898] Call Trace: [ 545.108632][T12898] [ 545.108640][T12898] dump_stack_lvl+0xe8/0x150 [ 545.108671][T12898] should_fail_ex+0x410/0x560 [ 545.108705][T12898] _copy_from_iter+0x1d3/0x1660 [ 545.108731][T12898] ? __alloc_skb+0x27a/0x7a0 [ 545.108759][T12898] ? __alloc_skb+0x27a/0x7a0 [ 545.108785][T12898] ? __alloc_skb+0x27a/0x7a0 [ 545.108810][T12898] ? __pfx__copy_from_iter+0x10/0x10 [ 545.108833][T12898] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 545.108859][T12898] ? __alloc_skb+0x27a/0x7a0 [ 545.108881][T12898] ? __alloc_skb+0x27a/0x7a0 [ 545.108910][T12898] ? netlink_sendmsg+0x650/0xb40 [ 545.108931][T12898] ? skb_put+0x112/0x210 [ 545.108959][T12898] netlink_sendmsg+0x6c0/0xb40 [ 545.108987][T12898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.109016][T12898] ? apparmor_socket_sendmsg+0x98/0x360 [ 545.109043][T12898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.109063][T12898] sock_sendmsg_nosec+0x13a/0x180 [ 545.109088][T12898] ____sys_sendmsg+0x54e/0x850 [ 545.109112][T12898] ? __pfx_____sys_sendmsg+0x10/0x10 [ 545.109145][T12898] ___sys_sendmsg+0x2a5/0x360 [ 545.109162][T12898] ? __lock_acquire+0x6df/0x2e50 [ 545.109185][T12898] ? __pfx____sys_sendmsg+0x10/0x10 [ 545.109208][T12898] ? kstrtoull+0x137/0x1d0 [ 545.109254][T12898] ? __fget_files+0x2a/0x420 [ 545.109277][T12898] ? __fget_files+0x3a2/0x420 [ 545.109309][T12898] __sys_sendmmsg+0x2de/0x4d0 [ 545.109332][T12898] ? __pfx___sys_sendmmsg+0x10/0x10 [ 545.109376][T12898] ? fput+0xa0/0xd0 [ 545.109398][T12898] ? ksys_write+0x242/0x270 [ 545.109429][T12898] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 545.109454][T12898] __do_fast_syscall_32+0x27a/0x6a0 [ 545.109488][T12898] ? do_fast_syscall_32+0x33/0x70 [ 545.109512][T12898] ? asm_int80_emulation+0x1a/0x20 [ 545.109530][T12898] ? do_int80_emulation+0x299/0x500 [ 545.109554][T12898] ? trace_irq_disable+0x3b/0x140 [ 545.109576][T12898] do_fast_syscall_32+0x33/0x70 [ 545.109600][T12898] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.109622][T12898] RIP: 0023:0xf7f940ec [ 545.109640][T12898] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 545.109657][T12898] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 545.109679][T12898] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 545.109692][T12898] RDX: 000000000000009f RSI: 0000000000000000 RDI: 0000000000000000 [ 545.109704][T12898] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 545.109716][T12898] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 545.109728][T12898] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 545.109755][T12898] [ 545.281594][ T1834] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 545.555493][ T1834] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 545.556933][ T1834] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 545.556977][ T1834] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.569346][ T1834] usb 7-1: config 0 descriptor?? [ 546.420775][ T1834] aiptek 7-1:0.0: Aiptek using 400 ms programming speed [ 546.438156][ T1834] input: Aiptek as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input60 [ 546.659567][ T5711] usb 7-1: USB disconnect, device number 27 [ 546.659564][ C0] aiptek 7-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 547.065054][T12938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.065639][T12938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.144633][ T1834] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 547.306408][ T1834] usb 4-1: Using ep0 maxpacket: 8 [ 547.312246][ T1834] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 547.323848][ T1834] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 547.339372][ T1834] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.339416][ T1834] usb 4-1: Product: syz [ 547.339460][ T1834] usb 4-1: Manufacturer: syz [ 547.339475][ T1834] usb 4-1: SerialNumber: syz [ 547.355198][ T1834] usb 4-1: config 0 descriptor?? [ 547.388750][ T1834] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 547.741713][T12953] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 547.741777][T12953] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.787999][T12954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.789690][T12954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.808807][T12954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.817784][T12954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.021938][T12956] netlink: 'syz.2.2364': attribute type 4 has an invalid length. [ 548.068911][T12954] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 549.454348][ T1834] gspca_zc3xx: i2c_w status error 8a [ 549.764486][T12968] loop9: detected capacity change from 0 to 7 [ 549.777788][T12969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.778391][T12969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.807187][T12968] Dev loop9: unable to read RDB block 7 [ 549.807252][T12968] loop9: unable to read partition table [ 549.807524][T12968] loop9: partition table beyond EOD, truncated [ 549.807559][T12968] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 550.054345][ T1834] gspca_zc3xx: reg_r err -32 [ 550.505341][T12978] netlink: 'syz.4.2369': attribute type 10 has an invalid length. [ 550.505398][T12978] netlink: 67 bytes leftover after parsing attributes in process `syz.4.2369'. [ 550.507300][T12978] vlan1: entered promiscuous mode [ 550.520534][T12978] team0: Port device vlan1 added [ 550.643722][ T1834] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 550.643840][ T1834] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -32 [ 550.809507][T12982] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 551.160033][ T965] usb 4-1: USB disconnect, device number 8 [ 551.633649][ T965] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 551.783731][ T965] usb 4-1: Using ep0 maxpacket: 16 [ 551.784624][ T965] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 551.786551][ T965] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 551.808768][ T965] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.808796][ T965] usb 4-1: Product: syz [ 551.808810][ T965] usb 4-1: Manufacturer: syz [ 551.808824][ T965] usb 4-1: SerialNumber: syz [ 551.828686][ T965] usb 4-1: config 0 descriptor?? [ 552.248933][T13004] netlink: 'syz.2.2377': attribute type 1 has an invalid length. [ 552.277927][T13004] 8021q: adding VLAN 0 to HW filter on device bond12 [ 552.366340][T13004] bond12: (slave veth19): Enslaving as an active interface with a down link [ 552.383738][ T965] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 552.539258][ T965] usb 7-1: unable to get BOS descriptor or descriptor too short [ 552.539330][ T965] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 552.541069][ T965] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 552.574263][ T965] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.574317][ T965] usb 7-1: Product: syz [ 552.574350][ T965] usb 7-1: Manufacturer: syz [ 552.574364][ T965] usb 7-1: SerialNumber: syz [ 552.611018][T13010] program syz.4.2378 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 552.829846][T12999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 552.830563][T12999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.936479][T13011] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 553.826924][ T965] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 553.826990][ T965] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 553.829741][ T965] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 554.014879][ T965] snd-usb-audio 7-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 554.026387][ T965] usb 7-1: USB disconnect, device number 28 [ 554.216024][T13016] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2379'. [ 554.376443][ T5710] usb 4-1: USB disconnect, device number 9 [ 554.595690][T13018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2380'. [ 555.157824][T13024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.170153][T13024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.464949][ T965] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 555.623655][ T965] usb 4-1: Using ep0 maxpacket: 16 [ 555.634030][ T965] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 555.647838][ T965] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 555.647886][ T965] usb 4-1: config 0 has no interface number 0 [ 555.647951][ T965] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 555.647984][ T965] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 555.699685][ T965] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 555.699737][ T965] usb 4-1: Product: syz [ 555.699771][ T965] usb 4-1: SerialNumber: syz [ 555.724294][ T965] usb 4-1: config 0 descriptor?? [ 555.736910][ T965] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 555.748506][ T965] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input61 [ 556.045729][T13030] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 556.079748][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.089408][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.097179][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.104450][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.104670][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.104881][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.105164][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.112290][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.119467][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.127065][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 556.144680][ T965] usb 4-1: USB disconnect, device number 10 [ 556.144773][ C0] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 556.187873][ T965] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 556.815433][T13047] fuse: Unknown parameter '' [ 556.842000][T13050] netlink: 'syz.3.2391': attribute type 1 has an invalid length. [ 556.873688][T13050] 8021q: adding VLAN 0 to HW filter on device bond12 [ 556.952178][T13050] bond12: (slave veth23): Enslaving as an active interface with a down link [ 557.043263][T13055] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(19) [ 557.043296][T13055] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 557.049510][T13055] vhci_hcd vhci_hcd.0: Device attached [ 557.070011][T13057] vhci_hcd: connection closed [ 557.094933][ T8553] vhci_hcd vhci_hcd.2: stop threads [ 557.095833][ T8553] vhci_hcd vhci_hcd.2: release socket [ 557.095926][ T8553] vhci_hcd vhci_hcd.2: disconnect device [ 557.243729][ T1833] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 557.393644][ T1833] usb 7-1: Using ep0 maxpacket: 16 [ 557.399894][ T1833] usb 7-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 557.410446][ T1833] usb 7-1: config 0 has an invalid interface number: 8 but max is 0 [ 557.419208][ T1833] usb 7-1: config 0 has no interface number 0 [ 557.419349][ T1833] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 557.419398][ T1833] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 557.449249][ T1833] usb 7-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 557.457639][ T1833] usb 7-1: Product: syz [ 557.461941][ T1833] usb 7-1: SerialNumber: syz [ 557.472155][ T1833] usb 7-1: config 0 descriptor?? [ 557.483904][ T1833] cm109 7-1:0.8: invalid payload size 0, expected 4 [ 557.496485][ T1833] input: CM109 USB driver as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.8/input/input62 [ 557.990203][T13071] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 558.022314][T13066] program syz.0.2393 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 558.179350][T13075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.188244][ T1833] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 558.212732][T13075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.353359][ T1833] usb 3-1: unable to get BOS descriptor or descriptor too short [ 558.367003][ T1833] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 558.379046][ T1833] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 558.395932][ T1833] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.395977][ T1833] usb 3-1: Product: syz [ 558.395997][ T1833] usb 3-1: Manufacturer: syz [ 558.396045][ T1833] usb 3-1: SerialNumber: syz [ 558.524700][T13075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.541632][T13075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.678606][T13070] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.708216][T13070] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.899245][T13070] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 559.062835][ T1833] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 559.062929][ T1833] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 559.100195][ T1833] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 559.219058][ T1833] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 559.241574][ T1833] usb 3-1: USB disconnect, device number 14 [ 559.448240][ T5711] usb 7-1: USB disconnect, device number 29 [ 559.448336][ C0] cm109 7-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 559.478329][ T5711] cm109 7-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 560.214605][ T1833] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 560.378059][ T1833] usb 3-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 560.388984][ T1833] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 560.389033][ T1833] usb 3-1: config 0 has no interface number 0 [ 560.389101][ T1833] usb 3-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid maxpacket 12592, setting to 64 [ 560.422431][ T1833] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.422478][ T1833] usb 3-1: Product: syz [ 560.422513][ T1833] usb 3-1: Manufacturer: syz [ 560.422533][ T1833] usb 3-1: SerialNumber: syz [ 560.449983][ T1833] usb 3-1: config 0 descriptor?? [ 560.456003][T13080] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 560.557832][T13088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.558415][T13088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.610739][T13088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.611330][T13088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.662724][T13086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.665209][T13086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.691675][T13086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.711039][T13086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.787659][ T1833] keyspan 3-1:0.133: Keyspan 1 port adapter converter detected [ 560.804655][ T1833] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 81 [ 560.813912][ T1833] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 1 [ 560.825913][ T1833] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 2 [ 560.840383][ T1833] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 560.856854][ T1833] usb 3-1: USB disconnect, device number 15 [ 560.874640][ T1833] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 560.894735][ T1833] keyspan 3-1:0.133: device disconnected [ 561.346018][ T1834] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 561.509385][T13103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.520792][ T1834] usb 4-1: unable to get BOS descriptor or descriptor too short [ 561.520883][ T1834] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 561.540119][ T1834] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 561.555609][ T1834] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.564074][ T1834] usb 4-1: Product: syz [ 561.566019][T13103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.578851][ T1834] usb 4-1: Manufacturer: syz [ 561.584092][ T1834] usb 4-1: SerialNumber: syz [ 561.652718][T13103] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 561.659954][T13103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.669208][T13103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.706564][T13103] misc userio: No port type given on /dev/userio [ 561.874808][T13098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.893016][T13098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.919247][T13098] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 562.019241][T13109] netlink: 'syz.6.2406': attribute type 10 has an invalid length. [ 562.019341][T13109] ipvlan0: entered allmulticast mode [ 562.019359][T13109] veth0_vlan: entered allmulticast mode [ 562.042497][T13109] team0: Device ipvlan0 failed to register rx_handler [ 562.095143][ T1834] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 562.105368][ T1834] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 562.121317][ T1834] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 562.182995][ T1834] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 562.197776][ T1834] usb 4-1: USB disconnect, device number 11 [ 562.377427][T13109] bond2: (slave bond_slave_1): Device is not our slave [ 562.377470][T13109] bond2: option active_slave: invalid value (bond_slave_1) [ 562.410378][T13109] bond2 (unregistering): Released all slaves [ 562.565442][T13116] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2405'. [ 562.787178][T13113] bond2: option arp_all_targets: invalid value (1073741825) [ 562.798417][T13113] bond2 (unregistering): Released all slaves [ 562.807975][T13124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.808528][T13124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 563.175500][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.175604][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.281711][T13119] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 563.683800][ T5711] usb 7-1: new full-speed USB device number 30 using dummy_hcd [ 563.839134][ T5711] usb 7-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 563.850755][ T5711] usb 7-1: config 0 has an invalid interface number: 3 but max is 0 [ 563.850798][ T5711] usb 7-1: config 0 has no interface number 0 [ 563.872653][ T5711] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.872696][ T5711] usb 7-1: Product: syz [ 563.872718][ T5711] usb 7-1: Manufacturer: syz [ 563.872730][ T5711] usb 7-1: SerialNumber: syz [ 563.901261][ T5711] usb 7-1: config 0 descriptor?? [ 563.986643][T13138] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2411'. [ 564.320534][ T5711] peak_usb 7-1:0.3 can0: unable to request usb[type=0 value=0] err=-71 [ 564.320592][ T5711] peak_usb 7-1:0.3: unable to read PCAN-USB Pro bootloader info (err -71) [ 564.454485][ T5711] peak_usb 7-1:0.3: probe with driver peak_usb failed with error -71 [ 564.472998][ T5711] usb 7-1: USB disconnect, device number 30 [ 564.593337][T13152] netlink: 'syz.2.2417': attribute type 1 has an invalid length. [ 564.637177][T13152] 8021q: adding VLAN 0 to HW filter on device bond13 [ 564.813769][ T1925] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 564.943884][ T1925] usb 4-1: device descriptor read/64, error -71 [ 565.193379][ T5622] Bluetooth: hci5: command 0x0406 tx timeout [ 565.200287][ T1925] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 565.293648][ T5710] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 565.333665][ T1925] usb 4-1: device descriptor read/64, error -71 [ 565.444128][ T1925] usb usb4-port1: attempt power cycle [ 565.471042][ T5710] usb 7-1: unable to get BOS descriptor or descriptor too short [ 565.479200][ T5710] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 565.491703][ T5710] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 565.508233][ T5710] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.517395][ T5710] usb 7-1: Product: syz [ 565.521838][ T5710] usb 7-1: Manufacturer: syz [ 565.526664][ T5710] usb 7-1: SerialNumber: syz [ 565.805731][ T1925] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 565.824772][T13162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.834879][ T1925] usb 4-1: device descriptor read/8, error -71 [ 565.844471][T13162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.003767][T13164] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 566.073648][ T1925] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 566.094972][ T1925] usb 4-1: device descriptor read/8, error -71 [ 566.214739][ T1925] usb usb4-port1: unable to enumerate USB device [ 566.732296][T13170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2421'. [ 566.742727][T13170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.748004][T13170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.848518][ T5710] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 566.857023][ T5710] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 566.872313][ T5710] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 566.929139][ T5710] snd-usb-audio 7-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 566.941726][ T5710] usb 7-1: USB disconnect, device number 31 [ 567.449632][T13173] syz_tun: entered allmulticast mode [ 567.772048][T13182] program syz.6.2426 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 567.781806][T13182] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2426'. [ 567.790925][T13182] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2426'. [ 567.803072][T13182] netlink: 'syz.6.2426': attribute type 6 has an invalid length. [ 567.858339][T13185] tipc: Enabling of bearer rejected, already enabled [ 567.977520][T13190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.978043][T13190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.214356][ T5710] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 568.384603][ T5710] usb 4-1: Using ep0 maxpacket: 16 [ 568.391032][ T5710] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 568.404243][ T5710] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 568.404283][ T5710] usb 4-1: config 0 has no interface number 0 [ 568.404345][ T5710] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 568.404408][ T5710] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 568.416037][ T5710] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 568.416065][ T5710] usb 4-1: Product: syz [ 568.416107][ T5710] usb 4-1: SerialNumber: syz [ 568.425043][ T5710] usb 4-1: config 0 descriptor?? [ 568.436692][ T5710] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 568.461340][ T5710] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input64 [ 568.668205][T13198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.668804][T13198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.763132][T13187] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 568.792696][ C1] cm109_urb_ctl_callback: 11 callbacks suppressed [ 568.792718][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.792913][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.793112][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.793315][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.793514][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.793752][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.793953][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.794154][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.794353][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.794549][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 568.797285][ T5710] usb 4-1: USB disconnect, device number 16 [ 568.797383][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 568.829405][ T5710] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 568.902668][T13198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.914466][T13198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.619847][T13207] netlink: 'syz.4.2436': attribute type 1 has an invalid length. [ 569.635990][T13206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2433'. [ 569.671637][T13207] 8021q: adding VLAN 0 to HW filter on device bond11 [ 569.730989][T13213] bond11: (slave veth13): Enslaving as an active interface with a down link [ 569.843161][T13217] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2437'. [ 569.891927][T13214] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2433'. [ 569.933664][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 570.088579][ T5710] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 570.097570][ T1925] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 570.109095][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 570.109165][ T9] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 570.127973][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1576, setting to 1024 [ 570.152509][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.152559][ T9] usb 3-1: Product: syz [ 570.152599][ T9] usb 3-1: Manufacturer: syz [ 570.152617][ T9] usb 3-1: SerialNumber: syz [ 570.233749][ T5710] usb 7-1: Using ep0 maxpacket: 16 [ 570.242565][ T5710] usb 7-1: unable to get BOS descriptor or descriptor too short [ 570.242664][ T5710] usb 7-1: New USB device found, idVendor=20d6, idProduct=cb17, bcdDevice= 0.40 [ 570.245144][ T5710] usb 7-1: config 1 interface 0 has no altsetting 0 [ 570.249980][ T1925] usb 4-1: unable to get BOS descriptor or descriptor too short [ 570.253216][ T1925] usb 4-1: not running at top speed; connect to a high speed hub [ 570.253248][ T1925] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 570.262166][ T1925] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 570.262194][ T1925] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 570.262890][ T5710] usb 7-1: language id specifier not provided by device, defaulting to English [ 570.270796][ T5710] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.270825][ T5710] usb 7-1: Product: syz [ 570.270840][ T5710] usb 7-1: Manufacturer: 䬦ḹ딋襩啜옡쿀ꩩ⠗梥郛㉈쩏뉌臁鿴褖嘓ꂪ榙ᳮꡀ◕򐉬 [ 570.270857][ T5710] usb 7-1: SerialNumber: syz [ 570.280617][ T1925] usb 4-1: string descriptor 0 read error: -22 [ 570.280785][ T1925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.329981][ T1925] usb 4-1: 0:1 : does not exist [ 570.330006][ T1925] usb 4-1: 0:2 : does not exist [ 570.395544][T13224] tipc: Enabled bearer , priority 0 [ 570.482588][T13223] tipc: Disabling bearer [ 570.498730][T13210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.507179][T13210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.613053][T13219] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 570.632623][T13219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.641465][T13219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.691808][T13210] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 570.732273][T13219] misc userio: No port type given on /dev/userio [ 570.827891][ T5710] usbhid 7-1:1.0: can't add hid device: -71 [ 570.828069][ T5710] usbhid 7-1:1.0: probe with driver usbhid failed with error -71 [ 570.865096][ T5710] usb 7-1: USB disconnect, device number 32 [ 570.985558][T13229] FAULT_INJECTION: forcing a failure. [ 570.985558][T13229] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.000363][T13229] CPU: 0 UID: 0 PID: 13229 Comm: syz.0.2441 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.000399][T13229] Tainted: [L]=SOFTLOCKUP [ 571.000408][T13229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 571.000421][T13229] Call Trace: [ 571.000430][T13229] [ 571.000439][T13229] dump_stack_lvl+0xe8/0x150 [ 571.000479][T13229] should_fail_ex+0x410/0x560 [ 571.000514][T13229] _copy_from_iter+0x1d3/0x1660 [ 571.000542][T13229] ? __alloc_skb+0x27a/0x7a0 [ 571.000572][T13229] ? __alloc_skb+0x27a/0x7a0 [ 571.000601][T13229] ? __alloc_skb+0x27a/0x7a0 [ 571.000628][T13229] ? __pfx__copy_from_iter+0x10/0x10 [ 571.000655][T13229] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 571.000683][T13229] ? __alloc_skb+0x27a/0x7a0 [ 571.000708][T13229] ? __alloc_skb+0x27a/0x7a0 [ 571.000740][T13229] ? netlink_sendmsg+0x650/0xb40 [ 571.000764][T13229] ? skb_put+0x112/0x210 [ 571.000794][T13229] netlink_sendmsg+0x6c0/0xb40 [ 571.000825][T13229] ? __pfx_netlink_sendmsg+0x10/0x10 [ 571.000857][T13229] ? apparmor_socket_sendmsg+0x98/0x360 [ 571.000887][T13229] ? __pfx_netlink_sendmsg+0x10/0x10 [ 571.000909][T13229] sock_sendmsg_nosec+0x13a/0x180 [ 571.000936][T13229] ____sys_sendmsg+0x54e/0x850 [ 571.000963][T13229] ? __pfx_____sys_sendmsg+0x10/0x10 [ 571.001019][T13229] ___sys_sendmsg+0x2a5/0x360 [ 571.001039][T13229] ? __lock_acquire+0x6df/0x2e50 [ 571.001065][T13229] ? __pfx____sys_sendmsg+0x10/0x10 [ 571.001085][T13229] ? get_pid_task+0x20/0x1f0 [ 571.001105][T13229] ? get_pid_task+0x20/0x1f0 [ 571.001122][T13229] ? get_pid_task+0x20/0x1f0 [ 571.001171][T13229] ? __fget_files+0x2a/0x420 [ 571.001196][T13229] ? __fget_files+0x3a2/0x420 [ 571.001232][T13229] __sys_sendmsg+0x177/0x240 [ 571.001255][T13229] ? __pfx___sys_sendmsg+0x10/0x10 [ 571.001302][T13229] __do_fast_syscall_32+0x27a/0x6a0 [ 571.001332][T13229] ? do_fast_syscall_32+0x33/0x70 [ 571.001359][T13229] ? asm_int80_emulation+0x1a/0x20 [ 571.001381][T13229] ? do_int80_emulation+0x299/0x500 [ 571.001407][T13229] ? trace_irq_disable+0x3b/0x140 [ 571.001430][T13229] do_fast_syscall_32+0x33/0x70 [ 571.001458][T13229] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 571.001482][T13229] RIP: 0023:0xf703f0ec [ 571.001502][T13229] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 571.001519][T13229] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 571.001543][T13229] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000000 [ 571.001558][T13229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.001569][T13229] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 571.001579][T13229] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 571.001591][T13229] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 571.001620][T13229] [ 571.679568][T13235] FAULT_INJECTION: forcing a failure. [ 571.679568][T13235] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.679665][T13235] CPU: 1 UID: 0 PID: 13235 Comm: syz.2.2444 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.679692][T13235] Tainted: [L]=SOFTLOCKUP [ 571.679700][T13235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 571.679712][T13235] Call Trace: [ 571.679720][T13235] [ 571.679736][T13235] dump_stack_lvl+0xe8/0x150 [ 571.679774][T13235] should_fail_ex+0x410/0x560 [ 571.679805][T13235] _copy_from_iter+0x1d3/0x1660 [ 571.679832][T13235] ? __alloc_skb+0x27a/0x7a0 [ 571.679860][T13235] ? __alloc_skb+0x27a/0x7a0 [ 571.679887][T13235] ? __alloc_skb+0x27a/0x7a0 [ 571.679912][T13235] ? __pfx__copy_from_iter+0x10/0x10 [ 571.679935][T13235] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 571.679961][T13235] ? __alloc_skb+0x27a/0x7a0 [ 571.679984][T13235] ? __alloc_skb+0x27a/0x7a0 [ 571.680013][T13235] ? netlink_sendmsg+0x650/0xb40 [ 571.680034][T13235] ? skb_put+0x112/0x210 [ 571.680062][T13235] netlink_sendmsg+0x6c0/0xb40 [ 571.680091][T13235] ? __pfx_netlink_sendmsg+0x10/0x10 [ 571.680119][T13235] ? apparmor_socket_sendmsg+0x98/0x360 [ 571.680147][T13235] ? __pfx_netlink_sendmsg+0x10/0x10 [ 571.680167][T13235] sock_sendmsg_nosec+0x13a/0x180 [ 571.680192][T13235] ____sys_sendmsg+0x54e/0x850 [ 571.680215][T13235] ? __pfx_____sys_sendmsg+0x10/0x10 [ 571.680249][T13235] ___sys_sendmsg+0x2a5/0x360 [ 571.680274][T13235] ? __lock_acquire+0x6df/0x2e50 [ 571.680297][T13235] ? __pfx____sys_sendmsg+0x10/0x10 [ 571.680314][T13235] ? get_pid_task+0x20/0x1f0 [ 571.680332][T13235] ? get_pid_task+0x20/0x1f0 [ 571.680347][T13235] ? get_pid_task+0x20/0x1f0 [ 571.680391][T13235] ? __fget_files+0x2a/0x420 [ 571.680413][T13235] ? __fget_files+0x3a2/0x420 [ 571.680445][T13235] __sys_sendmsg+0x177/0x240 [ 571.680465][T13235] ? __pfx___sys_sendmsg+0x10/0x10 [ 571.680501][T13235] __do_fast_syscall_32+0x27a/0x6a0 [ 571.680527][T13235] ? do_fast_syscall_32+0x33/0x70 [ 571.680551][T13235] ? asm_int80_emulation+0x1a/0x20 [ 571.680569][T13235] ? do_int80_emulation+0x299/0x500 [ 571.680592][T13235] ? trace_irq_disable+0x3b/0x140 [ 571.680614][T13235] do_fast_syscall_32+0x33/0x70 [ 571.680639][T13235] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 571.680661][T13235] RIP: 0023:0xf708f0ec [ 571.680679][T13235] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 571.680695][T13235] RSP: 002b:00000000f547d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 571.680717][T13235] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080009b40 [ 571.680730][T13235] RDX: 0000000004000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.680743][T13235] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 571.680754][T13235] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 571.680766][T13235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 571.680793][T13235] [ 571.735691][T13231] FAULT_INJECTION: forcing a failure. [ 571.735691][T13231] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.735748][T13231] CPU: 1 UID: 0 PID: 13231 Comm: syz.0.2442 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.735775][T13231] Tainted: [L]=SOFTLOCKUP [ 571.735783][T13231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 571.735798][T13231] Call Trace: [ 571.735806][T13231] [ 571.735815][T13231] dump_stack_lvl+0xe8/0x150 [ 571.735846][T13231] should_fail_ex+0x410/0x560 [ 571.735877][T13231] strncpy_from_user+0x36/0x2c0 [ 571.735906][T13231] do_getname+0x77/0x250 [ 571.735931][T13231] do_sys_openat2+0xcc/0x200 [ 571.735956][T13231] ? __pfx_do_sys_openat2+0x10/0x10 [ 571.735981][T13231] ? ksys_write+0x242/0x270 [ 571.736011][T13231] __ia32_sys_creat+0x8f/0xc0 [ 571.736037][T13231] __do_fast_syscall_32+0x27a/0x6a0 [ 571.736064][T13231] ? do_fast_syscall_32+0x33/0x70 [ 571.736087][T13231] ? asm_int80_emulation+0x1a/0x20 [ 571.736105][T13231] ? do_int80_emulation+0x299/0x500 [ 571.736129][T13231] ? trace_irq_disable+0x3b/0x140 [ 571.736152][T13231] do_fast_syscall_32+0x33/0x70 [ 571.736177][T13231] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 571.736200][T13231] RIP: 0023:0xf703f0ec [ 571.736218][T13231] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 571.736235][T13231] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000008 [ 571.736256][T13231] RAX: ffffffffffffffda RBX: 0000000080000100 RCX: 000000004d39dcca [ 571.736278][T13231] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.736290][T13231] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 571.736301][T13231] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 571.736313][T13231] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 571.736341][T13231] [ 571.822510][ T1925] usb 4-1: 6:0: failed to get current value for ch 1 (-22) [ 571.881891][ T1925] usb 4-1: 6:0: failed to get current value for ch 0 (-22) [ 572.154835][T13238] FAULT_INJECTION: forcing a failure. [ 572.154835][T13238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 572.154872][T13238] CPU: 1 UID: 0 PID: 13238 Comm: syz.2.2445 Tainted: G L syzkaller #0 PREEMPT(full) [ 572.154902][T13238] Tainted: [L]=SOFTLOCKUP [ 572.154910][T13238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 572.154922][T13238] Call Trace: [ 572.154930][T13238] [ 572.154938][T13238] dump_stack_lvl+0xe8/0x150 [ 572.154972][T13238] should_fail_ex+0x410/0x560 [ 572.155002][T13238] _copy_to_iter+0x59c/0x1810 [ 572.155040][T13238] ? __pfx__copy_to_iter+0x10/0x10 [ 572.155065][T13238] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 572.155091][T13238] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 572.155112][T13238] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 572.155137][T13238] __skb_datagram_iter+0xf8/0x980 [ 572.155158][T13238] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 572.155185][T13238] skb_copy_datagram_iter+0xb5/0x240 [ 572.155208][T13238] netlink_recvmsg+0x2b9/0xa50 [ 572.155239][T13238] ? __pfx_netlink_recvmsg+0x10/0x10 [ 572.155270][T13238] ? aa_sock_msg_perm+0x144/0x210 [ 572.155302][T13238] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 572.155324][T13238] ? security_socket_recvmsg+0x7e/0x2c0 [ 572.155346][T13238] ? __pfx_netlink_recvmsg+0x10/0x10 [ 572.155367][T13238] sock_recvmsg+0x196/0x1e0 [ 572.155394][T13238] ____sys_recvmsg+0x1e6/0x4a0 [ 572.155422][T13238] ? __pfx_____sys_recvmsg+0x10/0x10 [ 572.155452][T13238] ? __lock_acquire+0x6df/0x2e50 [ 572.155478][T13238] ___sys_recvmsg+0x213/0x5a0 [ 572.155503][T13238] ? __pfx____sys_recvmsg+0x10/0x10 [ 572.155527][T13238] ? lock_acquire+0x115/0x350 [ 572.155559][T13238] ? __fget_files+0x3a2/0x420 [ 572.155592][T13238] do_recvmmsg+0x38b/0x7f0 [ 572.155620][T13238] ? __pfx_do_recvmmsg+0x10/0x10 [ 572.155651][T13238] ? __mutex_unlock_slowpath+0x731/0x900 [ 572.155688][T13238] __sys_recvmmsg+0x1a5/0x290 [ 572.155710][T13238] ? __pfx___sys_recvmmsg+0x10/0x10 [ 572.155730][T13238] ? ksys_write+0x242/0x270 [ 572.155761][T13238] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 572.155788][T13238] __do_fast_syscall_32+0x27a/0x6a0 [ 572.155815][T13238] ? do_fast_syscall_32+0x33/0x70 [ 572.155839][T13238] ? asm_int80_emulation+0x1a/0x20 [ 572.155857][T13238] ? do_int80_emulation+0x299/0x500 [ 572.155880][T13238] ? trace_irq_disable+0x3b/0x140 [ 572.155903][T13238] do_fast_syscall_32+0x33/0x70 [ 572.155928][T13238] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 572.155950][T13238] RIP: 0023:0xf708f0ec [ 572.155968][T13238] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 572.155985][T13238] RSP: 002b:00000000f547d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 572.156008][T13238] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 572.156022][T13238] RDX: 0000000000000001 RSI: 0000000000002100 RDI: 0000000000000000 [ 572.156033][T13238] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 572.156045][T13238] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 572.156057][T13238] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 572.156083][T13238] [ 572.220183][ T1925] usb 4-1: USB disconnect, device number 17 [ 572.502676][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 572.502710][ T9] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 572.561285][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 572.612450][ T9] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 572.624347][ T9] usb 3-1: USB disconnect, device number 16 [ 573.115418][T13253] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2449'. [ 573.115474][T13253] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2449'. [ 573.742026][ T5622] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 573.751963][ T5622] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 573.759332][ T5622] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 573.773322][ T5622] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 573.783403][ T5622] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 574.547829][ T5710] usb 5-1: USB disconnect, device number 82 [ 574.547925][ C1] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 574.940042][ T8537] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.303126][ T8537] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.559288][T13287] FAULT_INJECTION: forcing a failure. [ 575.559288][T13287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 575.560734][T13287] CPU: 1 UID: 0 PID: 13287 Comm: syz.0.2458 Tainted: G L syzkaller #0 PREEMPT(full) [ 575.560768][T13287] Tainted: [L]=SOFTLOCKUP [ 575.560776][T13287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 575.560789][T13287] Call Trace: [ 575.560797][T13287] [ 575.560807][T13287] dump_stack_lvl+0xe8/0x150 [ 575.560837][T13287] should_fail_ex+0x410/0x560 [ 575.560867][T13287] _copy_from_user+0x2d/0xb0 [ 575.560887][T13287] get_compat_msghdr+0xb3/0x4c0 [ 575.560923][T13287] ? __pfx_get_compat_msghdr+0x10/0x10 [ 575.560970][T13287] ___sys_sendmsg+0x201/0x360 [ 575.560989][T13287] ? __lock_acquire+0x6df/0x2e50 [ 575.561012][T13287] ? __pfx____sys_sendmsg+0x10/0x10 [ 575.561035][T13287] ? kstrtoull+0x137/0x1d0 [ 575.561081][T13287] ? __fget_files+0x2a/0x420 [ 575.561104][T13287] ? __fget_files+0x3a2/0x420 [ 575.561136][T13287] __sys_sendmmsg+0x2de/0x4d0 [ 575.561160][T13287] ? __pfx___sys_sendmmsg+0x10/0x10 [ 575.561204][T13287] ? fput+0xa0/0xd0 [ 575.561225][T13287] ? ksys_write+0x242/0x270 [ 575.561257][T13287] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 575.561282][T13287] __do_fast_syscall_32+0x27a/0x6a0 [ 575.561308][T13287] ? do_fast_syscall_32+0x33/0x70 [ 575.561332][T13287] ? asm_int80_emulation+0x1a/0x20 [ 575.561350][T13287] ? do_int80_emulation+0x299/0x500 [ 575.561373][T13287] ? trace_irq_disable+0x3b/0x140 [ 575.561395][T13287] do_fast_syscall_32+0x33/0x70 [ 575.561420][T13287] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 575.561442][T13287] RIP: 0023:0xf703f0ec [ 575.561461][T13287] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 575.561478][T13287] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 575.561500][T13287] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000480 [ 575.561514][T13287] RDX: 00000000000002e9 RSI: 0000000000000000 RDI: 0000000000000000 [ 575.561526][T13287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 575.561537][T13287] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 575.561549][T13287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 575.561576][T13287] [ 575.711873][ T8537] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.823950][ T5622] Bluetooth: hci6: command tx timeout [ 576.193089][ T8548] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 576.318183][ T8537] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.533725][ T5677] usb 7-1: new full-speed USB device number 33 using dummy_hcd [ 576.694629][ T5677] usb 7-1: unable to get BOS descriptor or descriptor too short [ 576.695320][ T5677] usb 7-1: not running at top speed; connect to a high speed hub [ 576.695361][ T5677] usb 7-1: New USB device found, idVendor=0763, idProduct=0150, bcdDevice= 0.40 [ 576.697828][T13263] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.702060][T13263] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.710161][T13263] bridge_slave_0: entered allmulticast mode [ 576.710659][ T5677] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.710683][ T5677] usb 7-1: Product: syz [ 576.710697][ T5677] usb 7-1: Manufacturer: syz [ 576.710711][ T5677] usb 7-1: SerialNumber: syz [ 576.732306][T13263] bridge_slave_0: entered promiscuous mode [ 576.754696][T13263] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.754938][T13263] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.755118][T13263] bridge_slave_1: entered allmulticast mode [ 576.771989][T13263] bridge_slave_1: entered promiscuous mode [ 576.818563][T13306] FAULT_INJECTION: forcing a failure. [ 576.818563][T13306] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 576.818619][T13306] CPU: 0 UID: 0 PID: 13306 Comm: syz.0.2463 Tainted: G L syzkaller #0 PREEMPT(full) [ 576.818643][T13306] Tainted: [L]=SOFTLOCKUP [ 576.818649][T13306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 576.818659][T13306] Call Trace: [ 576.818668][T13306] [ 576.818678][T13306] dump_stack_lvl+0xe8/0x150 [ 576.818708][T13306] should_fail_ex+0x410/0x560 [ 576.818745][T13306] _copy_from_user+0x2d/0xb0 [ 576.818762][T13306] cmsghdr_from_user_compat_to_kern+0x534/0x810 [ 576.818782][T13306] ? lock_acquire+0x115/0x350 [ 576.818807][T13306] ? __pfx_cmsghdr_from_user_compat_to_kern+0x10/0x10 [ 576.818843][T13306] ____sys_sendmsg+0x217/0x850 [ 576.818865][T13306] ? __pfx_____sys_sendmsg+0x10/0x10 [ 576.818894][T13306] ___sys_sendmsg+0x2a5/0x360 [ 576.818908][T13306] ? __lock_acquire+0x6df/0x2e50 [ 576.818927][T13306] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.818942][T13306] ? get_pid_task+0x20/0x1f0 [ 576.818959][T13306] ? get_pid_task+0x20/0x1f0 [ 576.818975][T13306] ? get_pid_task+0x20/0x1f0 [ 576.819020][T13306] ? __fget_files+0x2a/0x420 [ 576.819046][T13306] ? __fget_files+0x3a2/0x420 [ 576.819082][T13306] __sys_sendmsg+0x177/0x240 [ 576.819104][T13306] ? __pfx___sys_sendmsg+0x10/0x10 [ 576.819143][T13306] __do_fast_syscall_32+0x27a/0x6a0 [ 576.819173][T13306] ? do_fast_syscall_32+0x33/0x70 [ 576.819198][T13306] ? asm_int80_emulation+0x1a/0x20 [ 576.819218][T13306] ? do_int80_emulation+0x299/0x500 [ 576.819243][T13306] ? trace_irq_disable+0x3b/0x140 [ 576.819267][T13306] do_fast_syscall_32+0x33/0x70 [ 576.819294][T13306] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 576.819318][T13306] RIP: 0023:0xf703f0ec [ 576.819336][T13306] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 576.819354][T13306] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 576.819376][T13306] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 576.819389][T13306] RDX: 0000000000008050 RSI: 0000000000000000 RDI: 0000000000000000 [ 576.819401][T13306] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 576.819413][T13306] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 576.819425][T13306] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 576.819453][T13306] [ 577.056065][ T5677] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 577.056120][ T5677] usb 7-1: MIDIStreaming interface descriptor not found [ 577.163842][T13308] FAULT_INJECTION: forcing a failure. [ 577.163842][T13308] name failslab, interval 1, probability 0, space 0, times 0 [ 577.163900][T13308] CPU: 0 UID: 0 PID: 13308 Comm: syz.0.2464 Tainted: G L syzkaller #0 PREEMPT(full) [ 577.163928][T13308] Tainted: [L]=SOFTLOCKUP [ 577.163935][T13308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.163945][T13308] Call Trace: [ 577.163954][T13308] [ 577.163962][T13308] dump_stack_lvl+0xe8/0x150 [ 577.163995][T13308] should_fail_ex+0x410/0x560 [ 577.164028][T13308] should_failslab+0xa8/0x100 [ 577.164050][T13308] ? alloc_empty_file+0x5b/0x1d0 [ 577.164074][T13308] kmem_cache_alloc_noprof+0xa1/0x600 [ 577.164105][T13308] ? alloc_empty_file+0x5b/0x1d0 [ 577.164137][T13308] alloc_empty_file+0x5b/0x1d0 [ 577.164162][T13308] alloc_file_pseudo+0x115/0x1e0 [ 577.164189][T13308] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 577.164209][T13308] ? security_inode_alloc+0xd5/0x310 [ 577.164233][T13308] ? inode_init_always_gfp+0x994/0xd30 [ 577.164264][T13308] sock_alloc_file+0xb8/0x2e0 [ 577.164292][T13308] do_accept+0x3a0/0x750 [ 577.164323][T13308] ? __pfx_do_accept+0x10/0x10 [ 577.164369][T13308] __sys_accept4+0x139/0x230 [ 577.164399][T13308] ? __pfx___sys_accept4+0x10/0x10 [ 577.164425][T13308] ? ksys_write+0x242/0x270 [ 577.164460][T13308] __ia32_sys_accept4+0x9a/0xb0 [ 577.164488][T13308] __do_fast_syscall_32+0x27a/0x6a0 [ 577.164520][T13308] ? do_fast_syscall_32+0x33/0x70 [ 577.164547][T13308] ? asm_int80_emulation+0x1a/0x20 [ 577.164568][T13308] ? do_int80_emulation+0x299/0x500 [ 577.164600][T13308] do_fast_syscall_32+0x33/0x70 [ 577.164628][T13308] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 577.164653][T13308] RIP: 0023:0xf703f0ec [ 577.164672][T13308] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 577.164690][T13308] RSP: 002b:00000000f542d50c EFLAGS: 00000206 ORIG_RAX: 000000000000016c [ 577.164713][T13308] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 577.164727][T13308] RDX: 0000000000000000 RSI: 0000000000080800 RDI: 0000000000000000 [ 577.164739][T13308] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 577.164751][T13308] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 577.164763][T13308] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 577.164794][T13308] [ 577.509697][T13263] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.536578][T13263] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.554938][ T983] bond4: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 577.556970][ T5677] usb 7-1: USB disconnect, device number 33 [ 577.574398][ T983] bond4: (slave veth5): making interface the new active one [ 577.620576][ T983] bond4: active interface up! [ 577.839404][T13318] netlink: 'syz.3.2468': attribute type 1 has an invalid length. [ 577.892668][T13263] team0: Port device team_slave_0 added [ 577.902977][T13263] team0: Port device team_slave_1 added [ 577.905123][ T5622] Bluetooth: hci6: command tx timeout [ 578.036614][ T8553] bond6: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 578.055093][ T8553] bond6: (slave veth9): making interface the new active one [ 578.078090][ T8553] bond6: active interface up! [ 578.104285][ T5677] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 578.167510][T13318] 8021q: adding VLAN 0 to HW filter on device bond13 [ 578.244421][ T8537] pim6reg: left allmulticast mode [ 578.265913][ T5677] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 578.277567][ T8537] tipc: Resetting bearer [ 578.289657][ T5677] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 578.303420][ T5677] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.324551][ T5677] usb 7-1: config 0 descriptor?? [ 578.343939][ T1834] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 578.528664][ T1834] usb 3-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 578.530985][ T1834] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 578.531016][ T1834] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 578.532469][ T1834] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 578.532491][ T1834] usb 3-1: Product: syz [ 578.532505][ T1834] usb 3-1: Manufacturer: syz [ 578.562123][ T1834] mos7840 3-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 578.591781][ T5677] usbhid 7-1:0.0: can't add hid device: -71 [ 578.591914][ T5677] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 578.625855][ T5677] usb 7-1: USB disconnect, device number 34 [ 579.114555][ T5677] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 579.115407][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 579.311544][ T5677] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 579.324489][ T5677] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 579.324562][ T5677] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.362285][ T5677] usb 7-1: config 0 descriptor?? [ 579.370928][ T8537] batman_adv: batadv0: Interface deactivated: macsec1 [ 579.387919][ T8537] batman_adv: batadv0: Removing interface: macsec1 [ 579.558767][ T8537] tipc: Disabling bearer [ 579.777821][ T8537] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 579.811246][ T8537] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 579.844477][ T8537] bond0 (unregistering): Released all slaves [ 579.918178][ T8537] bond1 (unregistering): (slave dummy0): Releasing active interface [ 579.942861][ T8537] bond1 (unregistering): Released all slaves [ 579.983722][ T5622] Bluetooth: hci6: command tx timeout [ 580.075425][ T8537] bond2 (unregistering): (slave veth3): Releasing active interface [ 580.131993][ T8537] bond2 (unregistering): Released all slaves [ 580.182036][ T8537] bond3 (unregistering): Released all slaves [ 580.205641][ T5677] aiptek 7-1:0.0: Aiptek using 400 ms programming speed [ 580.226153][ T5677] input: Aiptek as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input65 [ 580.239748][ T8537] bond4 (unregistering): Released all slaves [ 580.300792][ T8537] bond5 (unregistering): Released all slaves [ 580.377387][ T8537] bond6 (unregistering): (slave veth5): Releasing active interface [ 580.385679][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 580.401115][ T8537] bond6 (unregistering): Released all slaves [ 580.426951][ T9] usb 7-1: USB disconnect, device number 35 [ 580.433058][ C1] aiptek 7-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 580.548829][ T8537] bond7 (unregistering): (slave veth7): Releasing active interface [ 580.589123][ T8537] bond7 (unregistering): Released all slaves [ 580.669393][ T8537] bond8 (unregistering): (slave veth9): Releasing active interface [ 580.682981][ T8537] bond8 (unregistering): Released all slaves [ 580.736440][ T8537] bond9 (unregistering): Released all slaves [ 580.759722][ T8537] bond10 (unregistering): (slave veth11): Releasing active interface [ 580.777059][ T8537] bond10 (unregistering): Released all slaves [ 580.803068][ T8537] bond11 (unregistering): (slave veth13): Releasing active interface [ 580.826140][ T8537] bond11 (unregistering): Released all slaves [ 580.908735][ T5281] 8021q: adding VLAN 0 to HW filter on device eth5 [ 580.922628][T13263] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 580.922680][T13263] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.922712][T13263] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 581.055850][T13263] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 581.055890][T13263] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.055938][T13263] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 581.203138][ T1834] mos7840 ttyUSB0: probe with driver mos7840 failed with error -71 [ 581.259160][ T1834] usb 3-1: USB disconnect, device number 17 [ 581.303247][ T1834] mos7840 3-1:1.0: device disconnected [ 581.349845][ T8537] tipc: Disabling bearer [ 581.372263][ T8537] tipc: Disabling bearer [ 581.372445][ T8537] tipc: Left network mode [ 581.386430][ T8537] IPVS: stopping master sync thread 12637 ... [ 581.422264][ T983] bond3: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 581.435029][T13355] netlink: 'syz.3.2474': attribute type 1 has an invalid length. [ 581.443144][ T983] bond3: (slave veth3): making interface the new active one [ 581.531825][ T983] bond3: active interface up! [ 581.543768][ T9] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 581.556722][T13263] hsr_slave_0: entered promiscuous mode [ 581.564973][T13263] hsr_slave_1: entered promiscuous mode [ 581.565822][T13263] debugfs: 'hsr0' already exists in 'hsr' [ 581.565843][T13263] Cannot create hsr debugfs directory [ 581.696765][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 581.697518][ T9] usb 7-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 581.699653][ T9] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 581.699683][ T9] usb 7-1: config 0 interface 0 has no altsetting 0 [ 581.701797][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.701819][ T9] usb 7-1: Product: syz [ 581.701833][ T9] usb 7-1: Manufacturer: syz [ 581.701847][ T9] usb 7-1: SerialNumber: syz [ 581.706962][ T9] usb 7-1: config 0 descriptor?? [ 581.956729][ C0] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 581.970664][ T9] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input66 [ 582.031489][ T9] imon:send_packet: packet tx failed (-71) [ 582.048990][ T9] imon 7-1:0.0: panel buttons/knobs setup failed [ 582.064665][ T5622] Bluetooth: hci6: command tx timeout [ 582.257753][ T125] bond5: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 582.266592][ T125] bond5: (slave veth7): making interface the new active one [ 582.273795][ T9] rc_core: IR keymap rc-imon-pad not found [ 582.273813][ T9] Registered IR keymap rc-empty [ 582.273891][ T9] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 582.273908][ T9] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 582.274215][ T9] imon:send_packet: packet tx failed (-71) [ 582.303419][ T125] bond5: active interface up! [ 582.307283][ T9] imon 7-1:0.0: remote input dev register failed [ 582.307461][ T9] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 582.420421][ T8537] hsr_slave_0: left promiscuous mode [ 582.439797][ T8537] hsr_slave_1: left promiscuous mode [ 582.447288][ T8537] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 582.455795][ T8537] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 582.474889][ T8537] veth1_macvtap: left promiscuous mode [ 582.480522][ T8537] veth0_macvtap: left promiscuous mode [ 582.488784][ T8537] veth1_vlan: left promiscuous mode [ 582.694773][ T9] imon 7-1:0.0: unable to initialize intf0, err 0 [ 582.694831][ T9] imon:imon_probe: failed to initialize context! [ 582.696896][ T9] imon 7-1:0.0: unable to register, err -19 [ 582.723438][ T9] usb 7-1: USB disconnect, device number 36 [ 582.987559][T13378] FAULT_INJECTION: forcing a failure. [ 582.987559][T13378] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 582.987619][T13378] CPU: 0 UID: 0 PID: 13378 Comm: syz.2.2476 Tainted: G L syzkaller #0 PREEMPT(full) [ 582.987649][T13378] Tainted: [L]=SOFTLOCKUP [ 582.987658][T13378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 582.987670][T13378] Call Trace: [ 582.987679][T13378] [ 582.987689][T13378] dump_stack_lvl+0xe8/0x150 [ 582.987730][T13378] should_fail_ex+0x410/0x560 [ 582.987777][T13378] _copy_from_iter+0x1d3/0x1660 [ 582.987806][T13378] ? __alloc_skb+0x27a/0x7a0 [ 582.987839][T13378] ? __alloc_skb+0x27a/0x7a0 [ 582.987868][T13378] ? __alloc_skb+0x27a/0x7a0 [ 582.987895][T13378] ? __pfx__copy_from_iter+0x10/0x10 [ 582.987922][T13378] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 582.987952][T13378] ? __alloc_skb+0x27a/0x7a0 [ 582.987981][T13378] ? __alloc_skb+0x27a/0x7a0 [ 582.988014][T13378] ? netlink_sendmsg+0x650/0xb40 [ 582.988039][T13378] ? skb_put+0x112/0x210 [ 582.988070][T13378] netlink_sendmsg+0x6c0/0xb40 [ 582.988103][T13378] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.988134][T13378] ? apparmor_socket_sendmsg+0x18b/0x360 [ 582.988167][T13378] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.988189][T13378] sock_sendmsg_nosec+0x13a/0x180 [ 582.988218][T13378] ____sys_sendmsg+0x54e/0x850 [ 582.988243][T13378] ? __pfx_____sys_sendmsg+0x10/0x10 [ 582.988279][T13378] ___sys_sendmsg+0x2a5/0x360 [ 582.988298][T13378] ? __lock_acquire+0x6df/0x2e50 [ 582.988326][T13378] ? __pfx____sys_sendmsg+0x10/0x10 [ 582.988345][T13378] ? get_pid_task+0x20/0x1f0 [ 582.988366][T13378] ? get_pid_task+0x20/0x1f0 [ 582.988383][T13378] ? get_pid_task+0x20/0x1f0 [ 582.988431][T13378] ? __fget_files+0x2a/0x420 [ 582.988457][T13378] ? __fget_files+0x3a2/0x420 [ 582.988492][T13378] __sys_sendmsg+0x177/0x240 [ 582.988515][T13378] ? __pfx___sys_sendmsg+0x10/0x10 [ 582.988561][T13378] __do_fast_syscall_32+0x27a/0x6a0 [ 582.988594][T13378] ? do_fast_syscall_32+0x33/0x70 [ 582.988620][T13378] ? asm_int80_emulation+0x1a/0x20 [ 582.988641][T13378] ? do_int80_emulation+0x299/0x500 [ 582.988666][T13378] ? trace_irq_disable+0x3b/0x140 [ 582.988691][T13378] do_fast_syscall_32+0x33/0x70 [ 582.988715][T13378] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 582.988737][T13378] RIP: 0023:0xf708f0ec [ 582.988765][T13378] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 582.988781][T13378] RSP: 002b:00000000f547d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 582.988802][T13378] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 582.988816][T13378] RDX: 0000000024000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 582.988828][T13378] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 582.988839][T13378] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 582.988851][T13378] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 582.988879][T13378] [ 583.064715][ T9] usb 7-1: new full-speed USB device number 37 using dummy_hcd [ 583.255885][ T9] usb 7-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 583.270788][ T9] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 583.270822][ T9] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 583.270848][ T9] usb 7-1: config 0 interface 0 has no altsetting 0 [ 583.289068][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.289097][ T9] usb 7-1: Product: syz [ 583.289111][ T9] usb 7-1: Manufacturer: syz [ 583.289124][ T9] usb 7-1: SerialNumber: syz [ 583.299126][ T9] usb 7-1: config 0 descriptor?? [ 583.300111][T13349] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 583.555312][ C0] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 583.574300][ T965] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 583.634606][ T9] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input68 [ 583.688117][ T8537] team0 (unregistering): Port device vlan1 removed [ 583.734612][ T965] usb 3-1: Using ep0 maxpacket: 8 [ 583.737131][ T965] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 583.739684][ T965] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 583.739799][ T965] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 583.739823][ T965] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 583.739849][ T965] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 583.739873][ T965] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 583.739941][ T965] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.944012][ T9] rc_core: IR keymap rc-imon-pad not found [ 583.944058][ T9] Registered IR keymap rc-empty [ 583.944162][ T9] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 583.944181][ T9] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 583.978366][ T965] usb 3-1: usb_control_msg returned -32 [ 583.978425][ T965] usbtmc 3-1:16.0: can't read capabilities [ 584.022823][ T9] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 584.056472][ T9] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input69 [ 584.111307][ T8537] team0 (unregistering): Port device team_slave_1 removed [ 584.118985][ T9] imon 7-1:0.0: iMON device (15c2:0045, intf0) on usb<7:37> initialized [ 584.166837][ T8537] team0 (unregistering): Port device team_slave_0 removed [ 584.185528][ T9] usb 7-1: USB disconnect, device number 37 [ 584.541872][ T5281] 8021q: adding VLAN 0 to HW filter on device eth6 [ 585.967912][T13263] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 586.000406][T13263] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 586.003849][T13263] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 586.018650][T13263] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 586.023670][T13263] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 586.037516][T13263] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 586.040692][T13263] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 586.060932][T13263] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 586.166813][ T32] INFO: task kworker/1:1:30 blocked for more than 143 seconds. [ 586.166877][ T32] Tainted: G L syzkaller #0 [ 586.166906][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 586.166918][ T32] task:kworker/1:1 state:D stack:20808 pid:30 tgid:30 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 586.166971][ T32] Workqueue: usb_hub_wq hub ** replaying previous printk message ** [ 586.166971][ T32] Workqueue: usb_hub_wq hub_event [ 586.167077][ T32] Call Trace: [ 586.167085][ T32] [ 586.167099][ T32] __schedule+0x17d4/0x5820 [ 586.167143][ T32] ? hub_event+0x28e8/0x4d30 [ 586.167177][ T32] ? __pfx___schedule+0x10/0x10 [ 586.167197][ T32] ? lock_acquire+0x115/0x350 [ 586.167227][ T32] ? schedule+0x90/0x2b0 [ 586.167254][ T32] schedule+0x164/0x2b0 [ 586.167279][ T32] schedule_timeout+0xc0/0x2c0 [ 586.167300][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 586.167322][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 586.167357][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 586.167380][ T32] ? wait_for_completion+0x272/0x5e0 [ 586.167404][ T32] wait_for_completion+0x2ca/0x5e0 [ 586.167440][ T32] ? __pfx_wait_for_completion+0x10/0x10 [ 586.167470][ T32] ? kobject_put+0x50f/0x550 [ 586.167548][ T32] i2c_del_adapter+0x281/0x430 [ 586.167637][ T32] ? __pfx_i2c_del_adapter+0x10/0x10 [ 586.167664][ T32] ? dvb_usbv2_exit+0x94d/0xb80 [ 586.167765][ T32] dvb_usbv2_probe+0x4bb/0x3950 [ 586.167816][ T32] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 586.167842][ T32] ? __pm_runtime_set_status+0x994/0xc80 [ 586.167924][ T32] usb_probe_interface+0x788/0xe50 [ 586.167972][ T32] ? __pfx_usb_probe_interface+0x10/0x10 [ 586.167997][ T32] ? sysfs_do_create_link_sd+0xe0/0x110 [ 586.168028][ T32] ? driver_sysfs_add+0x1fe/0x210 [ 586.168099][ T32] ? __pfx_usb_probe_interface+0x10/0x10 [ 586.168118][ T32] really_probe+0x254/0xae0 [ 586.168151][ T32] __driver_probe_device+0x1e8/0x360 [ 586.168181][ T32] driver_probe_device+0x4f/0x240 [ 586.168212][ T32] __device_attach_driver+0x270/0x410 [ 586.168244][ T32] bus_for_each_drv+0x258/0x2f0 [ 586.168268][ T32] ? __pfx___device_attach_driver+0x10/0x10 [ 586.168296][ T32] ? __pfx_bus_for_each_drv+0x10/0x10 [ 586.168321][ T32] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 586.168348][ T32] __device_attach+0x2c4/0x450 [ 586.170216][ T32] ? __pfx___device_attach+0x10/0x10 [ 586.170247][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 586.170275][ T32] ? _raw_spin_unlock+0x28/0x50 [ 586.170300][ T32] device_initial_probe+0xa1/0xd0 [ 586.170328][ T32] bus_probe_device+0x12a/0x220 [ 586.170354][ T32] device_add+0x7d7/0xb80 [ 586.170412][ T32] usb_set_configuration+0x1ad8/0x2180 [ 586.170466][ T32] usb_generic_driver_probe+0x8d/0x150 [ 586.170532][ T32] usb_probe_device+0x1c3/0x3b0 [ 586.170555][ T32] ? __pfx_usb_probe_device+0x10/0x10 [ 586.170572][ T32] really_probe+0x254/0xae0 [ 586.170604][ T32] __driver_probe_device+0x1e8/0x360 [ 586.170633][ T32] driver_probe_device+0x4f/0x240 [ 586.170662][ T32] __device_attach_driver+0x270/0x410 [ 586.170693][ T32] bus_for_each_drv+0x258/0x2f0 [ 586.170723][ T32] ? __pfx___device_attach_driver+0x10/0x10 [ 586.170750][ T32] ? __pfx_bus_for_each_drv+0x10/0x10 [ 586.170775][ T32] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 586.170802][ T32] __device_attach+0x2c4/0x450 [ 586.170830][ T32] ? __pfx___device_attach+0x10/0x10 [ 586.170856][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 586.170883][ T32] ? _raw_spin_unlock+0x28/0x50 [ 586.170907][ T32] device_initial_probe+0xa1/0xd0 [ 586.170935][ T32] bus_probe_device+0x12a/0x220 [ 586.170961][ T32] device_add+0x7d7/0xb80 [ 586.170988][ T32] usb_new_device+0x9aa/0x1690 [ 586.171051][ T32] ? __pfx_usb_new_device+0x10/0x10 [ 586.171079][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 586.171105][ T32] hub_event+0x28e8/0x4d30 [ 586.171178][ T32] ? __pfx_hub_event+0x10/0x10 [ 586.171212][ T32] ? rcu_is_watching+0x16/0xb0 [ 586.171237][ T32] ? process_scheduled_works+0x97a/0x1630 [ 586.171261][ T32] process_scheduled_works+0xc3d/0x1630 [ 586.171315][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 586.171345][ T32] ? assign_work+0x3cf/0x5d0 [ 586.171374][ T32] worker_thread+0xa47/0xfb0 [ 586.171424][ T32] kthread+0x38b/0x480 [ 586.171443][ T32] ? __pfx_worker_thread+0x10/0x10 [ 586.171465][ T32] ? __pfx_kthread+0x10/0x10 [ 586.171485][ T32] ret_from_fork+0x514/0xb70 [ 586.171520][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 586.171548][ T32] ? __switch_to+0xc89/0x1420 [ 586.171578][ T32] ? __pfx_kthread+0x10/0x10 [ 586.171599][ T32] ret_from_fork_asm+0x1a/0x30 [ 586.171643][ T32] [ 586.171777][ T32] INFO: task syz.5.1778:11013 blocked for more than 143 seconds. [ 586.171870][ T32] Tainted: G L syzkaller #0 [ 586.171882][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 586.171892][ T32] task:syz.5.1778 state:D stack:27880 pid:11013 tgid:11012 ppid:9363 task_flags:0x400140 flags:0x08080002 [ 586.171950][ T32] Call Trace: [ 586.171958][ T32] [ 586.171971][ T32] __schedule+0x17d4/0x5820 [ 586.172023][ T32] ? __pfx___schedule+0x10/0x10 [ 586.172056][ T32] ? schedule+0x90/0x2b0 [ 586.172083][ T32] schedule+0x164/0x2b0 [ 586.172109][ T32] schedule_preempt_disabled+0x13/0x30 [ 586.172132][ T32] __mutex_lock+0x7c1/0x1550 [ 586.172162][ T32] ? __mutex_lock+0x5d4/0x1550 [ 586.172191][ T32] ? usbdev_open+0x151/0x770 [ 586.172215][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 586.172242][ T32] ? bus_find_device+0x27d/0x2d0 [ 586.172267][ T32] ? __pfx_bus_find_device+0x10/0x10 [ 586.172290][ T32] ? usbdev_open+0xa7/0x770 [ 586.172310][ T32] ? usbdev_open+0xa7/0x770 [ 586.172338][ T32] usbdev_open+0x151/0x770 [ 586.172365][ T32] ? __pfx_usbdev_open+0x10/0x10 [ 586.172389][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 586.172418][ T32] chrdev_open+0x4d9/0x600 [ 586.172443][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 586.172463][ T32] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 586.172508][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 586.172528][ T32] do_dentry_open+0x816/0x1380 [ 586.172561][ T32] vfs_open+0x3b/0x340 [ 586.172580][ T32] ? path_openat+0x1428/0x1d60 [ 586.172609][ T32] path_openat+0x1443/0x1d60 [ 586.172654][ T32] do_file_open+0x23e/0x4a0 [ 586.172686][ T32] ? __pfx_do_file_open+0x10/0x10 [ 586.172743][ T32] ? _raw_spin_unlock+0x28/0x50 [ 586.172764][ T32] ? alloc_fd+0x651/0x6c0 [ 586.172797][ T32] do_sys_openat2+0x115/0x200 [ 586.172822][ T32] ? __pfx_do_sys_openat2+0x10/0x10 [ 586.172845][ T32] ? rcu_is_watching+0x16/0xb0 [ 586.172875][ T32] __ia32_compat_sys_openat+0x131/0x160 [ 586.172930][ T32] do_int80_emulation+0x198/0x500 [ 586.172956][ T32] ? trace_irq_disable+0x3b/0x140 [ 586.172975][ T32] ? asm_int80_emulation+0x1a/0x20 [ 586.172993][ T32] ? clear_bhb_loop+0x70/0xc0 [ 586.173012][ T32] ? clear_bhb_loop+0x70/0xc0 [ 586.173035][ T32] asm_int80_emulation+0x1a/0x20 [ 586.173054][ T32] RIP: 0023:0xf71175ab [ 586.173072][ T32] RSP: 002b:00000000f53d603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 586.173092][ T32] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53d6100 [ 586.173106][ T32] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 586.173119][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 586.173131][ T32] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 586.173143][ T32] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 586.173171][ T32] [ 586.173180][ T32] INFO: task syz.5.1778:11025 blocked for more than 143 seconds. [ 586.173196][ T32] Tainted: G L syzkaller #0 [ 586.173207][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 586.173216][ T32] task:syz.5.1778 state:D stack:28080 pid:11025 tgid:11012 ppid:9363 task_flags:0x400040 flags:0x08080002 [ 586.173272][ T32] Call Trace: [ 586.173279][ T32] [ 586.173291][ T32] __schedule+0x17d4/0x5820 [ 586.173341][ T32] ? __pfx___schedule+0x10/0x10 [ 586.173372][ T32] ? schedule+0x90/0x2b0 [ 586.173397][ T32] schedule+0x164/0x2b0 [ 586.173422][ T32] schedule_preempt_disabled+0x13/0x30 [ 586.188785][ T32] __mutex_lock+0x7c1/0x1550 [ 586.188830][ T32] ? __mutex_lock+0x5d4/0x1550 [ 586.188860][ T32] ? usbdev_open+0x151/0x770 [ 586.188883][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 586.188909][ T32] ? bus_find_device+0x27d/0x2d0 [ 586.188934][ T32] ? __pfx_bus_find_device+0x10/0x10 [ 586.188956][ T32] ? usbdev_open+0xa7/0x770 [ 586.188974][ T32] ? usbdev_open+0xa7/0x770 [ 586.189001][ T32] usbdev_open+0x151/0x770 [ 586.189028][ T32] ? __pfx_usbdev_open+0x10/0x10 [ 586.189051][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 586.189081][ T32] chrdev_open+0x4d9/0x600 [ 586.189104][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 586.189125][ T32] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 586.189159][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 586.189178][ T32] do_dentry_open+0x816/0x1380 [ 586.189211][ T32] vfs_open+0x3b/0x340 [ 586.189229][ T32] ? path_openat+0x1428/0x1d60 [ 586.189258][ T32] path_openat+0x1443/0x1d60 [ 586.189303][ T32] do_file_open+0x23e/0x4a0 [ 586.189336][ T32] ? __pfx_do_file_open+0x10/0x10 [ 586.189384][ T32] ? _raw_spin_unlock+0x28/0x50 [ 586.189404][ T32] ? alloc_fd+0x651/0x6c0 [ 586.189437][ T32] do_sys_openat2+0x115/0x200 [ 586.189462][ T32] ? __pfx_do_sys_openat2+0x10/0x10 [ 586.189484][ T32] ? rcu_is_watching+0x16/0xb0 [ 586.189516][ T32] __ia32_compat_sys_openat+0x131/0x160 [ 586.189544][ T32] do_int80_emulation+0x198/0x500 [ 586.189569][ T32] ? trace_irq_disable+0x3b/0x140 [ 586.189587][ T32] ? asm_int80_emulation+0x1a/0x20 [ 586.189606][ T32] ? clear_bhb_loop+0x70/0xc0 [ 586.189640][ T32] ? clear_bhb_loop+0x70/0xc0 [ 586.189664][ T32] asm_int80_emulation+0x1a/0x20 [ 586.189683][ T32] RIP: 0023:0xf71175ab [ 586.189701][ T32] RSP: 002b:00000000f53b503c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 586.189730][ T32] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53b5100 [ 586.189744][ T32] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 586.189756][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 586.189767][ T32] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 586.189779][ T32] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 586.189808][ T32] [ 586.189850][ T32] [ 586.189850][ T32] Showing all locks held in the system: [ 586.189902][ T32] locks held by pr/ttyS0/16: 2, last CPU#1: [ 586.189965][ T32] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 586.190041][ T32] #1: ffff8880b8726118 (&base->lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 586.190097][ T32] locks held by kworker/1:1/30: 5, on CPU#1: [ 586.190112][ T32] #0: ffff88802368a140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 586.190165][ T32] #1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 586.190217][ T32] #2: ffff88802a2961d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 586.190271][ T32] #3: ffff88807afbb1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 586.190323][ T32] #4: ffff88807a7a81a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 586.190513][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 586.190528][ T32] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 586.190601][ T32] locks held by getty/5376: 2, on CPU#1: [ 586.190616][ T32] #0: ffff888035f6e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 586.190720][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 586.190803][ T32] locks held by udevd/7922: 4, on CPU#0: [ 586.190818][ T32] #0: ffff88802fabd3f8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 586.190863][ T32] #1: ffff88807a8f6880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 586.190917][ T32] #2: ffff88802ab054b8 (kn->active#26){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 586.190970][ T32] #3: ffff88807afbb1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 586.191027][ T32] locks held by syz.5.1778/11013: 1, on CPU#0: [ 586.191042][ T32] #0: ffff88802a2961d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 [ 586.191088][ T32] locks held by syz.5.1778/11025: 1, on CPU#1: [ 586.191706][ T32] #0: ffff88802a2961d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 [ 586.191770][ T32] locks held by syz-executor/13263: 3, on CPU#0: [ 586.191784][ T32] #0: ffffffff902c0b28 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 586.191833][ T32] #1: ffffffff902c0960 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 586.191882][ T32] #2: ffffffff9024fd40 (rtnl_mutex){+.+.}-{4:4}, at: wg_set_device_doit+0x170/0x2120 [ 586.191978][ T32] locks held by dhcpcd-run-hook/13395: 3, last CPU#1: [ 586.191992][ T32] #0: ffff888029e8f678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 586.192044][ T32] #1: ffff88803444c8b0 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0x119/0x720 [ 586.192116][ T32] #2: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 586.192165][ T32] locks held by syz.6.2484/13412: 1, on CPU#0: [ 586.192179][ T32] #0: ffff888028d20260 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_wait_for_connect+0x398/0x6e0 [ 586.192232][ T32] locks held by syz.6.2484/13414: 1, last CPU#0: [ 586.192245][ T32] #0: ffff888028d20260 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sendmsg+0xbb8/0x2d00 [ 586.192293][ T32] locks held by syz.6.2484/13416: 1, last CPU#0: [ 586.192306][ T32] #0: ffffffff9024fd40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 [ 586.192360][ T32] [ 586.192366][ T32] ============================================= [ 586.192366][ T32] [ 586.192375][ T32] NMI backtrace for cpu 0 [ 586.192391][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 586.192415][ T32] Tainted: [L]=SOFTLOCKUP [ 586.192422][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.192433][ T32] Call Trace: [ 586.192441][ T32] [ 586.192449][ T32] dump_stack_lvl+0xe8/0x150 [ 586.192476][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 586.192519][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 586.192555][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 586.192578][ T32] sys_info+0x135/0x170 [ 586.192595][ T32] watchdog+0xfd7/0x1030 [ 586.192626][ T32] ? watchdog+0x1c7/0x1030 [ 586.192650][ T32] kthread+0x38b/0x480 [ 586.192668][ T32] ? __pfx_watchdog+0x10/0x10 [ 586.192684][ T32] ? __pfx_kthread+0x10/0x10 [ 586.192703][ T32] ret_from_fork+0x514/0xb70 [ 586.192741][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 586.192767][ T32] ? __switch_to+0xc89/0x1420 [ 586.192793][ T32] ? __pfx_kthread+0x10/0x10 [ 586.192812][ T32] ret_from_fork_asm+0x1a/0x30 [ 586.192852][ T32] [ 586.192860][ T32] Sending NMI from CPU 0 to CPUs 1: [ 586.192907][ C1] NMI backtrace for cpu 1 [ 586.192924][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.192950][ C1] Tainted: [L]=SOFTLOCKUP [ 586.192958][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.192968][ C1] RIP: 0010:delay_tsc+0x73/0xd0 [ 586.192991][ C1] Code: e8 32 43 b3 f5 65 48 8b 05 fa 68 b2 07 48 85 c0 74 1c f3 90 bf 01 00 00 00 e8 c9 41 b3 f5 e8 84 7a 01 00 39 c5 75 0e 0f 01 f9 <66> 90 eb bb e8 24 ce 51 f5 eb dd 4c 29 fb e8 6a 7a 01 00 89 c5 0f [ 586.193008][ C1] RSP: 0000:ffffc900001578b8 EFLAGS: 00000046 [ 586.193026][ C1] RAX: 00000000c6d53cfd RBX: 0000000000000899 RCX: 0000000000000001 [ 586.193040][ C1] RDX: 0000000000000131 RSI: ffffffff8c6d8b60 RDI: ffffffff8c6d8b20 [ 586.193054][ C1] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004 [ 586.193065][ C1] R10: dffffc0000000000 R11: ffffffff8be196c0 R12: 1ffffffff35a5659 [ 586.193079][ C1] R13: 00000000ffffffff R14: 00000131c6d536fb R15: 0000000000000548 [ 586.193092][ C1] FS: 0000000000000000(0000) GS:ffff888124de0000(0000) knlGS:0000000000000000 [ 586.193108][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 586.193122][ C1] CR2: 00007fffcc764008 CR3: 0000000065b9a000 CR4: 00000000003526f0 [ 586.193140][ C1] Call Trace: [ 586.193148][ C1] [ 586.193158][ C1] wait_for_lsr+0x147/0x2f0 [ 586.193268][ C1] __serial8250_console_fifo_write+0xcd/0x3e0 [ 586.193313][ C1] serial8250_console_write+0xaa1/0x1200 [ 586.193338][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 586.193365][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 586.193388][ C1] ? __schedule+0x17ea/0x5820 [ 586.193416][ C1] nbcon_emit_next_record+0xef5/0x1a90 [ 586.193442][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 586.193464][ C1] ? nbcon_context_try_acquire+0x819/0xbd0 [ 586.193489][ C1] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 586.193512][ C1] nbcon_kthread_func+0x679/0x880 [ 586.193536][ C1] ? nbcon_kthread_func+0x163/0x880 [ 586.193557][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 586.193581][ C1] ? __kthread_parkme+0x71/0x1f0 [ 586.193610][ C1] ? __kthread_parkme+0x199/0x1f0 [ 586.193642][ C1] kthread+0x38b/0x480 [ 586.193662][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 586.193682][ C1] ? __pfx_kthread+0x10/0x10 [ 586.193702][ C1] ret_from_fork+0x514/0xb70 [ 586.193735][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 586.193767][ C1] ? __switch_to+0xc89/0x1420 [ 586.193793][ C1] ? __pfx_kthread+0x10/0x10 [ 586.193813][ C1] ret_from_fork_asm+0x1a/0x30 [ 586.193849][ C1] [ 586.207739][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 587.880637][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 587.891321][ T32] Tainted: [L]=SOFTLOCKUP [ 587.895646][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 587.905879][ T32] Call Trace: [ 587.909166][ T32] [ 587.912097][ T32] vpanic+0x56d/0xa60 [ 587.916102][ T32] ? __pfx___schedule+0x10/0x10 [ 587.920963][ T32] ? __pfx_vpanic+0x10/0x10 [ 587.925483][ T32] panic+0xc5/0xd0 [ 587.929221][ T32] ? __pfx_panic+0x10/0x10 [ 587.933652][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 587.939137][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 587.944518][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 587.950679][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 587.956835][ T32] watchdog+0x1030/0x1030 [ 587.961286][ T32] ? watchdog+0x1c7/0x1030 [ 587.965710][ T32] kthread+0x38b/0x480 [ 587.969804][ T32] ? __pfx_watchdog+0x10/0x10 [ 587.974482][ T32] ? __pfx_kthread+0x10/0x10 [ 587.979172][ T32] ret_from_fork+0x514/0xb70 [ 587.983800][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 587.988920][ T32] ? __switch_to+0xc89/0x1420 [ 587.993604][ T32] ? __pfx_kthread+0x10/0x10 [ 587.998197][ T32] ret_from_fork_asm+0x1a/0x30 [ 588.002999][ T32] [ 588.006428][ T32] Kernel Offset: disabled [ 588.010752][ T32] Rebooting in 86400 seconds..